| |
| |||||||
Log-Analyse und Auswertung: Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
16.09.2014, 09:55
| #1 |
| |  Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. Hallo, und vorab Danke für die Hilfe. Seit ca. 1,5 Wochen habe ich das Problem, dass in regelmäßigen Abständen ein Audiostream abgespielt wird. Dies ist sowohl Werbung, als auch Nachrichten oder die Wettervorhersage in unterschiedlichen Sprachen. Über den Taskmanager konnte ich den Prozess nicht lokalisieren und stoppen. Ich verwende Bitdefender Internet Security, habe immer wieder gescannt aber er hat nichts gefunden. In der Zeit hatte ich einen Bluescreen. Ich weiß nicht mehr genau seit wann, aber im Arbeitsplatz befinden sich 4 Wechseldatenträger die ich nicht zuordnen kann und die bei Doppelklick darum bitten einen Datenträger einzulegen (vielleicht von Bedeutung?). Zur Anleitung der Logerstellung: Defogger und FRST haben problemlos geklappt. Für GMER musste ich Bitdefender deinstallieren, da es sich nicht deaktivieren lässt. Beim ersten ausführen der GMER ist das Programm beim scannen abgestürzt und es kam eine Meldung, dass es beschädigt sei. Beim zweiten ausführen hat es geklappt aber nichts gefunden und keinen Log erstellt. Beim neuen installieren von Bitdefender kam ein Bluescreen. Es klappte erst nach einem Neustart wieder. Der Defogger Log: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:04 on 16/09/2014 (Lumey)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Lumey (administrator) on SUPERSPEED on 16-09-2014 10:07:04
Running from C:\Users\Lumey\Desktop\Virus entfernen
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe
(Microsoft Corporation) C:\Windows\vVX1000.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
() C:\Users\Lumey\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
() C:\Users\Lumey\AppData\Roaming\InetStat\inetstat.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Users\Lumey\Desktop\Virus entfernen\Defogger.exe
(Microsoft Corporation) C:\Windows\System32\wbengine.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1575192 2013-10-24] (Bitdefender)
HKLM\...\Run: [VX1000] => C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation)
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [Google Update] => C:\Users\Lumey\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-12-19] (Google Inc.)
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [Amazon Music] => C:\Users\Lumey\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] ()
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [InetStat] => C:\Users\Lumey\AppData\Roaming\InetStat\inetstat.exe [706544 2014-08-07] ()
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22734160 2014-08-08] (Google)
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\MountPoints2: {95b01228-4a05-11e2-86c5-806e6f6e6963} - E:\start.exe /checksection
Startup: C:\Users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung SSD Magician.lnk
ShortcutTarget: Samsung SSD Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung SSD Magician.exe (Samsung Electronics.)
Startup: C:\Users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default
FF Homepage: hxxp://www.zanox.com/de/ | hxxp://www.affili.net/de/Startseite.aspx | hxxp://www.baseline.de/admin/login.html | hxxp://www.belboon.com/de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF user.js: detected! => C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\user.js
FF SearchPlugin: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\youtubeunblocker@unblocker.yt [2014-09-12]
FF Extension: Autofill Forms - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\autofillForms@blueimp.net.xpi [2013-01-20]
FF Extension: YSlow - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\yslow@yahoo-inc.com.xpi [2013-06-18]
FF Extension: {218a9a75-7903-4a92-9365-f3afb1e33538} - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{218a9a75-7903-4a92-9365-f3afb1e33538}.xpi [2013-10-31]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2012-12-20]
FF Extension: QuickTime Manager Pro - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{69bae1d9-901c-435e-9c3a-2147b37f64d8}.xpi [2013-11-06]
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext
FF Extension: bdToolbar - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2012-12-19]
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR HomePage: Default -> BD97D806D1BADC380D1D800D7E9165D265E2E8AF7042376B00BBEDC3CFE3D601
CHR DefaultSearchKeyword: Default -> 8C618C2A006EF9BA48165FFAD44723793FEA959949BB61795B991F099B997BC0
CHR DefaultSearchProvider: Default -> 28244647C0AF5AD5CC01983C13EB0702DB67E394E82D0130E29E42E9470B99AF
CHR DefaultSearchURL: Default -> EF4872816F11B98EA7F4F16073C2BA1235276CBEBB4C5D89A3977973F4BC9A87
CHR Profile: C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (RoboForm Lite Password Manager) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\kidhjpmgjfbkmcfpfakmdddddgfbhahj [2013-01-20]
CHR Extension: (Google Wallet) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Lumey\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-09-14]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-10-24] (Bitdefender)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-23] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [67320 2013-10-24] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1645256 2013-10-24] (Bitdefender)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-10-24] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-12-19] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-10-24] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-04-29] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-10-24] (BitDefender SRL)
S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [77040 2012-11-02] (Fresco Logic)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-10-24] (BitDefender LLC)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-10-24] (BitDefender S.R.L.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U3 kwlyrfow; \??\C:\Users\Lumey\AppData\Local\Temp\kwlyrfow.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-16 10:07 - 2014-09-16 10:07 - 00000000 ____D () C:\FRST
2014-09-16 10:04 - 2014-09-16 10:04 - 00000000 _____ () C:\Users\Lumey\defogger_reenable
2014-09-15 10:35 - 2014-09-16 10:07 - 00000000 ____D () C:\Users\Lumey\Desktop\Virus entfernen
2014-09-15 08:40 - 2014-09-15 08:40 - 00000000 ____D () C:\Users\Lumey\Documents\Befund
2014-09-14 15:51 - 2014-09-14 15:51 - 00000000 ____D () C:\Users\Lumey\Desktop\Navi
2014-09-14 13:07 - 2014-09-16 09:53 - 00000000 ___RD () C:\Users\Lumey\Google Drive
2014-09-14 13:07 - 2014-09-14 13:07 - 00001715 _____ () C:\Users\Lumey\Desktop\Google Drive.lnk
2014-09-14 13:05 - 2014-09-16 09:53 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-14 13:05 - 2014-09-15 16:10 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-14 13:05 - 2014-09-14 13:05 - 00895120 _____ (Google Inc.) C:\Users\Lumey\Downloads\googledrivesync.exe
2014-09-14 13:05 - 2014-09-14 13:05 - 00003892 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-09-14 13:05 - 2014-09-14 13:05 - 00003640 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-09-14 13:05 - 2014-09-14 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-09-14 13:05 - 2014-09-14 13:05 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-14 10:40 - 2014-09-14 10:48 - 00000000 ____D () C:\Users\Lumey\Desktop\Vattenfall Problematik
2014-09-13 10:20 - 2014-09-13 10:20 - 02772915 _____ () C:\Users\Lumey\Desktop\bookmarks-2014-09-13.json
2014-09-13 10:19 - 2014-09-13 10:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 20:43 - 2014-09-12 20:45 - 00071550 _____ () C:\Users\Lumey\Desktop\Hausverwaltungen Berlin Brandenburg.xlsx
2014-09-12 14:37 - 2014-09-12 14:37 - 00000000 ____D () C:\Users\Lumey\Desktop\Symbole
2014-09-12 14:01 - 2014-09-12 14:33 - 00017070 _____ () C:\Users\Lumey\Desktop\ERP Software.xlsx
2014-09-11 09:09 - 2014-09-11 09:09 - 00000073 _____ () C:\Users\Lumