|
Log-Analyse und Auswertung: GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in QuarantäneWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
15.09.2014, 14:29 | #1 |
| GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Hallo! Ich bin neu hier, GDATA hat gerade den Virus Win32.Adware.Conduit.B in "AppData" 3 mal gefunden & den Virus Win32.Adware.Ibryte.R in einer anderen Datei. Die Viren konnten nicht desinfiziert werden, daher sind sie jetzt in Quarantäne. Außerdem habe ich sonst noch 50 andere Viren in Quarantäne, die früher mal nicht desinfiziert werden konnten (hoffe, dass Quarantäne wirklich = kein Schaden heißt). Soll ich etwas unternehmen? Habe letztens etwas per Kreditkarte gekauft, besteht die Gefahr, dass die Informationen ausgelesen wurden? Wollte gerade meine Log Files mit Farbar's Recovery Scan Tool posten, habe gelesen das ist nötig, aber da erkennt GDATA "erunt.exe" gestartet von cmd.exe und sagt es sei eine Bedrohung. Was soll ich tun? |
15.09.2014, 14:48 | #2 |
/// the machine /// TB-Ausbilder | GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
15.09.2014, 16:02 | #3 |
| GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Danke schonmal, aber bereits wenn ich den Scan starte wird eben die Unbekannte Bedrohung "erunt.exe" erkannt. Soll ich das in die Quarantäne verschieben? Bevor ich das nicht weiß kann ich den Scan nicht laufen lassen.
__________________Gut, habs einfach laufen lassen: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014 Ran by Tino (administrator) on TINO-PC on 15-09-2014 16:56:52 Running from C:\Users\Tino\Downloads Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\stacsv64.exe (Hewlett-Packard) C:\Windows\System32\hpservice.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Akamai Technologies, Inc.) C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (Spotify Ltd) C:\Users\Tino\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Microsoft) C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\GUI\GDSC.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunes.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company) HKLM\...\Run: [Unattend0000000001{CBF3078B-5A06-4E8A-B429-5783F1589DDA}] => %SYSTEMDRIVE%\restore\createrestore.exe /r HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-18] (IDT, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2013-09-30] () HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2010-02-25] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HPConnectionManager] => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-05-23] (Hewlett-Packard Development Company L.P.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-07] (Geek Software GmbH) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-09-09] (Apple Inc.) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ScCertProp: wlnotify.dll [X] HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-18] (Akamai Technologies, Inc.) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Spotify] => C:\Users\Tino\AppData\Roaming\Spotify\Spotify.exe [6170168 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Spotify Web Helper] => C:\Users\Tino\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\MountPoints2: {5697a708-8805-11e3-8258-88ae1dacdee7} - E:\SETUP.EXE ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {CB927D12-4FF7-4A9E-A169-56E4B8A75598} hxxp://qtinstall.apple.com/qtactivex/qtplugin.cab Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: 74.208.10.249 gs.apple.com Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation) Chrome: ======= CHR Profile: C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-25] CHR Extension: (Google Drive) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-25] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-15] CHR Extension: (YouTube) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-25] CHR Extension: (Google-Suche) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-25] CHR Extension: (FoxyProxy Standard) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcknhkkoolaabfmlnjonogaaifnjlfnp [2014-09-13] CHR Extension: (Google Wallet) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-25] CHR Extension: (Google Mail) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-25] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation) R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-07-30] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG) R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3227624 2014-08-06] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG) R2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [204576 2014-06-25] (Microsoft) R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe [244224 2009-11-18] (IDT, Inc.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-28] (Disc Soft Ltd) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-29] (G Data Software AG) R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-29] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-09-15] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-29] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-09-15] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-07-30] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-29] (G Data Software AG) R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-15 16:56 - 2014-09-15 16:57 - 00017157 _____ () C:\Users\Tino\Downloads\FRST.txt 2014-09-15 15:25 - 2014-09-15 16:57 - 00000000 ____D () C:\FRST 2014-09-15 15:21 - 2014-09-15 15:22 - 02105856 _____ (Farbar) C:\Users\Tino\Downloads\FRST64.exe 2014-09-15 14:07 - 2014-09-15 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2014-09-12 08:52 - 2014-09-12 09:13 - 00013307 _____ () C:\Users\Tino\Desktop\Handyverträge_v03.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00010137 _____ () C:\Users\Tino\Desktop\Handyverträge_v02.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00000123 _____ () C:\Users\Tino\Desktop\comdirect.txt 2014-09-11 23:46 - 2014-09-11 23:46 - 00009176 _____ () C:\Users\Tino\Desktop\Handyverträge.xlsx 2014-09-11 23:46 - 2014-09-11 23:46 - 00008199 _____ () C:\Users\Tino\Desktop\Chrome Lesezeichen.xlsx 2014-09-10 19:12 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-10 19:12 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-09-10 19:12 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-10 19:12 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-10 19:12 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-10 19:12 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-09-10 19:12 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-10 19:12 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-10 19:12 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-10 19:12 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-10 19:12 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-10 19:12 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-10 19:12 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-10 19:12 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-10 19:12 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-10 19:12 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-10 19:12 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-09-10 19:12 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-10 19:12 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-10 19:12 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-09-10 19:12 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-10 19:12 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-09-10 19:12 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-09-10 19:12 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-09-10 19:12 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-09-10 19:12 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-09-10 19:12 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-10 19:12 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-09-10 19:12 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-09-10 19:12 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-09-10 19:12 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-09-10 19:12 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-10 19:12 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-10 19:12 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-10 19:12 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-10 19:12 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-09-10 19:12 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-09-10 19:12 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-09-10 19:12 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-09-10 19:12 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-10 19:12 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-09-10 19:12 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-10 19:12 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-09-10 19:12 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-09-10 19:12 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-09-10 19:12 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-10 19:12 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-09-10 19:12 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-09-10 19:12 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-10 19:12 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-09-10 18:58 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-09-10 18:58 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-09-10 13:14 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-10 13:14 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-10 13:14 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-10 13:14 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-09-10 13:14 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-10 13:14 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-10 13:14 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-09-10 13:14 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-09-10 13:14 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-09-10 13:14 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-10 13:14 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-09-09 20:45 - 2014-09-09 20:45 - 00001852 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-09-09 20:45 - 2014-09-09 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-09-09 20:42 - 2014-09-09 20:46 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-09-08 22:17 - 2014-09-08 22:17 - 00039424 _____ () C:\Users\Tino\Downloads\Notenblatt_DStipendium_BSc.xls 2014-09-03 00:33 - 2014-09-03 00:33 - 00000308 _____ () C:\Users\Tino\Desktop\magic tricks stuart edge.txt 2014-08-30 20:17 - 2014-09-01 12:59 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\dvdcss 2014-08-30 00:01 - 2014-09-01 17:55 - 00000000 ____D () C:\Users\Tino\AppData\Local\FullTiltPoker.eu 2014-08-30 00:01 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\cache 2014-08-29 23:55 - 2014-08-29 23:57 - 54483208 _____ () C:\Users\Tino\Downloads\FullTiltPokerEuSetup.exe 2014-08-29 20:36 - 2014-08-29 23:45 - 00000000 ____D () C:\Users\Tino\AppData\Local\PokerStars.EU 2014-08-29 20:34 - 2014-08-29 23:55 - 00000000 ____D () C:\Program Files\Verschiedenes 2014-08-28 18:26 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 18:26 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 18:26 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-27 19:28 - 2014-08-27 19:29 - 00011539 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP_v02.xlsx 2014-08-26 14:58 - 2014-08-26 14:58 - 17279732 _____ () C:\Users\Tino\Downloads\redsn0w_win_0.9.15b3 (1).zip 2014-08-26 14:50 - 2014-08-26 14:50 - 03458048 _____ () C:\Users\Tino\Downloads\tinyumbrella-7.11.00 (1).exe 2014-08-26 14:43 - 2014-08-26 14:43 - 00408541 _____ () C:\Users\Tino\Downloads\ireb-r7.zip 2014-08-26 11:58 - 2014-08-26 11:59 - 00011381 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP.xlsx 2014-08-23 20:21 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-23 20:21 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-23 20:21 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-23 20:21 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-23 20:21 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-23 20:20 - 2014-05-14 14:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-23 20:20 - 2014-05-14 14:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-23 20:20 - 2014-05-14 14:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-23 20:20 - 2014-05-14 14:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-08-23 04:24 - 2014-08-23 04:24 - 00000137 _____ () C:\Users\Tino\Desktop\Varco Praktikum.txt 2014-08-19 20:53 - 2014-08-19 20:53 - 00000000 ____D () C:\Users\Tino\Desktop\Was ist das 2014-08-19 00:10 - 2014-08-19 00:10 - 00000286 _____ () C:\Users\Tino\Downloads\BK_PENG_002006DE_LC_64_22050_ster_A3BXOVXDGOB8X5.adh 2014-08-19 00:09 - 2014-08-19 00:09 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN (1).exe 2014-08-19 00:07 - 2014-08-29 17:03 - 00000000 ____D () C:\Users\Tino\AppData\Local\Audible 2014-08-19 00:07 - 2014-08-19 00:07 - 00255352 _____ (Audible, Inc.) C:\Windows\SysWOW64\awrdscdc.ax 2014-08-19 00:07 - 2014-08-19 00:07 - 00001972 _____ () C:\Users\Tino\Desktop\Audible Manager.lnk 2014-08-18 23:53 - 2014-08-19 00:08 - 00000000 ____D () C:\Users\Tino\Documents\Iphone Backup manuell 2014-08-18 23:52 - 2014-08-19 00:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager 2014-08-18 23:52 - 2014-08-19 00:07 - 00000000 ____D () C:\Program Files (x86)\Audible 2014-08-18 23:52 - 2014-08-18 23:52 - 00000000 ____D () C:\Users\Tino\Documents\Audible 2014-08-18 23:52 - 2014-08-18 23:52 - 00000000 ____D () C:\Users\Public\Documents\Audible 2014-08-18 23:52 - 2003-03-19 02:20 - 01060864 ____N (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll 2014-08-18 23:52 - 2003-03-19 01:14 - 00499712 ____N (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll 2014-08-18 23:52 - 2003-02-21 09:42 - 00348160 ____N (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2014-08-18 23:52 - 2001-08-18 03:43 - 00024576 ____N (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll 2014-08-18 23:51 - 2014-08-18 23:51 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN.exe 2014-08-18 22:18 - 2014-08-19 00:37 - 00009794 _____ () C:\Users\Tino\Documents\Books Audiobooks_18Aug14.xlsx 2014-08-17 22:53 - 2014-08-17 22:53 - 00000081 _____ () C:\Users\Tino\Desktop\Hilda Call_17Aug.txt 2014-08-17 17:44 - 2014-08-17 17:44 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-08-16 02:50 - 2014-08-16 02:50 - 00010841 _____ () C:\Users\Tino\Documents\Flüge Rio Deutschland.xlsx ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-15 16:57 - 2014-09-15 16:56 - 00017157 _____ () C:\Users\Tino\Downloads\FRST.txt 2014-09-15 16:57 - 2014-09-15 15:25 - 00000000 ____D () C:\FRST 2014-09-15 16:13 - 2014-01-23 17:35 - 01870817 _____ () C:\Windows\WindowsUpdate.log 2014-09-15 15:22 - 2014-09-15 15:21 - 02105856 _____ (Farbar) C:\Users\Tino\Downloads\FRST64.exe 2014-09-15 14:50 - 2014-01-25 01:51 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-15 14:22 - 2013-11-27 11:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-15 14:18 - 2009-07-14 06:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-15 14:18 - 2009-07-14 06:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-09-15 14:12 - 2014-02-13 01:31 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Spotify 2014-09-15 14:10 - 2014-01-25 01:51 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-15 14:09 - 2013-11-27 14:06 - 00148910 _____ () C:\Windows\setupact.log 2014-09-15 14:09 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-15 14:07 - 2014-09-15 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2014-09-15 14:07 - 2014-01-23 16:45 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-09-15 14:07 - 2014-01-23 16:45 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-09-15 14:06 - 2014-07-29 03:18 - 00004114 _____ () C:\Windows\DPINST.LOG 2014-09-15 01:15 - 2014-01-28 16:42 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-15 01:14 - 2014-01-28 16:46 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2014-09-12 23:56 - 2014-08-08 21:27 - 00000000 ____D () C:\Users\Tino\Documents\Finanzen 2014-09-12 22:50 - 2014-01-25 01:51 - 00002182 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-09-12 09:13 - 2014-09-12 08:52 - 00013307 _____ () C:\Users\Tino\Desktop\Handyverträge_v03.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00010137 _____ () C:\Users\Tino\Desktop\Handyverträge_v02.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00000123 _____ () C:\Users\Tino\Desktop\comdirect.txt 2014-09-11 23:46 - 2014-09-11 23:46 - 00009176 _____ () C:\Users\Tino\Desktop\Handyverträge.xlsx 2014-09-11 23:46 - 2014-09-11 23:46 - 00008199 _____ () C:\Users\Tino\Desktop\Chrome Lesezeichen.xlsx 2014-09-10 19:09 - 2013-11-27 11:04 - 01592824 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-09-10 19:09 - 2011-04-12 09:43 - 00699160 _____ () C:\Windows\system32\perfh007.dat 2014-09-10 19:09 - 2011-04-12 09:43 - 00149268 _____ () C:\Windows\system32\perfc007.dat 2014-09-10 19:09 - 2009-07-14 07:13 - 01592824 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-10 19:08 - 2014-08-05 23:13 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-10 19:00 - 2014-08-05 23:13 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-10 18:58 - 2014-05-06 07:12 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-09-10 18:46 - 2014-03-29 05:16 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\vlc 2014-09-09 20:46 - 2014-09-09 20:42 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-09-09 20:45 - 2014-09-09 20:45 - 00001852 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-09-09 20:45 - 2014-09-09 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-09-08 22:17 - 2014-09-08 22:17 - 00039424 _____ () C:\Users\Tino\Downloads\Notenblatt_DStipendium_BSc.xls 2014-09-08 14:05 - 2014-08-08 20:37 - 00000000 ____D () C:\Users\Tino\Documents\Bildung 2014-09-05 04:10 - 2014-09-10 13:14 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-05 04:05 - 2014-09-10 13:14 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-05 00:07 - 2014-08-08 20:36 - 00000000 ____D () C:\Users\Tino\Documents\Personal Development 2014-09-03 00:33 - 2014-09-03 00:33 - 00000308 _____ () C:\Users\Tino\Desktop\magic tricks stuart edge.txt 2014-09-02 23:45 - 2014-07-24 05:54 - 00000000 ____D () C:\Users\Tino\Documents\Praktika 2014-09-01 17:55 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\FullTiltPoker.eu 2014-09-01 12:59 - 2014-08-30 20:17 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\dvdcss 2014-08-30 00:01 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\cache 2014-08-29 23:57 - 2014-08-29 23:55 - 54483208 _____ () C:\Users\Tino\Downloads\FullTiltPokerEuSetup.exe 2014-08-29 23:55 - 2014-08-29 20:34 - 00000000 ____D () C:\Program Files\Verschiedenes 2014-08-29 23:45 - 2014-08-29 20:36 - 00000000 ____D () C:\Users\Tino\AppData\Local\PokerStars.EU 2014-08-29 20:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-08-29 17:03 - 2014-08-19 00:07 - 00000000 ____D () C:\Users\Tino\AppData\Local\Audible 2014-08-29 12:42 - 2009-07-14 06:45 - 00438168 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-27 19:29 - 2014-08-27 19:28 - 00011539 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP_v02.xlsx 2014-08-27 14:48 - 2010-11-21 05:47 - 00019508 _____ () C:\Windows\PFRO.log 2014-08-26 14:58 - 2014-08-26 14:58 - 17279732 _____ () C:\Users\Tino\Downloads\redsn0w_win_0.9.15b3 (1).zip 2014-08-26 14:57 - 2014-08-10 21:56 - 00000877 _____ () C:\Windows\system32\Drivers\etc\hosts.umbrella 2014-08-26 14:57 - 2014-08-10 21:56 - 00000213 _____ () C:\Users\Tino\umbrella0.log 2014-08-26 14:57 - 2014-08-10 19:57 - 00011223 _____ () C:\Users\Tino\Downloads\umbrella.log 2014-08-26 14:57 - 2014-01-23 17:44 - 00000000 ____D () C:\Users\Tino 2014-08-26 14:50 - 2014-08-26 14:50 - 03458048 _____ () C:\Users\Tino\Downloads\tinyumbrella-7.11.00 (1).exe 2014-08-26 14:43 - 2014-08-26 14:43 - 00408541 _____ () C:\Users\Tino\Downloads\ireb-r7.zip 2014-08-26 11:59 - 2014-08-26 11:58 - 00011381 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP.xlsx 2014-08-25 00:18 - 2014-01-25 03:19 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Skype 2014-08-23 04:24 - 2014-08-23 04:24 - 00000137 _____ () C:\Users\Tino\Desktop\Varco Praktikum.txt 2014-08-23 04:07 - 2014-08-28 18:26 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 03:45 - 2014-08-28 18:26 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-23 02:59 - 2014-08-28 18:26 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-19 20:53 - 2014-08-19 20:53 - 00000000 ____D () C:\Users\Tino\Desktop\Was ist das 2014-08-19 20:05 - 2014-09-10 19:12 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-19 19:39 - 2014-09-10 19:12 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-19 01:01 - 2014-09-10 19:12 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-19 00:37 - 2014-08-18 22:18 - 00009794 _____ () C:\Users\Tino\Documents\Books Audiobooks_18Aug14.xlsx 2014-08-19 00:29 - 2014-09-10 19:12 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-19 00:29 - 2014-09-10 19:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-19 00:26 - 2014-09-10 19:12 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-19 00:20 - 2014-09-10 19:12 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-19 00:19 - 2014-09-10 19:12 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-19 00:15 - 2014-09-10 19:12 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-19 00:15 - 2014-09-10 19:12 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-19 00:14 - 2014-09-10 19:12 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-19 00:14 - 2014-09-10 19:12 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-19 00:10 - 2014-08-19 00:10 - 00000286 _____ () C:\Users\Tino\Downloads\BK_PENG_002006DE_LC_64_22050_ster_A3BXOVXDGOB8X5.adh 2014-08-19 00:09 - 2014-08-19 00:09 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN (1).exe 2014-08-19 00:08 - 2014-09-10 19:12 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-19 00:08 - 2014-09-10 19:12 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-19 00:08 - 2014-09-10 19:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-19 00:08 - 2014-08-18 23:53 - 00000000 ____D () C:\Users\Tino\Documents\Iphone Backup manuell 2014-08-19 00:07 - 2014-08-19 00:07 - 00255352 _____ (Audible, Inc.) C:\Windows\SysWOW64\awrdscdc.ax 2014-08-19 00:07 - 2014-08-19 00:07 - 00001972 _____ () C:\Users\Tino\Desktop\Audible Manager.lnk 2014-08-19 00:07 - 2014-08-18 23:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager 2014-08-19 00:07 - 2014-08-18 23:52 - 00000000 ____D () C:\Program Files (x86)\Audible 2014-08-19 00:05 - 2014-09-10 19:12 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-19 00:03 - 2014-09-10 19:12 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-19 00:03 - 2014-09-10 19:12 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-19 00:03 - 2014-09-10 19:12 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-18 23:57 - 2014-09-10 19:12 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-18 23:56 - 2014-09-10 19:12 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-18 23:52 - 2014-08-18 23:52 - 00000000 ____D () C:\Users\Tino\Documents\Audible 2014-08-18 23:52 - 2014-08-18 23:52 - 00000000 ____D () C:\Users\Public\Documents\Audible 2014-08-18 23:51 - 2014-09-10 19:12 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-18 23:51 - 2014-08-18 23:51 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN.exe 2014-08-18 23:46 - 2014-09-10 19:12 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-18 23:45 - 2014-09-10 19:12 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-18 23:45 - 2014-09-10 19:12 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-18 23:44 - 2014-09-10 19:12 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-08-18 23:44 - 2014-09-10 19:12 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-08-18 23:42 - 2014-09-10 19:12 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-18 23:40 - 2014-09-10 19:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-18 23:39 - 2014-09-10 19:12 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-18 23:39 - 2014-09-10 19:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-18 23:39 - 2014-09-10 19:12 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-18 23:38 - 2014-09-10 19:12 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-18 23:37 - 2014-09-10 19:12 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-18 23:36 - 2014-09-10 19:12 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-18 23:35 - 2014-09-10 19:12 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-08-18 23:27 - 2014-09-10 19:12 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-18 23:25 - 2014-09-10 19:12 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-18 23:25 - 2014-09-10 19:12 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-18 23:23 - 2014-09-10 19:12 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-18 23:23 - 2014-09-10 19:12 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-18 23:22 - 2014-09-10 19:12 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-08-18 23:19 - 2014-09-10 19:12 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-18 23:17 - 2014-09-10 19:12 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-18 23:17 - 2014-09-10 19:12 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-18 23:16 - 2014-09-10 19:12 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-18 23:15 - 2014-09-10 19:12 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-18 23:15 - 2014-09-10 19:12 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-18 23:09 - 2014-09-10 19:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-18 23:08 - 2014-09-10 19:12 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-18 23:07 - 2014-09-10 19:12 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-08-18 22:55 - 2014-09-10 19:12 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-18 22:46 - 2014-09-10 19:12 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-18 22:38 - 2014-09-10 19:12 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-18 22:38 - 2014-09-10 19:12 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-18 22:36 - 2014-09-10 19:12 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-08-17 22:53 - 2014-08-17 22:53 - 00000081 _____ () C:\Users\Tino\Desktop\Hilda Call_17Aug.txt 2014-08-17 17:53 - 2014-01-23 17:44 - 00111520 _____ () C:\Users\Tino\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-17 17:44 - 2014-08-17 17:44 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER 2014-08-17 17:44 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-08-16 02:50 - 2014-08-16 02:50 - 00010841 _____ () C:\Users\Tino\Documents\Flüge Rio Deutschland.xlsx Some content of TEMP: ==================== C:\Users\Tino\AppData\Local\Temp\amazonicon_v4.exe C:\Users\Tino\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Tino\AppData\Local\Temp\bitool.dll C:\Users\Tino\AppData\Local\Temp\memoPERS_free.exe C:\Users\Tino\AppData\Local\Temp\ose00000.exe C:\Users\Tino\AppData\Local\Temp\sdanircmdc.exe C:\Users\Tino\AppData\Local\Temp\sdapskill.exe C:\Users\Tino\AppData\Local\Temp\sdaspwn.exe C:\Users\Tino\AppData\Local\Temp\_unps.exe C:\Users\Tino\AppData\Local\Temp\{4F8ED1F5-5C76-4BD1-A905-50A280DE78CD}-35.0.1916.153_35.0.1916.114_chrome_updater_alt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-07 09:07 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014 Ran by Tino at 2014-09-15 16:58:22 Running from C:\Users\Tino\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: G DATA INTERNET SECURITY (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0} AS: G DATA INTERNET SECURITY (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: G DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) µTorrent (HKCU\...\uTorrent) (Version: 3.4.1.30888 - BitTorrent Inc.) Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.8.800.94 - Adobe Systems Incorporated) Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated) Adobe Reader XI (11.0.03) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated) Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc) Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AudibleManager (HKLM-x32\...\AudibleManager) (Version: 2010397950.48.56.6163690 - Audible, Inc.) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Cossacks Anthology (HKLM-x32\...\Cossacks Anthology_is1) (Version: - GOG.com) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd) Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{9719DFA1-7CB0-422E-98AE-C77FD3426BE8}) (Version: - Microsoft) doPDF (Version: 8.0.910 - Softland) Hidden doPDF 8 (HKLM-x32\...\{d3e39f93-195c-43bb-b222-19a5b4b0bf3f}) (Version: 8.0.910 - Softland) Download.am (HKLM-x32\...\Download.am) (Version: - ) Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Free YouTube Download version 3.2.31.325 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.31.325 - DVDVideoSoft Ltd.) Free YouTube to MP3 Converter version 3.12.29.304 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.29.304 - DVDVideoSoft Ltd.) G DATA INTERNET SECURITY (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.2.1 - G DATA Software AG) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.) Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden Hex-Editor MX (HKLM-x32\...\{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1) (Version: 6.0 - NEXT-Soft) HP Battery Check (HKLM-x32\...\HP Battery Check) (Version: 4.3.2.2 - Hewlett-Packard) HP Battery Check (x32 Version: 4.3.2.2 - Hewlett-Packard) Hidden HP Connection Manager (HKLM-x32\...\{7A6B4340-7090-418F-8976-EE9650B35550}) (Version: 4.1.22.1 - Hewlett-Packard Company) HP Quick Launch Buttons (HKLM-x32\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.50.17.1 - Hewlett-Packard Company) HP Wireless Assistant (HKLM\...\{9EA86AD9-FB32-4B9E-BD56-3068F9B8031F}) (Version: 4.0.10.0 - Hewlett-Packard) IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6257.0 - IDT) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2413 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.) Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle) Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden Kalo24 - der Freeware-Kaloreinexperte 1.0.0.0 (HKLM-x32\...\Kalo24 - der Freeware-Kaloreinexperte) (Version: 1.0.0.0 - Ralph Borchert) KaloMa 4.94 (HKLM-x32\...\KaloMa_is1) (Version: - Frank Böpple) memoPERS 1.2 (HKLM-x32\...\memoPERS) (Version: 1.2 - Reinhold Vogt & Paul Finkler) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Access MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft DCF MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Excel MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Groove MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Lync MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office 32-bit Components 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Office Professional Plus 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft OneNote MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Outlook MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Publisher MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Word MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden novaPDF 8 Printer Driver (HKLM\...\{6240B066-54CB-4F8E-8460-EB96F125A87B}) (Version: 8.0.910 - Softland) Nur Entfernen der CopyTrans Suite möglich (HKCU\...\CopyTrans Suite) (Version: 2.37 - WindSolutions) Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden QLBCASL (x32 Version: 6.40.17.2 - Hewlett-Packard) Hidden QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.) Revisores de Texto do Microsoft Office 2013 – Português do Brasil (HKLM\...\{90150000-001F-0416-1000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation) RICOH Media Driver (HKLM-x32\...\{F5CC2EF8-20A4-4366-A681-3FE849E65809}) (Version: 2.10.00.04 - RICOH) Scorpyn Ticket Scanner (Full) (HKCU\...\c7b569b109308fbc) (Version: 1.0.0.18 - Scorpyn Ticket Scanner (Full)) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft) Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.) Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB) Update for Microsoft Excel 2013 (KB2889861) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{6A34D28A-A780-405D-BF1A-F054542A37C8}) (Version: - Microsoft) Update for Microsoft Excel 2013 (KB2889861) 64-Bit Edition (HKLM\...\{90150000-0018-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{6A34D28A-A780-405D-BF1A-F054542A37C8}) (Version: - Microsoft) Update for Microsoft Excel 2013 (KB2889861) 64-Bit Edition (HKLM\...\{90150000-001B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{6A34D28A-A780-405D-BF1A-F054542A37C8}) (Version: - Microsoft) Update for Microsoft Excel 2013 (KB2889861) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{6A34D28A-A780-405D-BF1A-F054542A37C8}) (Version: - Microsoft) Update for Microsoft Excel 2013 (KB2889861) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{6A34D28A-A780-405D-BF1A-F054542A37C8}) (Version: - Microsoft) Update for Microsoft Lync 2013 (KB2881083) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{F1FFD0B3-9F20-4EE7-ACED-5B63DFA018D8}) (Version: - Microsoft) Update for Microsoft Lync 2013 (KB2889860) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{75FECCEB-66B8-4376-8A25-6137D30D3C93}) (Version: - Microsoft) Update for Microsoft Lync 2013 (KB2889860) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{75FECCEB-66B8-4376-8A25-6137D30D3C93}) (Version: - Microsoft) Update for Microsoft Lync 2013 (KB2889860) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{75FECCEB-66B8-4376-8A25-6137D30D3C93}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2760249) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{7A4AB8E1-C091-4BD3-B308-844BA6EE752A}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2760344) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{EF77B4A6-DFEC-4010-A87D-9B6BF87FABEC}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2760544) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{62857CDD-2985-4939-91BA-19ED0B0031A5}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2768012) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{0814662C-FD28-4DE0-ACE5-EE50D1D6C8FB}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{E79EFFDB-192A-4D9E-A2DB-C0F774E6EC32}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E79EFFDB-192A-4D9E-A2DB-C0F774E6EC32}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2837644) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D692E9FF-84BF-4F44-A0EA-D58ECE0D538E}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2863843) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{290D80DE-03AB-47EC-9402-108AF4CE4F66}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2880478) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{8116ED50-F1E7-49E1-9D8D-421497D34B0F}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2881001) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{DF1B7B95-4A86-4605-A628-556394B5580A}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2881009) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{3033838D-15E0-4199-8CBD-A7F2057AE653}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2881035) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{885C981B-F1E3-430A-A099-31CA9D28C251}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2881035) 64-Bit Edition (HKLM\...\{90150000-0090-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{885C981B-F1E3-430A-A099-31CA9D28C251}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2881035) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{885C981B-F1E3-430A-A099-31CA9D28C251}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2881039) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{C675FC43-E413-49A7-B3DC-44967B4FE22D}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2881081) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{3BE27413-9FFE-4AB1-9013-344E111E718F}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2883036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E919ACF4-A1D7-4CAA-A103-5EB115563721}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2883049) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{39D9DAC1-16A7-430A-B2F3-4D3D000454D0}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2883060) 64-Bit Edition (HKLM\...\{90150000-001F-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{E12997A4-DAEC-4563-B330-F21EB71880D9}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2883060) 64-Bit Edition (HKLM\...\{90150000-001F-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{F9C35D99-CA8E-4D17-B785-66AC654D5664}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2883060) 64-Bit Edition (HKLM\...\{90150000-001F-040C-1000-0000000FF1CE}_Office15.PROPLUSR_{18C53DCB-FA98-4A7B-BC2E-6DA30D4E4901}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2883060) 64-Bit Edition (HKLM\...\{90150000-001F-0410-1000-0000000FF1CE}_Office15.PROPLUSR_{540B47E7-0F89-4CA1-8BFA-5CF377A963AF}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2889848) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{A9D59DD4-0591-447A-AEEB-DC1FEE5502BF}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2889848) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{A9D59DD4-0591-447A-AEEB-DC1FEE5502BF}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2889848) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{A9D59DD4-0591-447A-AEEB-DC1FEE5502BF}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2889862) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{CC0535B0-340B-4740-A63D-DBBE389DC83A}) (Version: - Microsoft) Update for Microsoft Office 2013 (KB2889862) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{CC0535B0-340B-4740-A63D-DBBE389DC83A}) (Version: - Microsoft) Update for Microsoft OneDrive for Business (KB2889866) 64-Bit Edition (HKLM\...\{90150000-00BA-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{6666C6C6-4AC6-4475-887E-5874B69EB414}) (Version: - Microsoft) Update for Microsoft OneDrive for Business (KB2889866) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{6666C6C6-4AC6-4475-887E-5874B69EB414}) (Version: - Microsoft) Update for Microsoft OneDrive for Business (KB2889866) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{6666C6C6-4AC6-4475-887E-5874B69EB414}) (Version: - Microsoft) Update for Microsoft OneDrive for Business (KB2889866) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{6666C6C6-4AC6-4475-887E-5874B69EB414}) (Version: - Microsoft) Update for Microsoft OneNote 2013 (KB2881082) 64-Bit Edition (HKLM\...\{90150000-00A1-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{BFD66A5D-F608-441E-9282-41E13F5E7412}) (Version: - Microsoft) Update for Microsoft OneNote 2013 (KB2881082) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{BFD66A5D-F608-441E-9282-41E13F5E7412}) (Version: - Microsoft) Update for Microsoft OneNote 2013 (KB2881082) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{BFD66A5D-F608-441E-9282-41E13F5E7412}) (Version: - Microsoft) Update for Microsoft Outlook 2013 (KB2881011) 64-Bit Edition (HKLM\...\{90150000-001A-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{679E6BE6-50D5-4D94-A10E-CB4FE1C5695B}) (Version: - Microsoft) Update for Microsoft Outlook 2013 (KB2881011) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{679E6BE6-50D5-4D94-A10E-CB4FE1C5695B}) (Version: - Microsoft) Update for Microsoft PowerPoint 2013 (KB2889847) 64-Bit Edition (HKLM\...\{90150000-0018-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{7F1008C2-8C87-497F-B6D8-56B53DA0FAB3}) (Version: - Microsoft) Update for Microsoft PowerPoint 2013 (KB2889847) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{7F1008C2-8C87-497F-B6D8-56B53DA0FAB3}) (Version: - Microsoft) Update for Microsoft Publisher 2013 (KB2880999) 64-Bit Edition (HKLM\...\{90150000-0019-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{C07147B9-CC0B-4CC1-A107-A705889A54F2}) (Version: - Microsoft) Update for Microsoft Publisher 2013 (KB2880999) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{C07147B9-CC0B-4CC1-A107-A705889A54F2}) (Version: - Microsoft) Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version: - Microsoft) Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version: - Microsoft) Update for Microsoft Word 2013 (KB2878319) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{BC51FE30-3A56-4802-8D9E-E9BC05B56B49}) (Version: - Microsoft) Update for Microsoft Word 2013 (KB2889852) 64-Bit Edition (HKLM\...\{90150000-001A-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{01839F84-E94C-4E47-BEBE-95DF9CAE5FF3}) (Version: - Microsoft) Update for Microsoft Word 2013 (KB2889852) 64-Bit Edition (HKLM\...\{90150000-001B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{01839F84-E94C-4E47-BEBE-95DF9CAE5FF3}) (Version: - Microsoft) Update for Microsoft Word 2013 (KB2889852) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUSR_{01839F84-E94C-4E47-BEBE-95DF9CAE5FF3}) (Version: - Microsoft) Update for Microsoft Word 2013 (KB2889852) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{01839F84-E94C-4E47-BEBE-95DF9CAE5FF3}) (Version: - Microsoft) VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN) Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation) Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 02-09-2014 13:58:41 Windows Update 05-09-2014 19:21:26 Windows Update 09-09-2014 06:36:59 Windows Update 09-09-2014 18:44:24 Installed QuickTime 7 10-09-2014 16:57:07 Windows Update 14-09-2014 23:12:25 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2014-08-26 14:57 - 00000877 ____A C:\Windows\system32\Drivers\etc\hosts 74.208.10.249 gs.apple.com ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {1177E4A6-0962-42D8-96CF-54911F6F0E99} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-25] (Google Inc.) Task: {485A89E0-095F-4007-96B5-E10F6716E9B5} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {75F2879E-732C-450E-917E-D5FA261646D7} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {A81A396F-2591-4871-B23D-54D0043792B8} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation) Task: {AD703F02-B1DD-48BE-A9A4-9A275F1F0C97} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-27] (Adobe Systems Incorporated) Task: {B6F1A382-9B7E-44BA-BBF2-216147048C9E} - System32\Tasks\doPDF Update => C:\Program Files\Softland\novaPDF 8\Driver\UpdateApplication.exe [2014-06-25] () Task: {D7A7FF80-A034-4132-B20F-F9E4381E0CE8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-25] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ? Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ? Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ? ==================== Loaded Modules (whitelisted) ============= 2014-07-03 17:59 - 2014-07-03 17:59 - 00130933 _____ () C:\Windows\TEMP\63dd21ca-afc5-4609-b75e-641bf1d44482\AgileDotNetRT64.dll 2014-07-03 18:00 - 2014-07-03 18:00 - 00130933 _____ () C:\Windows\TEMP\89bd6089-f9b6-4cf3-a5e6-fccc45ad15f3\AgileDotNetRT64.dll 2014-05-20 03:38 - 2014-05-20 03:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll 2010-07-21 15:33 - 2010-07-21 15:33 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll 2010-07-21 15:33 - 2010-07-21 15:33 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll 2010-07-21 15:33 - 2010-07-21 15:33 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll 2011-04-08 10:57 - 2011-04-08 10:57 - 01102336 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\System.Data.SQLite.dll 2009-07-01 16:44 - 2009-07-01 16:44 - 00632888 _____ () C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe 2014-02-13 01:58 - 2014-02-13 01:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2014-02-13 01:58 - 2014-02-13 01:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2011-04-08 10:57 - 2011-04-08 10:57 - 00514570 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll 2014-09-12 22:50 - 2014-09-04 05:01 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libglesv2.dll 2014-09-12 22:50 - 2014-09-04 05:01 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\libegl.dll 2014-09-12 22:50 - 2014-09-04 05:01 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\pdf.dll 2014-09-12 22:50 - 2014-09-04 05:01 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ppGoogleNaClPluginChrome.dll 2014-09-12 22:50 - 2014-09-04 05:01 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\ffmpegsumo.dll 2014-09-12 22:50 - 2014-09-04 05:01 - 14891848 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.120\PepperFlash\pepflashplayer.dll 2014-02-13 01:58 - 2014-02-13 01:58 - 00237384 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (09/15/2014 02:11:23 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. Error: (09/15/2014 02:07:32 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: setup.exe_G Data Security Setup, Version: 1.0.14155.738, Zeitstempel: 0x538ef28b Name des fehlerhaften Moduls: SHELL32.dll, Version: 6.1.7601.18517, Zeitstempel: 0x53aa285b Ausnahmecode: 0xc0000005 Fehleroffset: 0x000ad029 ID des fehlerhaften Prozesses: 0x1da0 Startzeit der fehlerhaften Anwendung: 0xsetup.exe_G Data Security Setup0 Pfad der fehlerhaften Anwendung: setup.exe_G Data Security Setup1 Pfad des fehlerhaften Moduls: setup.exe_G Data Security Setup2 Berichtskennung: setup.exe_G Data Security Setup3 Error: (09/15/2014 01:33:42 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. Error: (09/15/2014 00:56:54 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 234532 Error: (09/15/2014 00:56:54 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 234532 Error: (09/15/2014 00:56:54 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (09/15/2014 00:56:53 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 233533 Error: (09/15/2014 00:56:53 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 233533 Error: (09/15/2014 00:56:53 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (09/15/2014 00:56:52 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 232535 System errors: ============= Error: (09/13/2014 00:46:33 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "G Data AntiVirus Proxy" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error: (09/13/2014 11:25:32 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "novaPDF Server" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (09/13/2014 11:25:32 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst novaPDF Server erreicht. Error: (09/01/2014 03:38:01 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "novaPDF Server" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (09/01/2014 03:38:01 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst novaPDF Server erreicht. Error: (08/27/2014 06:00:06 PM) (Source: BROWSER) (EventID: 8032) (User: ) Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{3B940609-F2EB-4E8D-9A0F-424CFBE69C94}" zu oft fehl. Der Sicherungssuchdienst wird beendet. Error: (08/23/2014 04:13:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "novaPDF Server" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (08/23/2014 04:13:29 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst novaPDF Server erreicht. Error: (08/21/2014 04:16:43 AM) (Source: DCOM) (EventID: 10010) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Error: (08/18/2014 04:32:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "novaPDF Server" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Microsoft Office Sessions: ========================= Error: (09/15/2014 02:11:23 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/15/2014 02:07:32 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: setup.exe_G Data Security Setup1.0.14155.738538ef28bSHELL32.dll6.1.7601.1851753aa285bc0000005000ad0291da001cfd0dda0ae498fC:\Program Files (x86)\G Data\InternetSecurity\AVK\UpdatePGM\setup.exeC:\Windows\syswow64\SHELL32.dlldee7459f-3cd0-11e4-ba9b-88ae1dacdee7 Error: (09/15/2014 01:33:42 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/15/2014 00:56:54 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 234532 Error: (09/15/2014 00:56:54 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 234532 Error: (09/15/2014 00:56:54 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (09/15/2014 00:56:53 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 233533 Error: (09/15/2014 00:56:53 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 233533 Error: (09/15/2014 00:56:53 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (09/15/2014 00:56:52 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 232535 ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5 CPU M 520 @ 2.40GHz Percentage of memory in use: 49% Total physical RAM: 5941.78 MB Available physical RAM: 2985.09 MB Total Pagefile: 11881.73 MB Available Pagefile: 8236.26 MB Total Virtual: 8192 MB Available Virtual: 8191.84 MB ==================== Drives ================================ Drive c: (Windows) (Fixed) (Total:225.12 GB) (Free:74.47 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive e: (15.0.4420.1017) (CDROM) (Total:0.76 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: ABEAC3E5) Partition 1: (Not Active) - (Size=7.8 GB) - (Type=27) Partition 2: (Active) - (Size=225.1 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
16.09.2014, 10:55 | #4 |
/// the machine /// TB-Ausbilder | GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
17.09.2014, 11:17 | #5 |
| GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Hab alles gemacht. Noch etwas, was ich nicht verstehe:: Seit einigen Tagen habe ich beim Öffnen von Chrome stehen: "Internetverbindung wird kontrolliert. Eine Erweiterung hat die Kontrolle über ihre Proxyeinstellungen übernommen. Das bedeutet, dass diese Erweiterung sämtliche Onlineaktivitäten ändern, abbrechen oder überwachen kann. Wenn Sie nicht sicher sind, wie es zu dieser Änderung gekommen ist, war sie wahrscheinlich nicht beabsichtigt." Ich habe vermutet, dass das Problem bei der Erweiterung "FoxyProxy" liegt (die ich aber schon vor einigen Monaten installiert hatte. Die Meldung kam erst vor ein paar Tagen.). Entferne ich die Erweiterung und starte Chrome neu, erscheint die Seite "FoxyProxy was just updated" und FoxyProxy ist wieder installiert. mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 16.09.2014 Suchlauf-Zeit: 13:42:21 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.16.04 Rootkit Datenbank: v2014.09.15.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Tino Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 333293 Verstrichene Zeit: 15 Min, 34 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 1 PUP.Optional.Conduit.A, C:\Users\Tino\AppData\Local\Temp\ct3289075, In Quarantäne, [d480747a7cffd1656668ac2640c26e92], Dateien: 6 PUP.Optional.Somoto, C:\Users\Tino\AppData\Local\Temp\nseBC92.tmp, In Quarantäne, [f460b737f388fa3c873d017cb351ed13], PUP.Optional.Somoto, C:\Users\Tino\AppData\Local\Temp\bitool.dll, In Quarantäne, [6ee69955d4a792a43fe0cd8b0af8e61a], PUP.Optional.Conduit.A, C:\Users\Tino\AppData\Local\Temp\ct3289075\ctbe.exe, In Quarantäne, [5df7638b413a0c2af8c3d84689779b65], PUP.Optional.OpenCandy, C:\Users\Tino\Downloads\DTLite4481-0347.exe, In Quarantäne, [2a2a6688c1bab2849c9d879eb25344bc], PUP.Optional.Conduit.A, C:\Users\Tino\AppData\Local\Temp\ct3289075\chromeid.txt, In Quarantäne, [d480747a7cffd1656668ac2640c26e92], PUP.Optional.Conduit.A, C:\Users\Tino\AppData\Local\Temp\ct3289075\setup.ini.txt, In Quarantäne, [d480747a7cffd1656668ac2640c26e92], Physische Sektoren: 0 (No malicious items detected) (end) 1. Durchlauf: Code:
ATTFilter # AdwCleaner v3.310 - Bericht erstellt am 16/09/2014 um 14:53:25 # Aktualisiert 12/09/2014 von Xplode # Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits) # Benutzername : Tino - TINO-PC # Gestartet von : C:\Users\Tino\Downloads\AdwCleaner_3.310.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Datei Gelöscht : C:\END Datei Gelöscht : C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage Datei Gelöscht : C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage-journal Datei Gelöscht : C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.softonic.de_0.localstorage Datei Gelöscht : C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.softonic.de_0.localstorage-journal ***** [ Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17280 -\\ Google Chrome v37.0.2062.120 [ Datei : C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [1384 octets] - [16/09/2014 14:42:10] AdwCleaner[S0].txt - [1305 octets] - [16/09/2014 14:53:25] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1365 octets] ########## Code:
ATTFilter # AdwCleaner v3.310 - Bericht erstellt am 16/09/2014 um 20:13:41 # Aktualisiert 12/09/2014 von Xplode # Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits) # Benutzername : Tino - TINO-PC # Gestartet von : C:\Users\Tino\Downloads\AdwCleaner_3.310.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17280 -\\ Google Chrome v37.0.2062.120 [ Datei : C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [1384 octets] - [16/09/2014 14:42:10] AdwCleaner[R1].txt - [947 octets] - [16/09/2014 15:04:10] AdwCleaner[S0].txt - [1445 octets] - [16/09/2014 14:53:25] AdwCleaner[S1].txt - [869 octets] - [16/09/2014 20:13:41] ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [928 octets] ########## JRT.txt (Anmerkung: Habe vor diesem Durchlauf schon einmal einen Durchlauf gemacht, aber da wurde danach keine JRT.txt auf dem Desktop erstellt. Wurde evtl. abgebrochen, keine Ahnung ob da schon etwas währenddessen gelöscht wurde) Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Professional x64 Ran by Tino on 17.09.2014 at 11:45:15,46 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 17.09.2014 at 12:01:13,36 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST.txt FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014 Ran by Tino (administrator) on TINO-PC on 17-09-2014 12:09:43 Running from C:\Users\Tino\Downloads Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\stacsv64.exe (Hewlett-Packard) C:\Windows\System32\hpservice.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft) C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Akamai Technologies, Inc.) C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe (Spotify Ltd) C:\Users\Tino\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Akamai Technologies, Inc.) C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company) HKLM\...\Run: [Unattend0000000001{CBF3078B-5A06-4E8A-B429-5783F1589DDA}] => %SYSTEMDRIVE%\restore\createrestore.exe /r HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-18] (IDT, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2013-09-30] () HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2010-02-25] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HPConnectionManager] => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-05-23] (Hewlett-Packard Development Company L.P.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-07] (Geek Software GmbH) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-09-09] (Apple Inc.) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe, Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ScCertProp: wlnotify.dll [X] HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-18] (Akamai Technologies, Inc.) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Spotify] => C:\Users\Tino\AppData\Roaming\Spotify\Spotify.exe [6170168 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Spotify Web Helper] => C:\Users\Tino\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\MountPoints2: {5697a708-8805-11e3-8258-88ae1dacdee7} - E:\SETUP.EXE ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {CB927D12-4FF7-4A9E-A169-56E4B8A75598} hxxp://qtinstall.apple.com/qtactivex/qtplugin.cab Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: 74.208.10.249 gs.apple.com Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation) Chrome: ======= CHR Profile: C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-25] CHR Extension: (Google Drive) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-25] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-17] CHR Extension: (YouTube) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-25] CHR Extension: (Google-Suche) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-25] CHR Extension: (FoxyProxy Standard) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcknhkkoolaabfmlnjonogaaifnjlfnp [2014-09-13] CHR Extension: (Google Wallet) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-25] CHR Extension: (Google Mail) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-25] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation) R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-07-30] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG) R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3227624 2014-08-06] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [204576 2014-06-25] (Microsoft) R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe [244224 2009-11-18] (IDT, Inc.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-28] (Disc Soft Ltd) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-29] (G Data Software AG) R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-29] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-09-15] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-29] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-09-15] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-07-30] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-29] (G Data Software AG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-17] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-17 12:05 - 2014-09-16 20:14 - 00001007 _____ () C:\Users\Tino\Desktop\AdwCleaner[S1].txt 2014-09-17 12:05 - 2014-09-16 14:53 - 00001445 _____ () C:\Users\Tino\Desktop\AdwCleaner[S0].txt 2014-09-17 12:01 - 2014-09-17 12:01 - 00000624 _____ () C:\Users\Tino\Desktop\JRT.txt 2014-09-16 20:25 - 2014-09-16 20:25 - 00252925 _____ () C:\Users\Tino\Desktop\bookmarks_16.09.14.html 2014-09-16 20:23 - 2014-09-16 20:23 - 00000000 ____D () C:\Windows\ERUNT 2014-09-16 14:43 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-09-16 14:42 - 2014-09-16 20:14 - 00000000 ____D () C:\AdwCleaner 2014-09-16 14:42 - 2014-09-16 14:42 - 01016261 _____ (Thisisu) C:\Users\Tino\Downloads\JRT.exe 2014-09-16 14:41 - 2014-09-16 14:41 - 00001975 _____ () C:\Users\Tino\Desktop\mbam.txt 2014-09-16 13:41 - 2014-09-16 13:42 - 01373475 _____ () C:\Users\Tino\Downloads\AdwCleaner_3.310.exe 2014-09-16 13:40 - 2014-09-17 10:55 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-16 13:40 - 2014-09-16 13:40 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-09-16 13:40 - 2014-09-16 13:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:39 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-16 13:39 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-09-16 13:39 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-09-16 13:39 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-09-16 13:38 - 2014-09-16 13:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Tino\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-15 16:58 - 2014-09-15 16:59 - 00036613 _____ () C:\Users\Tino\Downloads\Addition.txt 2014-09-15 16:56 - 2014-09-17 12:09 - 00016872 _____ () C:\Users\Tino\Downloads\FRST.txt 2014-09-15 15:25 - 2014-09-17 12:09 - 00000000 ____D () C:\FRST 2014-09-15 15:21 - 2014-09-15 15:22 - 02105856 _____ (Farbar) C:\Users\Tino\Downloads\FRST64.exe 2014-09-15 14:07 - 2014-09-15 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2014-09-12 08:52 - 2014-09-12 09:13 - 00013307 _____ () C:\Users\Tino\Desktop\Handyverträge_v03.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00010137 _____ () C:\Users\Tino\Desktop\Handyverträge_v02.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00000123 _____ () C:\Users\Tino\Desktop\comdirect.txt 2014-09-11 23:46 - 2014-09-11 23:46 - 00009176 _____ () C:\Users\Tino\Desktop\Handyverträge.xlsx 2014-09-11 23:46 - 2014-09-11 23:46 - 00008199 _____ () C:\Users\Tino\Desktop\Chrome Lesezeichen.xlsx 2014-09-10 19:12 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-10 19:12 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-09-10 19:12 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-10 19:12 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-10 19:12 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-10 19:12 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-09-10 19:12 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-10 19:12 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-10 19:12 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-10 19:12 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-10 19:12 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-10 19:12 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-10 19:12 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-10 19:12 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-10 19:12 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-10 19:12 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-10 19:12 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-09-10 19:12 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-10 19:12 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-10 19:12 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-09-10 19:12 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-10 19:12 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-09-10 19:12 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-09-10 19:12 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-09-10 19:12 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-09-10 19:12 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-09-10 19:12 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-10 19:12 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-09-10 19:12 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-09-10 19:12 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-09-10 19:12 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-09-10 19:12 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-10 19:12 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-10 19:12 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-10 19:12 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-10 19:12 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-09-10 19:12 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-09-10 19:12 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-09-10 19:12 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-09-10 19:12 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-10 19:12 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-09-10 19:12 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-10 19:12 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-09-10 19:12 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-09-10 19:12 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-09-10 19:12 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-10 19:12 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-09-10 19:12 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-09-10 19:12 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-10 19:12 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-09-10 18:58 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-09-10 18:58 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-09-10 13:14 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-10 13:14 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-10 13:14 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-10 13:14 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-09-10 13:14 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-10 13:14 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-10 13:14 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-09-10 13:14 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-09-10 13:14 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-09-10 13:14 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-10 13:14 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-09-09 20:45 - 2014-09-09 20:45 - 00001852 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-09-09 20:45 - 2014-09-09 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-09-09 20:42 - 2014-09-09 20:46 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-09-08 22:17 - 2014-09-08 22:17 - 00039424 _____ () C:\Users\Tino\Downloads\Notenblatt_DStipendium_BSc.xls 2014-09-03 00:33 - 2014-09-03 00:33 - 00000308 _____ () C:\Users\Tino\Desktop\magic tricks stuart edge.txt 2014-08-30 20:17 - 2014-09-01 12:59 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\dvdcss 2014-08-30 00:01 - 2014-09-01 17:55 - 00000000 ____D () C:\Users\Tino\AppData\Local\FullTiltPoker.eu 2014-08-30 00:01 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\cache 2014-08-29 23:55 - 2014-08-29 23:57 - 54483208 _____ () C:\Users\Tino\Downloads\FullTiltPokerEuSetup.exe 2014-08-29 20:36 - 2014-08-29 23:45 - 00000000 ____D () C:\Users\Tino\AppData\Local\PokerStars.EU 2014-08-29 20:34 - 2014-08-29 23:55 - 00000000 ____D () C:\Program Files\Verschiedenes 2014-08-28 18:26 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 18:26 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 18:26 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-27 19:28 - 2014-08-27 19:29 - 00011539 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP_v02.xlsx 2014-08-26 14:58 - 2014-08-26 14:58 - 17279732 _____ () C:\Users\Tino\Downloads\redsn0w_win_0.9.15b3 (1).zip 2014-08-26 14:50 - 2014-08-26 14:50 - 03458048 _____ () C:\Users\Tino\Downloads\tinyumbrella-7.11.00 (1).exe 2014-08-26 14:43 - 2014-08-26 14:43 - 00408541 _____ () C:\Users\Tino\Downloads\ireb-r7.zip 2014-08-26 11:58 - 2014-08-26 11:59 - 00011381 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP.xlsx 2014-08-23 20:21 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-23 20:21 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-23 20:21 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-23 20:21 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-23 20:21 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-23 20:20 - 2014-05-14 14:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-23 20:20 - 2014-05-14 14:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-23 20:20 - 2014-05-14 14:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-23 20:20 - 2014-05-14 14:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-08-23 04:24 - 2014-08-23 04:24 - 00000137 _____ () C:\Users\Tino\Desktop\Varco Praktikum.txt 2014-08-19 20:53 - 2014-08-19 20:53 - 00000000 ____D () C:\Users\Tino\Desktop\Was ist das 2014-08-19 00:10 - 2014-08-19 00:10 - 00000286 _____ () C:\Users\Tino\Downloads\BK_PENG_002006DE_LC_64_22050_ster_A3BXOVXDGOB8X5.adh 2014-08-19 00:09 - 2014-08-19 00:09 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN (1).exe 2014-08-19 00:07 - 2014-08-29 17:03 - 00000000 ____D () C:\Users\Tino\AppData\Local\Audible 2014-08-19 00:07 - 2014-08-19 00:07 - 00255352 _____ (Audible, Inc.) C:\Windows\SysWOW64\awrdscdc.ax 2014-08-19 00:07 - 2014-08-19 00:07 - 00001972 _____ () C:\Users\Tino\Desktop\Audible Manager.lnk 2014-08-18 23:53 - 2014-08-19 00:08 - 00000000 ____D () C:\Users\Tino\Documents\Iphone Backup manuell 2014-08-18 23:52 - 2014-08-19 00:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager 2014-08-18 23:52 - 2014-08-19 00:07 - 00000000 ____D () C:\Program Files (x86)\Audible 2014-08-18 23:52 - 2014-08-18 23:52 - 00000000 ____D () C:\Users\Tino\Documents\Audible 2014-08-18 23:52 - 2014-08-18 23:52 - 00000000 ____D () C:\Users\Public\Documents\Audible 2014-08-18 23:52 - 2003-03-19 02:20 - 01060864 ____N (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll 2014-08-18 23:52 - 2003-03-19 01:14 - 00499712 ____N (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll 2014-08-18 23:52 - 2003-02-21 09:42 - 00348160 ____N (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2014-08-18 23:52 - 2001-08-18 03:43 - 00024576 ____N (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll 2014-08-18 23:51 - 2014-08-18 23:51 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN.exe 2014-08-18 22:18 - 2014-08-19 00:37 - 00009794 _____ () C:\Users\Tino\Documents\Books Audiobooks_18Aug14.xlsx ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-17 12:09 - 2014-09-15 16:56 - 00016872 _____ () C:\Users\Tino\Downloads\FRST.txt 2014-09-17 12:09 - 2014-09-15 15:25 - 00000000 ____D () C:\FRST 2014-09-17 12:03 - 2014-01-23 17:35 - 01961488 _____ () C:\Windows\WindowsUpdate.log 2014-09-17 12:01 - 2014-09-17 12:01 - 00000624 _____ () C:\Users\Tino\Desktop\JRT.txt 2014-09-17 11:50 - 2014-01-25 01:51 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-17 11:22 - 2013-11-27 11:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-17 11:01 - 2009-07-14 06:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-17 11:01 - 2009-07-14 06:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-09-17 10:57 - 2014-02-13 01:31 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Spotify 2014-09-17 10:56 - 2014-01-25 01:51 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-17 10:55 - 2014-09-16 13:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-17 10:54 - 2013-11-27 14:06 - 00149302 _____ () C:\Windows\setupact.log 2014-09-17 10:54 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-16 20:55 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-09-16 20:25 - 2014-09-16 20:25 - 00252925 _____ () C:\Users\Tino\Desktop\bookmarks_16.09.14.html 2014-09-16 20:23 - 2014-09-16 20:23 - 00000000 ____D () C:\Windows\ERUNT 2014-09-16 20:15 - 2010-11-21 05:47 - 00022148 _____ () C:\Windows\PFRO.log 2014-09-16 20:14 - 2014-09-17 12:05 - 00001007 _____ () C:\Users\Tino\Desktop\AdwCleaner[S1].txt 2014-09-16 20:14 - 2014-09-16 14:42 - 00000000 ____D () C:\AdwCleaner 2014-09-16 14:53 - 2014-09-17 12:05 - 00001445 _____ () C:\Users\Tino\Desktop\AdwCleaner[S0].txt 2014-09-16 14:42 - 2014-09-16 14:42 - 01016261 _____ (Thisisu) C:\Users\Tino\Downloads\JRT.exe 2014-09-16 14:41 - 2014-09-16 14:41 - 00001975 _____ () C:\Users\Tino\Desktop\mbam.txt 2014-09-16 13:42 - 2014-09-16 13:41 - 01373475 _____ () C:\Users\Tino\Downloads\AdwCleaner_3.310.exe 2014-09-16 13:40 - 2014-09-16 13:40 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-09-16 13:40 - 2014-09-16 13:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-16 13:40 - 2014-09-16 13:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:39 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-16 13:39 - 2014-09-16 13:38 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Tino\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-15 16:59 - 2014-09-15 16:58 - 00036613 _____ () C:\Users\Tino\Downloads\Addition.txt 2014-09-15 15:22 - 2014-09-15 15:21 - 02105856 _____ (Farbar) C:\Users\Tino\Downloads\FRST64.exe 2014-09-15 14:07 - 2014-09-15 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2014-09-15 14:07 - 2014-01-23 16:45 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-09-15 14:07 - 2014-01-23 16:45 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-09-15 14:06 - 2014-07-29 03:18 - 00004114 _____ () C:\Windows\DPINST.LOG 2014-09-15 01:15 - 2014-01-28 16:42 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-15 01:14 - 2014-01-28 16:46 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2014-09-12 23:56 - 2014-08-08 21:27 - 00000000 ____D () C:\Users\Tino\Documents\Finanzen 2014-09-12 22:50 - 2014-01-25 01:51 - 00002182 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-09-12 09:13 - 2014-09-12 08:52 - 00013307 _____ () C:\Users\Tino\Desktop\Handyverträge_v03.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00010137 _____ () C:\Users\Tino\Desktop\Handyverträge_v02.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00000123 _____ () C:\Users\Tino\Desktop\comdirect.txt 2014-09-11 23:46 - 2014-09-11 23:46 - 00009176 _____ () C:\Users\Tino\Desktop\Handyverträge.xlsx 2014-09-11 23:46 - 2014-09-11 23:46 - 00008199 _____ () C:\Users\Tino\Desktop\Chrome Lesezeichen.xlsx 2014-09-10 19:09 - 2013-11-27 11:04 - 01592824 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-09-10 19:09 - 2011-04-12 09:43 - 00699160 _____ () C:\Windows\system32\perfh007.dat 2014-09-10 19:09 - 2011-04-12 09:43 - 00149268 _____ () C:\Windows\system32\perfc007.dat 2014-09-10 19:09 - 2009-07-14 07:13 - 01592824 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-10 19:08 - 2014-08-05 23:13 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-10 19:00 - 2014-08-05 23:13 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-10 18:58 - 2014-05-06 07:12 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-09-10 18:46 - 2014-03-29 05:16 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\vlc 2014-09-09 20:46 - 2014-09-09 20:42 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-09-09 20:45 - 2014-09-09 20:45 - 00001852 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-09-09 20:45 - 2014-09-09 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-09-08 22:17 - 2014-09-08 22:17 - 00039424 _____ () C:\Users\Tino\Downloads\Notenblatt_DStipendium_BSc.xls 2014-09-08 14:05 - 2014-08-08 20:37 - 00000000 ____D () C:\Users\Tino\Documents\Bildung 2014-09-05 04:10 - 2014-09-10 13:14 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-05 04:05 - 2014-09-10 13:14 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-05 00:07 - 2014-08-08 20:36 - 00000000 ____D () C:\Users\Tino\Documents\Personal Development 2014-09-03 00:33 - 2014-09-03 00:33 - 00000308 _____ () C:\Users\Tino\Desktop\magic tricks stuart edge.txt 2014-09-02 23:45 - 2014-07-24 05:54 - 00000000 ____D () C:\Users\Tino\Documents\Praktika 2014-09-01 17:55 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\FullTiltPoker.eu 2014-09-01 12:59 - 2014-08-30 20:17 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\dvdcss 2014-08-30 00:01 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\cache 2014-08-29 23:57 - 2014-08-29 23:55 - 54483208 _____ () C:\Users\Tino\Downloads\FullTiltPokerEuSetup.exe 2014-08-29 23:55 - 2014-08-29 20:34 - 00000000 ____D () C:\Program Files\Verschiedenes 2014-08-29 23:45 - 2014-08-29 20:36 - 00000000 ____D () C:\Users\Tino\AppData\Local\PokerStars.EU 2014-08-29 17:03 - 2014-08-19 00:07 - 00000000 ____D () C:\Users\Tino\AppData\Local\Audible 2014-08-29 12:42 - 2009-07-14 06:45 - 00438168 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-27 19:29 - 2014-08-27 19:28 - 00011539 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP_v02.xlsx 2014-08-26 14:58 - 2014-08-26 14:58 - 17279732 _____ () C:\Users\Tino\Downloads\redsn0w_win_0.9.15b3 (1).zip 2014-08-26 14:57 - 2014-08-10 21:56 - 00000877 _____ () C:\Windows\system32\Drivers\etc\hosts.umbrella 2014-08-26 14:57 - 2014-08-10 21:56 - 00000213 _____ () C:\Users\Tino\umbrella0.log 2014-08-26 14:57 - 2014-08-10 19:57 - 00011223 _____ () C:\Users\Tino\Downloads\umbrella.log 2014-08-26 14:57 - 2014-01-23 17:44 - 00000000 ____D () C:\Users\Tino 2014-08-26 14:50 - 2014-08-26 14:50 - 03458048 _____ () C:\Users\Tino\Downloads\tinyumbrella-7.11.00 (1).exe 2014-08-26 14:43 - 2014-08-26 14:43 - 00408541 _____ () C:\Users\Tino\Downloads\ireb-r7.zip 2014-08-26 11:59 - 2014-08-26 11:58 - 00011381 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP.xlsx 2014-08-25 06:53 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-08-25 00:18 - 2014-01-25 03:19 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Skype 2014-08-23 04:24 - 2014-08-23 04:24 - 00000137 _____ () C:\Users\Tino\Desktop\Varco Praktikum.txt 2014-08-23 04:07 - 2014-08-28 18:26 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 03:45 - 2014-08-28 18:26 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-23 02:59 - 2014-08-28 18:26 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-19 20:53 - 2014-08-19 20:53 - 00000000 ____D () C:\Users\Tino\Desktop\Was ist das 2014-08-19 20:05 - 2014-09-10 19:12 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-19 19:39 - 2014-09-10 19:12 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-19 01:01 - 2014-09-10 19:12 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-19 00:37 - 2014-08-18 22:18 - 00009794 _____ () C:\Users\Tino\Documents\Books Audiobooks_18Aug14.xlsx 2014-08-19 00:29 - 2014-09-10 19:12 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-19 00:29 - 2014-09-10 19:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-19 00:26 - 2014-09-10 19:12 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-19 00:20 - 2014-09-10 19:12 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-19 00:19 - 2014-09-10 19:12 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-19 00:15 - 2014-09-10 19:12 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-19 00:15 - 2014-09-10 19:12 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-19 00:14 - 2014-09-10 19:12 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-19 00:14 - 2014-09-10 19:12 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-19 00:10 - 2014-08-19 00:10 - 00000286 _____ () C:\Users\Tino\Downloads\BK_PENG_002006DE_LC_64_22050_ster_A3BXOVXDGOB8X5.adh 2014-08-19 00:09 - 2014-08-19 00:09 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN (1).exe 2014-08-19 00:08 - 2014-09-10 19:12 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-19 00:08 - 2014-09-10 19:12 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-19 00:08 - 2014-09-10 19:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-19 00:08 - 2014-08-18 23:53 - 00000000 ____D () C:\Users\Tino\Documents\Iphone Backup manuell 2014-08-19 00:07 - 2014-08-19 00:07 - 00255352 _____ (Audible, Inc.) C:\Windows\SysWOW64\awrdscdc.ax 2014-08-19 00:07 - 2014-08-19 00:07 - 00001972 _____ () C:\Users\Tino\Desktop\Audible Manager.lnk 2014-08-19 00:07 - 2014-08-18 23:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager 2014-08-19 00:07 - 2014-08-18 23:52 - 00000000 ____D () C:\Program Files (x86)\Audible 2014-08-19 00:05 - 2014-09-10 19:12 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-19 00:03 - 2014-09-10 19:12 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-19 00:03 - 2014-09-10 19:12 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-19 00:03 - 2014-09-10 19:12 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-18 23:57 - 2014-09-10 19:12 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-18 23:56 - 2014-09-10 19:12 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-18 23:52 - 2014-08-18 23:52 - 00000000 ____D () C:\Users\Tino\Documents\Audible 2014-08-18 23:52 - 2014-08-18 23:52 - 00000000 ____D () C:\Users\Public\Documents\Audible 2014-08-18 23:51 - 2014-09-10 19:12 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-18 23:51 - 2014-08-18 23:51 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN.exe 2014-08-18 23:46 - 2014-09-10 19:12 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-18 23:45 - 2014-09-10 19:12 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-18 23:45 - 2014-09-10 19:12 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-18 23:44 - 2014-09-10 19:12 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-08-18 23:44 - 2014-09-10 19:12 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-08-18 23:42 - 2014-09-10 19:12 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-18 23:40 - 2014-09-10 19:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-18 23:39 - 2014-09-10 19:12 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-18 23:39 - 2014-09-10 19:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-18 23:39 - 2014-09-10 19:12 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-18 23:38 - 2014-09-10 19:12 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-18 23:37 - 2014-09-10 19:12 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-18 23:36 - 2014-09-10 19:12 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-18 23:35 - 2014-09-10 19:12 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-08-18 23:27 - 2014-09-10 19:12 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-18 23:25 - 2014-09-10 19:12 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-18 23:25 - 2014-09-10 19:12 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-18 23:23 - 2014-09-10 19:12 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-18 23:23 - 2014-09-10 19:12 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-18 23:22 - 2014-09-10 19:12 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-08-18 23:19 - 2014-09-10 19:12 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-18 23:17 - 2014-09-10 19:12 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-18 23:17 - 2014-09-10 19:12 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-18 23:16 - 2014-09-10 19:12 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-18 23:15 - 2014-09-10 19:12 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-18 23:15 - 2014-09-10 19:12 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-18 23:09 - 2014-09-10 19:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-18 23:08 - 2014-09-10 19:12 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-18 23:07 - 2014-09-10 19:12 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-08-18 22:55 - 2014-09-10 19:12 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-18 22:46 - 2014-09-10 19:12 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-18 22:38 - 2014-09-10 19:12 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-18 22:38 - 2014-09-10 19:12 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-18 22:36 - 2014-09-10 19:12 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll Some content of TEMP: ==================== C:\Users\Tino\AppData\Local\Temp\amazonicon_v4.exe C:\Users\Tino\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Tino\AppData\Local\Temp\memoPERS_free.exe C:\Users\Tino\AppData\Local\Temp\ose00000.exe C:\Users\Tino\AppData\Local\Temp\sdanircmdc.exe C:\Users\Tino\AppData\Local\Temp\sdapskill.exe C:\Users\Tino\AppData\Local\Temp\sdaspwn.exe C:\Users\Tino\AppData\Local\Temp\_unps.exe C:\Users\Tino\AppData\Local\Temp\{4F8ED1F5-5C76-4BD1-A905-50A280DE78CD}-35.0.1916.153_35.0.1916.114_chrome_updater_alt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-16 15:21 ==================== End Of Log ============================ --- --- --- --- --- --- |
17.09.2014, 20:34 | #6 |
/// the machine /// TB-Ausbilder | GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in QuarantäneESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne |
18.09.2014, 13:45 | #7 |
| GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Der Online Scanner hat 1 Bedrohung gefunden, aber die wurde ja jetzt nicht entfernt oder? Naja viele Probleme hatte ich ja nicht, aber die FoxyProxy Situation dieselbe... "updatet" immer noch. Und die ganzen Viren in der Quarantäne von GDATA sind ja noch dadrin, kann man die einfach drin lassen? Ich denke mal Du als Experte kannst das mit den Files besser beurleiten ob alles OK ist: (Und übrigens schonmal vielen Dank!!) Eset Online Scanner Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=5aae3025516b524bab21b6d02ca30d78 # engine=20211 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-09-18 11:39:39 # local_time=2014-09-18 01:39:39 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 92697 162670229 0 0 # scanned=171074 # found=1 # cleaned=0 # scan_time=3502 sh=953322AD4C7D5EA33202E48EED24ADB6E46FC300 ft=1 fh=1fc7002f13887d8e vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Tino\Downloads\memoPERS-lnstall.exe" Code:
ATTFilter Results of screen317's Security Check version 0.99.87 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` G DATA INTERNET SECURITY Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Java 7 Update 67 Adobe Flash Player 11.8.800.94 Flash Player out of Date! Adobe Reader XI Google Chrome 37.0.2062.103 Google Chrome 37.0.2062.120 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe G Data InternetSecurity Firewall GDFirewallTray.exe G Data InternetSecurity Firewall GDFwSvcx64.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014 Ran by Tino (administrator) on TINO-PC on 18-09-2014 14:32:30 Running from C:\Users\Tino\Downloads Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\stacsv64.exe (Hewlett-Packard) C:\Windows\System32\hpservice.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft) C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Akamai Technologies, Inc.) C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe (Spotify Ltd) C:\Users\Tino\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Akamai Technologies, Inc.) C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company) HKLM\...\Run: [Unattend0000000001{CBF3078B-5A06-4E8A-B429-5783F1589DDA}] => %SYSTEMDRIVE%\restore\createrestore.exe /r HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-18] (IDT, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2013-09-30] () HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2010-02-25] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HPConnectionManager] => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-05-23] (Hewlett-Packard Development Company L.P.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-07] (Geek Software GmbH) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-09-09] (Apple Inc.) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe, Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ScCertProp: wlnotify.dll [X] HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Tino\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-18] (Akamai Technologies, Inc.) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Spotify] => C:\Users\Tino\AppData\Roaming\Spotify\Spotify.exe [6170168 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [Spotify Web Helper] => C:\Users\Tino\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\MountPoints2: {5697a708-8805-11e3-8258-88ae1dacdee7} - E:\SETUP.EXE ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {CB927D12-4FF7-4A9E-A169-56E4B8A75598} hxxp://qtinstall.apple.com/qtactivex/qtplugin.cab Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: 74.208.10.249 gs.apple.com Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation) Chrome: ======= CHR Profile: C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-25] CHR Extension: (Google Drive) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-25] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-17] CHR Extension: (YouTube) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-25] CHR Extension: (Google-Suche) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-25] CHR Extension: (FoxyProxy Standard) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcknhkkoolaabfmlnjonogaaifnjlfnp [2014-09-13] CHR Extension: (Google Wallet) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-25] CHR Extension: (Google Mail) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-25] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation) R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-07-30] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG) R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3227624 2014-08-06] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [204576 2014-06-25] (Microsoft) R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe [244224 2009-11-18] (IDT, Inc.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-28] (Disc Soft Ltd) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-29] (G Data Software AG) R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-29] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-09-15] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-29] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-09-15] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-07-30] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-29] (G Data Software AG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-18] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-18 14:29 - 2014-09-18 14:29 - 00001008 _____ () C:\Users\Tino\Desktop\checkup.txt 2014-09-18 14:17 - 2014-09-18 14:17 - 00854417 _____ () C:\Users\Tino\Desktop\SecurityCheck.exe 2014-09-18 12:26 - 2014-09-18 12:26 - 02347384 _____ (ESET) C:\Users\Tino\Downloads\esetsmartinstaller_deu.exe 2014-09-17 12:05 - 2014-09-16 20:14 - 00001007 _____ () C:\Users\Tino\Desktop\AdwCleaner[S1].txt 2014-09-17 12:05 - 2014-09-16 14:53 - 00001445 _____ () C:\Users\Tino\Desktop\AdwCleaner[S0].txt 2014-09-17 12:01 - 2014-09-17 12:01 - 00000624 _____ () C:\Users\Tino\Desktop\JRT.txt 2014-09-16 20:25 - 2014-09-16 20:25 - 00252925 _____ () C:\Users\Tino\Desktop\bookmarks_16.09.14.html 2014-09-16 20:23 - 2014-09-16 20:23 - 00000000 ____D () C:\Windows\ERUNT 2014-09-16 14:43 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-09-16 14:42 - 2014-09-16 20:14 - 00000000 ____D () C:\AdwCleaner 2014-09-16 14:42 - 2014-09-16 14:42 - 01016261 _____ (Thisisu) C:\Users\Tino\Downloads\JRT.exe 2014-09-16 14:41 - 2014-09-16 14:41 - 00001975 _____ () C:\Users\Tino\Desktop\mbam.txt 2014-09-16 13:41 - 2014-09-16 13:42 - 01373475 _____ () C:\Users\Tino\Downloads\AdwCleaner_3.310.exe 2014-09-16 13:40 - 2014-09-18 14:23 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-16 13:40 - 2014-09-16 13:40 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-09-16 13:40 - 2014-09-16 13:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:39 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-16 13:39 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-09-16 13:39 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-09-16 13:39 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-09-16 13:38 - 2014-09-16 13:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Tino\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-15 16:58 - 2014-09-15 16:59 - 00036613 _____ () C:\Users\Tino\Downloads\Addition.txt 2014-09-15 16:56 - 2014-09-18 14:32 - 00016724 _____ () C:\Users\Tino\Downloads\FRST.txt 2014-09-15 15:25 - 2014-09-18 14:32 - 00000000 ____D () C:\FRST 2014-09-15 15:21 - 2014-09-15 15:22 - 02105856 _____ (Farbar) C:\Users\Tino\Downloads\FRST64.exe 2014-09-15 14:07 - 2014-09-15 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2014-09-12 08:52 - 2014-09-12 09:13 - 00013307 _____ () C:\Users\Tino\Desktop\Handyverträge_v03.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00010137 _____ () C:\Users\Tino\Desktop\Handyverträge_v02.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00000123 _____ () C:\Users\Tino\Desktop\comdirect.txt 2014-09-11 23:46 - 2014-09-11 23:46 - 00009176 _____ () C:\Users\Tino\Desktop\Handyverträge.xlsx 2014-09-11 23:46 - 2014-09-11 23:46 - 00008199 _____ () C:\Users\Tino\Desktop\Chrome Lesezeichen.xlsx 2014-09-10 19:12 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-10 19:12 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-09-10 19:12 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-10 19:12 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-10 19:12 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-10 19:12 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-09-10 19:12 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-10 19:12 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-10 19:12 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-10 19:12 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-10 19:12 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-10 19:12 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-10 19:12 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-10 19:12 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-10 19:12 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-10 19:12 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-10 19:12 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-09-10 19:12 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-10 19:12 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-10 19:12 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-09-10 19:12 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-10 19:12 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-09-10 19:12 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-09-10 19:12 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-09-10 19:12 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-09-10 19:12 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-09-10 19:12 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-10 19:12 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-09-10 19:12 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-09-10 19:12 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-09-10 19:12 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-09-10 19:12 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-10 19:12 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-10 19:12 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-10 19:12 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-10 19:12 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-09-10 19:12 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-09-10 19:12 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-09-10 19:12 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-09-10 19:12 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-10 19:12 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-09-10 19:12 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-10 19:12 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-09-10 19:12 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-09-10 19:12 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-09-10 19:12 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-10 19:12 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-09-10 19:12 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-09-10 19:12 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-10 19:12 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-09-10 18:58 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-09-10 18:58 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-09-10 13:14 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-10 13:14 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-10 13:14 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-10 13:14 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-09-10 13:14 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-10 13:14 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-10 13:14 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-09-10 13:14 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-09-10 13:14 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-09-10 13:14 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-10 13:14 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-09-09 20:45 - 2014-09-09 20:45 - 00001852 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-09-09 20:45 - 2014-09-09 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-09-09 20:42 - 2014-09-09 20:46 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-09-08 22:17 - 2014-09-08 22:17 - 00039424 _____ () C:\Users\Tino\Downloads\Notenblatt_DStipendium_BSc.xls 2014-09-03 00:33 - 2014-09-03 00:33 - 00000308 _____ () C:\Users\Tino\Desktop\magic tricks stuart edge.txt 2014-08-30 20:17 - 2014-09-01 12:59 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\dvdcss 2014-08-30 00:01 - 2014-09-01 17:55 - 00000000 ____D () C:\Users\Tino\AppData\Local\FullTiltPoker.eu 2014-08-30 00:01 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\cache 2014-08-29 23:55 - 2014-08-29 23:57 - 54483208 _____ () C:\Users\Tino\Downloads\FullTiltPokerEuSetup.exe 2014-08-29 20:36 - 2014-08-29 23:45 - 00000000 ____D () C:\Users\Tino\AppData\Local\PokerStars.EU 2014-08-29 20:34 - 2014-08-29 23:55 - 00000000 ____D () C:\Program Files\Verschiedenes 2014-08-28 18:26 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 18:26 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 18:26 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-27 19:28 - 2014-08-27 19:29 - 00011539 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP_v02.xlsx 2014-08-26 14:58 - 2014-08-26 14:58 - 17279732 _____ () C:\Users\Tino\Downloads\redsn0w_win_0.9.15b3 (1).zip 2014-08-26 14:50 - 2014-08-26 14:50 - 03458048 _____ () C:\Users\Tino\Downloads\tinyumbrella-7.11.00 (1).exe 2014-08-26 14:43 - 2014-08-26 14:43 - 00408541 _____ () C:\Users\Tino\Downloads\ireb-r7.zip 2014-08-26 11:58 - 2014-08-26 11:59 - 00011381 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP.xlsx 2014-08-23 20:21 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-23 20:21 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-23 20:21 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-23 20:21 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-23 20:21 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-23 20:21 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-23 20:20 - 2014-05-14 14:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-23 20:20 - 2014-05-14 14:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-23 20:20 - 2014-05-14 14:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-23 20:20 - 2014-05-14 14:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-08-23 04:24 - 2014-08-23 04:24 - 00000137 _____ () C:\Users\Tino\Desktop\Varco Praktikum.txt 2014-08-19 20:53 - 2014-08-19 20:53 - 00000000 ____D () C:\Users\Tino\Desktop\Was ist das 2014-08-19 00:10 - 2014-08-19 00:10 - 00000286 _____ () C:\Users\Tino\Downloads\BK_PENG_002006DE_LC_64_22050_ster_A3BXOVXDGOB8X5.adh 2014-08-19 00:09 - 2014-08-19 00:09 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN (1).exe 2014-08-19 00:07 - 2014-08-29 17:03 - 00000000 ____D () C:\Users\Tino\AppData\Local\Audible 2014-08-19 00:07 - 2014-08-19 00:07 - 00255352 _____ (Audible, Inc.) C:\Windows\SysWOW64\awrdscdc.ax 2014-08-19 00:07 - 2014-08-19 00:07 - 00001972 _____ () C:\Users\Tino\Desktop\Audible Manager.lnk ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-18 14:32 - 2014-09-15 16:56 - 00016724 _____ () C:\Users\Tino\Downloads\FRST.txt 2014-09-18 14:32 - 2014-09-15 15:25 - 00000000 ____D () C:\FRST 2014-09-18 14:29 - 2014-09-18 14:29 - 00001008 _____ () C:\Users\Tino\Desktop\checkup.txt 2014-09-18 14:28 - 2009-07-14 06:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-18 14:28 - 2009-07-14 06:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-09-18 14:26 - 2014-01-23 17:35 - 01988043 _____ () C:\Windows\WindowsUpdate.log 2014-09-18 14:23 - 2014-09-16 13:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-18 14:22 - 2014-02-13 01:31 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Spotify 2014-09-18 14:22 - 2013-11-27 11:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-18 14:21 - 2014-01-25 01:51 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-18 14:20 - 2013-11-27 14:06 - 00149358 _____ () C:\Windows\setupact.log 2014-09-18 14:20 - 2010-11-21 05:47 - 00022982 _____ () C:\Windows\PFRO.log 2014-09-18 14:20 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-18 14:17 - 2014-09-18 14:17 - 00854417 _____ () C:\Users\Tino\Desktop\SecurityCheck.exe 2014-09-18 13:50 - 2014-01-25 01:51 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-18 12:26 - 2014-09-18 12:26 - 02347384 _____ (ESET) C:\Users\Tino\Downloads\esetsmartinstaller_deu.exe 2014-09-17 12:14 - 2014-03-29 05:15 - 00000922 _____ () C:\Users\Public\Desktop\VLC media player.lnk 2014-09-17 12:01 - 2014-09-17 12:01 - 00000624 _____ () C:\Users\Tino\Desktop\JRT.txt 2014-09-16 20:55 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-09-16 20:25 - 2014-09-16 20:25 - 00252925 _____ () C:\Users\Tino\Desktop\bookmarks_16.09.14.html 2014-09-16 20:23 - 2014-09-16 20:23 - 00000000 ____D () C:\Windows\ERUNT 2014-09-16 20:14 - 2014-09-17 12:05 - 00001007 _____ () C:\Users\Tino\Desktop\AdwCleaner[S1].txt 2014-09-16 20:14 - 2014-09-16 14:42 - 00000000 ____D () C:\AdwCleaner 2014-09-16 14:53 - 2014-09-17 12:05 - 00001445 _____ () C:\Users\Tino\Desktop\AdwCleaner[S0].txt 2014-09-16 14:42 - 2014-09-16 14:42 - 01016261 _____ (Thisisu) C:\Users\Tino\Downloads\JRT.exe 2014-09-16 14:41 - 2014-09-16 14:41 - 00001975 _____ () C:\Users\Tino\Desktop\mbam.txt 2014-09-16 13:42 - 2014-09-16 13:41 - 01373475 _____ () C:\Users\Tino\Downloads\AdwCleaner_3.310.exe 2014-09-16 13:40 - 2014-09-16 13:40 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-09-16 13:40 - 2014-09-16 13:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-16 13:40 - 2014-09-16 13:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:39 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-16 13:39 - 2014-09-16 13:38 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Tino\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-15 16:59 - 2014-09-15 16:58 - 00036613 _____ () C:\Users\Tino\Downloads\Addition.txt 2014-09-15 15:22 - 2014-09-15 15:21 - 02105856 _____ (Farbar) C:\Users\Tino\Downloads\FRST64.exe 2014-09-15 14:07 - 2014-09-15 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2014-09-15 14:07 - 2014-01-23 16:45 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-09-15 14:07 - 2014-01-23 16:45 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-09-15 14:06 - 2014-07-29 03:18 - 00004114 _____ () C:\Windows\DPINST.LOG 2014-09-15 01:15 - 2014-01-28 16:42 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-15 01:14 - 2014-01-28 16:46 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2014-09-12 23:56 - 2014-08-08 21:27 - 00000000 ____D () C:\Users\Tino\Documents\Finanzen 2014-09-12 22:50 - 2014-01-25 01:51 - 00002182 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-09-12 09:13 - 2014-09-12 08:52 - 00013307 _____ () C:\Users\Tino\Desktop\Handyverträge_v03.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00010137 _____ () C:\Users\Tino\Desktop\Handyverträge_v02.xlsx 2014-09-12 01:10 - 2014-09-12 01:10 - 00000123 _____ () C:\Users\Tino\Desktop\comdirect.txt 2014-09-11 23:46 - 2014-09-11 23:46 - 00009176 _____ () C:\Users\Tino\Desktop\Handyverträge.xlsx 2014-09-11 23:46 - 2014-09-11 23:46 - 00008199 _____ () C:\Users\Tino\Desktop\Chrome Lesezeichen.xlsx 2014-09-10 19:09 - 2013-11-27 11:04 - 01592824 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-09-10 19:09 - 2011-04-12 09:43 - 00699160 _____ () C:\Windows\system32\perfh007.dat 2014-09-10 19:09 - 2011-04-12 09:43 - 00149268 _____ () C:\Windows\system32\perfc007.dat 2014-09-10 19:09 - 2009-07-14 07:13 - 01592824 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-10 19:08 - 2014-08-05 23:13 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-10 19:00 - 2014-08-05 23:13 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-10 18:58 - 2014-05-06 07:12 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-09-10 18:46 - 2014-03-29 05:16 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\vlc 2014-09-09 20:46 - 2014-09-09 20:42 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-09-09 20:45 - 2014-09-09 20:45 - 00001852 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk 2014-09-09 20:45 - 2014-09-09 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-09-08 22:17 - 2014-09-08 22:17 - 00039424 _____ () C:\Users\Tino\Downloads\Notenblatt_DStipendium_BSc.xls 2014-09-08 14:05 - 2014-08-08 20:37 - 00000000 ____D () C:\Users\Tino\Documents\Bildung 2014-09-05 04:10 - 2014-09-10 13:14 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-05 04:05 - 2014-09-10 13:14 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-05 00:07 - 2014-08-08 20:36 - 00000000 ____D () C:\Users\Tino\Documents\Personal Development 2014-09-03 00:33 - 2014-09-03 00:33 - 00000308 _____ () C:\Users\Tino\Desktop\magic tricks stuart edge.txt 2014-09-02 23:45 - 2014-07-24 05:54 - 00000000 ____D () C:\Users\Tino\Documents\Praktika 2014-09-01 17:55 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\FullTiltPoker.eu 2014-09-01 12:59 - 2014-08-30 20:17 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\dvdcss 2014-08-30 00:01 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\cache 2014-08-29 23:57 - 2014-08-29 23:55 - 54483208 _____ () C:\Users\Tino\Downloads\FullTiltPokerEuSetup.exe 2014-08-29 23:55 - 2014-08-29 20:34 - 00000000 ____D () C:\Program Files\Verschiedenes 2014-08-29 23:45 - 2014-08-29 20:36 - 00000000 ____D () C:\Users\Tino\AppData\Local\PokerStars.EU 2014-08-29 17:03 - 2014-08-19 00:07 - 00000000 ____D () C:\Users\Tino\AppData\Local\Audible 2014-08-29 12:42 - 2009-07-14 06:45 - 00438168 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-27 19:29 - 2014-08-27 19:28 - 00011539 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP_v02.xlsx 2014-08-26 14:58 - 2014-08-26 14:58 - 17279732 _____ () C:\Users\Tino\Downloads\redsn0w_win_0.9.15b3 (1).zip 2014-08-26 14:57 - 2014-08-10 21:56 - 00000877 _____ () C:\Windows\system32\Drivers\etc\hosts.umbrella 2014-08-26 14:57 - 2014-08-10 21:56 - 00000213 _____ () C:\Users\Tino\umbrella0.log 2014-08-26 14:57 - 2014-08-10 19:57 - 00011223 _____ () C:\Users\Tino\Downloads\umbrella.log 2014-08-26 14:57 - 2014-01-23 17:44 - 00000000 ____D () C:\Users\Tino 2014-08-26 14:50 - 2014-08-26 14:50 - 03458048 _____ () C:\Users\Tino\Downloads\tinyumbrella-7.11.00 (1).exe 2014-08-26 14:43 - 2014-08-26 14:43 - 00408541 _____ () C:\Users\Tino\Downloads\ireb-r7.zip 2014-08-26 11:59 - 2014-08-26 11:58 - 00011381 _____ () C:\Users\Tino\Documents\Essen nach Mandel OP.xlsx 2014-08-25 06:53 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-08-25 00:18 - 2014-01-25 03:19 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Skype 2014-08-23 04:24 - 2014-08-23 04:24 - 00000137 _____ () C:\Users\Tino\Desktop\Varco Praktikum.txt 2014-08-23 04:07 - 2014-08-28 18:26 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 03:45 - 2014-08-28 18:26 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-23 02:59 - 2014-08-28 18:26 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-19 20:53 - 2014-08-19 20:53 - 00000000 ____D () C:\Users\Tino\Desktop\Was ist das 2014-08-19 20:05 - 2014-09-10 19:12 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-19 19:39 - 2014-09-10 19:12 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-19 01:01 - 2014-09-10 19:12 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-19 00:37 - 2014-08-18 22:18 - 00009794 _____ () C:\Users\Tino\Documents\Books Audiobooks_18Aug14.xlsx 2014-08-19 00:29 - 2014-09-10 19:12 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-19 00:29 - 2014-09-10 19:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-19 00:26 - 2014-09-10 19:12 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-19 00:20 - 2014-09-10 19:12 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-19 00:19 - 2014-09-10 19:12 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-19 00:15 - 2014-09-10 19:12 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-19 00:15 - 2014-09-10 19:12 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-19 00:14 - 2014-09-10 19:12 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-19 00:14 - 2014-09-10 19:12 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-19 00:10 - 2014-08-19 00:10 - 00000286 _____ () C:\Users\Tino\Downloads\BK_PENG_002006DE_LC_64_22050_ster_A3BXOVXDGOB8X5.adh 2014-08-19 00:09 - 2014-08-19 00:09 - 01730272 _____ (Audible Inc.) C:\Users\Tino\Downloads\ActiveSetupN (1).exe 2014-08-19 00:08 - 2014-09-10 19:12 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-19 00:08 - 2014-09-10 19:12 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-19 00:08 - 2014-09-10 19:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-19 00:08 - 2014-08-18 23:53 - 00000000 ____D () C:\Users\Tino\Documents\Iphone Backup manuell 2014-08-19 00:07 - 2014-08-19 00:07 - 00255352 _____ (Audible, Inc.) C:\Windows\SysWOW64\awrdscdc.ax 2014-08-19 00:07 - 2014-08-19 00:07 - 00001972 _____ () C:\Users\Tino\Desktop\Audible Manager.lnk 2014-08-19 00:07 - 2014-08-18 23:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AudibleManager 2014-08-19 00:07 - 2014-08-18 23:52 - 00000000 ____D () C:\Program Files (x86)\Audible 2014-08-19 00:05 - 2014-09-10 19:12 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-19 00:03 - 2014-09-10 19:12 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-19 00:03 - 2014-09-10 19:12 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-19 00:03 - 2014-09-10 19:12 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe Some content of TEMP: ==================== C:\Users\Tino\AppData\Local\Temp\amazonicon_v4.exe C:\Users\Tino\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Tino\AppData\Local\Temp\memoPERS_free.exe C:\Users\Tino\AppData\Local\Temp\ose00000.exe C:\Users\Tino\AppData\Local\Temp\sdanircmdc.exe C:\Users\Tino\AppData\Local\Temp\sdapskill.exe C:\Users\Tino\AppData\Local\Temp\sdaspwn.exe C:\Users\Tino\AppData\Local\Temp\_unps.exe C:\Users\Tino\AppData\Local\Temp\{4F8ED1F5-5C76-4BD1-A905-50A280DE78CD}-35.0.1916.153_35.0.1916.114_chrome_updater_alt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-16 15:21 ==================== End Of Log ============================ |
19.09.2014, 08:15 | #8 |
/// the machine /// TB-Ausbilder | GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Flash updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM\...\Run: [Unattend0000000001{CBF3078B-5A06-4E8A-B429-5783F1589DDA}] => %SYSTEMDRIVE%\restore\createrestore.exe /r Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
20.09.2014, 16:31 | #9 |
| GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Hallo! Bin jetzt erst zu all dem gekommen. Habe mein Chrome deinstalliert mit Unrevo und neu installiert (Firefox hab ich gar nicht). Flash ist wohl auf dem neusten Stand. Hab bei einem neuen Viren-Scan von GDATA gesehen, dass über 100 Dateien den Zugriff verweigern. Könnten das auch Viren sein? Sind in den Verzeichnissen: C:\Program Data\Microsoft\Crypto\RSA\Machine Keys C\Windows\System32 C:\System Volume Information Fixlog Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014 Ran by Tino at 2014-09-19 12:01:16 Run:1 Running from C:\Users\Tino\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** HKLM\...\Run: [Unattend0000000001{CBF3078B-5A06-4E8A-B429-5783F1589DDA}] => %SYSTEMDRIVE%\restore\createrestore.exe /r ***************** HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Unattend0000000001{CBF3078B-5A06-4E8A-B429-5783F1589DDA} => value deleted successfully. ==== End of Fixlog ==== |
21.09.2014, 09:39 | #10 |
/// the machine /// TB-Ausbilder | GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne das kommt schon mal vor. BEstehen noch Probleme mit dem System?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
22.09.2014, 01:40 | #11 |
| GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne OK. Nein es bestehen keine Probleme, vorher hatte ich den Virenbefall aber auch nicht als negative Auswirkung aufs System erkannt. FoxyProxy gibts auch nicht mehr. Dann gibts nichts mehr zu tun richtig? // EDIT: Naja google Chrome stürzt jetzt ständig ab... hatte ich vorher nie. ABer das geht jetzt wohl zu weit, kann ja alles sein. |
22.09.2014, 16:15 | #12 |
/// the machine /// TB-Ausbilder | GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de Chrome jetzt besser?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
23.09.2014, 16:47 | #13 |
| GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Ok, zweites mal mit Revo entfernt und diesmal die 32 bit Variante installiert (Vorher 64 bit, trotz 64 bit system evtl. problematisch gewesen). Schaut gut aus Ich hoffe mal der Virenterror ist vorbei und ich kann sicher weitermachen. Dir jedenfalls vielen Dank für deine Hilfe! Eine tolle Sache, dass man hier so schnell kompetente Hilfe bekommt. Ich werd ne Spende dalassen. LG |
24.09.2014, 10:42 | #14 |
/// the machine /// TB-Ausbilder | GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
24.09.2014, 23:46 | #15 |
| GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne Hallo! Ich wollte gerade mit dem allem anfangen, da meldet mir GDATA wieder etwas: "In Ihrem Browser wurde ein unbekannter Schädling (Fingerprint: [38922a8c])entdeckt. Die Schadfunktionen wurden deaktiviert. Trotzdem empfehlen wir Ihnen dringend, bis zur dauerhaften Entfernung des Schädlings keine Passwörter mehr im Browser einzugeben und insbesondere auf empfindliche Vorgänge, wie z.B. Online-Banking, zu verzichten. Zur vollständigen Behebung des Sicherheits-Problems empfehlen wir, den Schädling mit der "G DATA BootCD" zu entfernen. Sollte der Schädling wider Erwarten mit der BootCD nicht entfernt werden können: G DATA arbeitet ständig mit Hochdruck an der Erkennung und Entfernung neuester Computer-Schädlinge und wird voraussichtlich innerhalb kürzester Zeit ein entsprechendes Update bereitstellen können. Für weitere Informationen steht Ihnen der G DATA Support zur Verfügung." Ich muss jetzt erstmal schauen, was die G DATA BootCD überhaupt ist. Hast Du eine Ahnung? Falls das jetzt wieder nötig ist, hier einfach nochmal meine LOG Files. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-09-2014 Ran by Tino (administrator) on TINO-PC on 25-09-2014 00:44:03 Running from C:\Users\Tino\Downloads Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\stacsv64.exe (Hewlett-Packard) C:\Windows\System32\hpservice.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft) C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (G Data Software AG) C:\Program Files (x86)\G Data\USB KEYBOARD GUARD\GD2NDKBB.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\GUI\GDSC.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-18] (IDT, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2013-09-30] () HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2010-02-25] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HPConnectionManager] => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-05-23] (Hewlett-Packard Development Company L.P.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-09-09] (Apple Inc.) HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG) HKLM-x32\...\Run: [GDataUsbProtection] => C:\Program Files (x86)\G DATA\USB KEYBOARD GUARD\GD2NDKBB.exe [1412216 2014-09-05] (G Data Software AG) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe, Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ScCertProp: wlnotify.dll [X] HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.) HKU\S-1-5-21-2385482401-86098894-1030466509-1001\...\MountPoints2: {5697a708-8805-11e3-8258-88ae1dacdee7} - E:\SETUP.EXE Startup: C:\Users\Tino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {CB927D12-4FF7-4A9E-A169-56E4B8A75598} hxxp://qtinstall.apple.com/qtactivex/qtplugin.cab Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: 74.208.10.249 gs.apple.com Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation) Chrome: ======= CHR Profile: C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-22] CHR Extension: (Google Docs) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-22] CHR Extension: (Google Drive) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-22] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-23] CHR Extension: (YouTube) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-22] CHR Extension: (Google Search) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-22] CHR Extension: (Google Sheets) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-22] CHR Extension: (Google Wallet) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-22] CHR Extension: (Gmail) - C:\Users\Tino\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-22] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation) R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-07-30] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG) R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3227624 2014-08-06] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [204576 2014-06-25] (Microsoft) R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe [244224 2009-11-18] (IDT, Inc.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-28] (Disc Soft Ltd) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-29] (G Data Software AG) R3 GDKBBlocker; C:\Windows\system32\drivers\GDKBBlocker64.sys [30720 2014-09-22] (G Data Software AG) R3 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-07-29] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-09-15] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-29] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-09-15] (G Data Software AG) R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-07-30] (G Data Software) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-29] (G Data Software AG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-25] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-25 00:37 - 2014-09-25 00:37 - 00000820 _____ () C:\Users\Tino\Desktop\GDATA Meldung.txt 2014-09-24 13:14 - 2014-09-24 13:15 - 02106880 _____ (Farbar) C:\Users\Tino\Downloads\FRST64.exe 2014-09-24 12:07 - 2014-09-24 23:37 - 00000000 ____D () C:\Users\Tino\Documents\Ernährung 2014-09-24 12:01 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-09-24 12:01 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-09-23 00:21 - 2014-09-23 01:10 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Audacity 2014-09-23 00:21 - 2014-09-23 00:21 - 00001026 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk 2014-09-23 00:21 - 2014-09-23 00:21 - 00000000 ____D () C:\Program Files (x86)\Audacity 2014-09-23 00:17 - 2014-09-23 00:18 - 22180353 _____ (Audacity Team ) C:\Users\Tino\Downloads\audacity-win-2.0.5.exe 2014-09-22 20:38 - 2014-09-25 00:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-22 20:38 - 2014-09-24 20:43 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-22 20:38 - 2014-09-22 20:38 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-09-22 20:38 - 2014-09-22 20:38 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-09-22 20:38 - 2014-09-22 20:38 - 00002254 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-09-22 20:38 - 2014-09-22 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-09-22 19:42 - 2014-09-22 19:42 - 00000057 _____ () C:\ProgramData\Ament.ini 2014-09-22 19:42 - 2014-09-22 19:42 - 00000000 ____D () C:\ProgramData\HP 2014-09-22 19:42 - 2014-09-22 19:42 - 00000000 ____D () C:\Program Files\HP 2014-09-22 19:42 - 2014-09-22 19:42 - 00000000 ____D () C:\Program Files (x86)\HP 2014-09-22 19:42 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPMB011.dll 2014-09-22 19:41 - 2014-09-23 15:12 - 00000000 ____D () C:\Users\Tino\AppData\Local\HP 2014-09-22 19:38 - 2014-09-22 19:40 - 70332736 _____ () C:\Users\Tino\Downloads\DJ3520_1315-1.exe 2014-09-22 19:24 - 2014-09-22 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer 2014-09-22 19:24 - 2014-09-22 19:24 - 00000000 ____D () C:\Program Files\Tracker Software 2014-09-22 19:21 - 2014-09-22 19:22 - 18390866 _____ () C:\Users\Tino\Downloads\PDFXV09wer.zip 2014-09-22 15:08 - 2014-09-22 15:08 - 00030720 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBBlocker64.sys 2014-09-22 15:08 - 2014-09-22 15:08 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBBlocker64_01007.Wdf 2014-09-22 15:02 - 2014-09-22 15:03 - 11896320 _____ (G Data Software AG) C:\Users\Tino\Downloads\INT_GD_USB_KEYBOARD_GUARD.exe 2014-09-20 19:02 - 2014-09-20 19:02 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2014-09-20 19:01 - 2014-09-25 00:38 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU 2014-09-20 17:04 - 2014-09-20 17:06 - 54371328 _____ (PokerStars) C:\Users\Tino\Downloads\PokerStarsInstallEU.exe 2014-09-20 16:51 - 2014-09-20 16:53 - 45480648 _____ () C:\Users\Tino\Downloads\Unconfirmed 858552.crdownload 2014-09-20 16:37 - 2014-09-20 16:37 - 00895120 _____ (Google Inc.) C:\Users\Tino\Downloads\ChromeSetup_64bit_37.0.2062.120.exe 2014-09-20 16:25 - 2014-09-20 16:25 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-09-20 16:24 - 2014-09-20 16:24 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Tino\Downloads\revosetup95.exe 2014-09-18 12:26 - 2014-09-18 12:26 - 02347384 _____ (ESET) C:\Users\Tino\Downloads\esetsmartinstaller_deu.exe 2014-09-16 20:23 - 2014-09-16 20:23 - 00000000 ____D () C:\Windows\ERUNT 2014-09-16 14:43 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-09-16 14:42 - 2014-09-24 14:42 - 00000000 ____D () C:\AdwCleaner 2014-09-16 14:42 - 2014-09-16 14:42 - 01016261 _____ (Thisisu) C:\Users\Tino\Downloads\JRT.exe 2014-09-16 13:41 - 2014-09-16 13:42 - 01373475 _____ () C:\Users\Tino\Downloads\AdwCleaner_3.310.exe 2014-09-16 13:40 - 2014-09-25 00:36 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-16 13:40 - 2014-09-16 13:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:39 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-16 13:39 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-09-16 13:39 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-09-16 13:39 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-09-16 13:38 - 2014-09-16 13:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Tino\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-15 16:58 - 2014-09-15 16:59 - 00036613 _____ () C:\Users\Tino\Downloads\Addition.txt 2014-09-15 16:56 - 2014-09-25 00:44 - 00017087 _____ () C:\Users\Tino\Downloads\FRST.txt 2014-09-15 15:25 - 2014-09-25 00:44 - 00000000 ____D () C:\FRST 2014-09-15 14:07 - 2014-09-15 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2014-09-10 19:12 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-10 19:12 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-09-10 19:12 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-10 19:12 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-10 19:12 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-10 19:12 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-09-10 19:12 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-10 19:12 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-10 19:12 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-10 19:12 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-10 19:12 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-10 19:12 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-10 19:12 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-10 19:12 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-10 19:12 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-10 19:12 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-10 19:12 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-10 19:12 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-09-10 19:12 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-10 19:12 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-10 19:12 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-09-10 19:12 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-10 19:12 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-09-10 19:12 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-09-10 19:12 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-09-10 19:12 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-09-10 19:12 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-09-10 19:12 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-09-10 19:12 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-10 19:12 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-09-10 19:12 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-09-10 19:12 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-09-10 19:12 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-09-10 19:12 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-10 19:12 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-10 19:12 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-10 19:12 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-10 19:12 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-09-10 19:12 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-09-10 19:12 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-09-10 19:12 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-09-10 19:12 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-10 19:12 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-09-10 19:12 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-10 19:12 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-09-10 19:12 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-09-10 19:12 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-09-10 19:12 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-10 19:12 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-09-10 19:12 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-09-10 19:12 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-10 19:12 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-09-10 18:58 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-09-10 18:58 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-09-10 13:14 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-10 13:14 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-10 13:14 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-10 13:14 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-09-10 13:14 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-10 13:14 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-10 13:14 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-09-10 13:14 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-09-10 13:14 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-09-10 13:14 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-10 13:14 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-09-09 20:45 - 2014-09-09 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-09-09 20:42 - 2014-09-09 20:46 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-09-08 22:17 - 2014-09-08 22:17 - 00039424 _____ () C:\Users\Tino\Downloads\Notenblatt_DStipendium_BSc.xls 2014-08-30 20:17 - 2014-09-01 12:59 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\dvdcss 2014-08-30 00:01 - 2014-09-01 17:55 - 00000000 ____D () C:\Users\Tino\AppData\Local\FullTiltPoker.eu 2014-08-30 00:01 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\cache 2014-08-29 23:55 - 2014-08-29 23:57 - 54483208 _____ () C:\Users\Tino\Downloads\FullTiltPokerEuSetup.exe 2014-08-29 20:36 - 2014-09-25 00:38 - 00000000 ____D () C:\Users\Tino\AppData\Local\PokerStars.EU 2014-08-29 20:34 - 2014-08-29 23:55 - 00000000 ____D () C:\Program Files\Verschiedenes 2014-08-28 18:26 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 18:26 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 18:26 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-26 14:58 - 2014-08-26 14:58 - 17279732 _____ () C:\Users\Tino\Downloads\redsn0w_win_0.9.15b3 (1).zip 2014-08-26 14:50 - 2014-08-26 14:50 - 03458048 _____ () C:\Users\Tino\Downloads\tinyumbrella-7.11.00 (1).exe 2014-08-26 14:43 - 2014-08-26 14:43 - 00408541 _____ () C:\Users\Tino\Downloads\ireb-r7.zip ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-25 00:44 - 2014-09-15 16:56 - 00017087 _____ () C:\Users\Tino\Downloads\FRST.txt 2014-09-25 00:44 - 2014-09-15 15:25 - 00000000 ____D () C:\FRST 2014-09-25 00:43 - 2014-09-22 20:38 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-25 00:38 - 2014-09-20 19:01 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU 2014-09-25 00:38 - 2014-08-29 20:36 - 00000000 ____D () C:\Users\Tino\AppData\Local\PokerStars.EU 2014-09-25 00:37 - 2014-09-25 00:37 - 00000820 _____ () C:\Users\Tino\Desktop\GDATA Meldung.txt 2014-09-25 00:36 - 2014-09-16 13:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-25 00:31 - 2013-11-27 14:06 - 00152678 _____ () C:\Windows\setupact.log 2014-09-25 00:22 - 2013-11-27 11:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-24 23:37 - 2014-09-24 12:07 - 00000000 ____D () C:\Users\Tino\Documents\Ernährung 2014-09-24 20:49 - 2009-07-14 06:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-24 20:49 - 2009-07-14 06:45 - 00031904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-09-24 20:43 - 2014-09-22 20:38 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-24 20:42 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-24 18:18 - 2014-01-23 17:35 - 01289807 _____ () C:\Windows\WindowsUpdate.log 2014-09-24 15:41 - 2014-03-27 02:42 - 00000000 ____D () C:\Users\Tino\Documents\Pläne 2014-09-24 15:40 - 2014-08-08 20:36 - 00000000 ____D () C:\Users\Tino\Documents\UNI 2014-09-24 15:39 - 2014-08-08 20:36 - 00000000 ____D () C:\Users\Tino\Documents\Personal Development 2014-09-24 15:39 - 2014-03-27 03:06 - 00000000 ____D () C:\Users\Tino\Documents\Verschiedenes 2014-09-24 14:43 - 2010-11-21 05:47 - 00024784 _____ () C:\Windows\PFRO.log 2014-09-24 14:42 - 2014-09-16 14:42 - 00000000 ____D () C:\AdwCleaner 2014-09-24 13:15 - 2014-09-24 13:14 - 02106880 _____ (Farbar) C:\Users\Tino\Downloads\FRST64.exe 2014-09-24 12:10 - 2014-08-09 00:50 - 00000000 ____D () C:\Users\Tino\Documents\Benutzerdefinierte Office-Vorlagen 2014-09-24 12:09 - 2014-08-08 21:33 - 00000000 ____D () C:\Users\Tino\Documents\Gesundheit 2014-09-24 12:09 - 2014-01-26 00:51 - 00000000 ____D () C:\Users\Tino\Documents\WM 2014-09-24 12:05 - 2014-08-08 20:38 - 00000000 ____D () C:\Users\Tino\Documents\Calls 2014-09-23 20:36 - 2014-08-08 21:27 - 00000000 ____D () C:\Users\Tino\Documents\Finanzen 2014-09-23 15:12 - 2014-09-22 19:41 - 00000000 ____D () C:\Users\Tino\AppData\Local\HP 2014-09-23 01:10 - 2014-09-23 00:21 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Audacity 2014-09-23 00:21 - 2014-09-23 00:21 - 00001026 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk 2014-09-23 00:21 - 2014-09-23 00:21 - 00000000 ____D () C:\Program Files (x86)\Audacity 2014-09-23 00:18 - 2014-09-23 00:17 - 22180353 _____ (Audacity Team ) C:\Users\Tino\Downloads\audacity-win-2.0.5.exe 2014-09-22 20:38 - 2014-09-22 20:38 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-09-22 20:38 - 2014-09-22 20:38 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-09-22 20:38 - 2014-09-22 20:38 - 00002254 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-09-22 20:38 - 2014-09-22 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-09-22 20:38 - 2014-01-25 01:51 - 00000000 ____D () C:\Program Files (x86)\Google 2014-09-22 20:38 - 2014-01-25 01:50 - 00000000 ____D () C:\Users\Tino\AppData\Local\Google 2014-09-22 19:42 - 2014-09-22 19:42 - 00000057 _____ () C:\ProgramData\Ament.ini 2014-09-22 19:42 - 2014-09-22 19:42 - 00000000 ____D () C:\ProgramData\HP 2014-09-22 19:42 - 2014-09-22 19:42 - 00000000 ____D () C:\Program Files\HP 2014-09-22 19:42 - 2014-09-22 19:42 - 00000000 ____D () C:\Program Files (x86)\HP 2014-09-22 19:42 - 2013-11-27 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP 2014-09-22 19:40 - 2014-09-22 19:38 - 70332736 _____ () C:\Users\Tino\Downloads\DJ3520_1315-1.exe 2014-09-22 19:24 - 2014-09-22 19:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer 2014-09-22 19:24 - 2014-09-22 19:24 - 00000000 ____D () C:\Program Files\Tracker Software 2014-09-22 19:22 - 2014-09-22 19:21 - 18390866 _____ () C:\Users\Tino\Downloads\PDFXV09wer.zip 2014-09-22 15:08 - 2014-09-22 15:08 - 00030720 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBBlocker64.sys 2014-09-22 15:08 - 2014-09-22 15:08 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_GDKBBlocker64_01007.Wdf 2014-09-22 15:08 - 2014-01-23 17:45 - 00000000 ____D () C:\Program Files (x86)\G Data 2014-09-22 15:03 - 2014-09-22 15:02 - 11896320 _____ (G Data Software AG) C:\Users\Tino\Downloads\INT_GD_USB_KEYBOARD_GUARD.exe 2014-09-22 14:53 - 2014-01-25 02:18 - 00000000 ____D () C:\Users\Tino\AppData\Local\Akamai 2014-09-22 14:53 - 2013-11-27 11:01 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-09-22 14:52 - 2014-02-13 01:31 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Spotify 2014-09-22 14:41 - 2011-04-12 09:43 - 00699340 _____ () C:\Windows\system32\perfh007.dat 2014-09-22 14:41 - 2011-04-12 09:43 - 00149448 _____ () C:\Windows\system32\perfc007.dat 2014-09-22 14:41 - 2009-07-14 07:13 - 01619272 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-21 13:13 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-09-20 19:02 - 2014-09-20 19:02 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2014-09-20 17:06 - 2014-09-20 17:04 - 54371328 _____ (PokerStars) C:\Users\Tino\Downloads\PokerStarsInstallEU.exe 2014-09-20 16:53 - 2014-09-20 16:51 - 45480648 _____ () C:\Users\Tino\Downloads\Unconfirmed 858552.crdownload 2014-09-20 16:37 - 2014-09-20 16:37 - 00895120 _____ (Google Inc.) C:\Users\Tino\Downloads\ChromeSetup_64bit_37.0.2062.120.exe 2014-09-20 16:34 - 2014-07-09 17:41 - 00000000 ____D () C:\Program Files (x86)\GOG.com 2014-09-20 16:31 - 2014-07-02 04:20 - 00000000 ____D () C:\Users\Tino\AppData\Local\Deployment 2014-09-20 16:25 - 2014-09-20 16:25 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-09-20 16:24 - 2014-09-20 16:24 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Tino\Downloads\revosetup95.exe 2014-09-19 20:14 - 2014-08-19 00:07 - 00000000 ____D () C:\Users\Tino\AppData\Local\Audible 2014-09-18 12:26 - 2014-09-18 12:26 - 02347384 _____ (ESET) C:\Users\Tino\Downloads\esetsmartinstaller_deu.exe 2014-09-16 20:55 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-09-16 20:23 - 2014-09-16 20:23 - 00000000 ____D () C:\Windows\ERUNT 2014-09-16 14:42 - 2014-09-16 14:42 - 01016261 _____ (Thisisu) C:\Users\Tino\Downloads\JRT.exe 2014-09-16 13:42 - 2014-09-16 13:41 - 01373475 _____ () C:\Users\Tino\Downloads\AdwCleaner_3.310.exe 2014-09-16 13:40 - 2014-09-16 13:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-16 13:40 - 2014-09-16 13:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-16 13:39 - 2014-09-16 13:39 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-16 13:39 - 2014-09-16 13:38 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Tino\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-15 16:59 - 2014-09-15 16:58 - 00036613 _____ () C:\Users\Tino\Downloads\Addition.txt 2014-09-15 14:07 - 2014-09-15 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY 2014-09-15 14:07 - 2014-01-23 16:45 - 00142336 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-09-15 14:07 - 2014-01-23 16:45 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-09-15 14:06 - 2014-07-29 03:18 - 00004114 _____ () C:\Windows\DPINST.LOG 2014-09-15 09:06 - 2010-11-21 05:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-15 01:15 - 2014-01-28 16:42 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-15 01:14 - 2014-01-28 16:46 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2014-09-10 19:09 - 2013-11-27 11:04 - 01592824 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-09-10 19:08 - 2014-08-05 23:13 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-10 19:00 - 2014-08-05 23:13 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-10 18:58 - 2014-05-06 07:12 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-09-10 18:46 - 2014-03-29 05:16 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\vlc 2014-09-10 00:11 - 2014-09-24 12:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-09-09 23:47 - 2014-09-24 12:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-09-09 20:46 - 2014-09-09 20:42 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-09-09 20:45 - 2014-09-09 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2014-09-08 22:17 - 2014-09-08 22:17 - 00039424 _____ () C:\Users\Tino\Downloads\Notenblatt_DStipendium_BSc.xls 2014-09-05 04:10 - 2014-09-10 13:14 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-05 04:05 - 2014-09-10 13:14 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-02 23:45 - 2014-07-24 05:54 - 00000000 ____D () C:\Users\Tino\Documents\Praktika 2014-09-01 17:55 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\FullTiltPoker.eu 2014-09-01 12:59 - 2014-08-30 20:17 - 00000000 ____D () C:\Users\Tino\AppData\Roaming\dvdcss 2014-08-30 00:01 - 2014-08-30 00:01 - 00000000 ____D () C:\Users\Tino\AppData\Local\cache 2014-08-29 23:57 - 2014-08-29 23:55 - 54483208 _____ () C:\Users\Tino\Downloads\FullTiltPokerEuSetup.exe 2014-08-29 23:55 - 2014-08-29 20:34 - 00000000 ____D () C:\Program Files\Verschiedenes 2014-08-29 12:42 - 2009-07-14 06:45 - 00438168 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-26 14:58 - 2014-08-26 14:58 - 17279732 _____ () C:\Users\Tino\Downloads\redsn0w_win_0.9.15b3 (1).zip 2014-08-26 14:57 - 2014-08-10 21:56 - 00000877 _____ () C:\Windows\system32\Drivers\etc\hosts.umbrella 2014-08-26 14:57 - 2014-08-10 21:56 - 00000213 _____ () C:\Users\Tino\umbrella0.log 2014-08-26 14:57 - 2014-08-10 19:57 - 00011223 _____ () C:\Users\Tino\Downloads\umbrella.log 2014-08-26 14:57 - 2014-01-23 17:44 - 00000000 ____D () C:\Users\Tino 2014-08-26 14:50 - 2014-08-26 14:50 - 03458048 _____ () C:\Users\Tino\Downloads\tinyumbrella-7.11.00 (1).exe 2014-08-26 14:43 - 2014-08-26 14:43 - 00408541 _____ () C:\Users\Tino\Downloads\ireb-r7.zip Some content of TEMP: ==================== C:\Users\Tino\AppData\Local\Temp\amazonicon_v4.exe C:\Users\Tino\AppData\Local\Temp\amazoninstallernircmdc.exe C:\Users\Tino\AppData\Local\Temp\memoPERS_free.exe C:\Users\Tino\AppData\Local\Temp\ose00000.exe C:\Users\Tino\AppData\Local\Temp\Quarantine.exe C:\Users\Tino\AppData\Local\Temp\sdanircmdc.exe C:\Users\Tino\AppData\Local\Temp\sdapskill.exe C:\Users\Tino\AppData\Local\Temp\sdaspwn.exe C:\Users\Tino\AppData\Local\Temp\_unps.exe C:\Users\Tino\AppData\Local\Temp\{4F8ED1F5-5C76-4BD1-A905-50A280DE78CD}-35.0.1916.153_35.0.1916.114_chrome_updater_alt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-16 15:21 ==================== End Of Log ============================ --- --- --- |
Themen zu GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne |
appdata, cmd.exe, fehlercode 0xc0000005, nötig, pup.optional.conduit.a, pup.optional.opencandy, pup.optional.somoto, quarantäne, unternehmen, win32 adware conduit b, win32/winloadsda.d, wirklich |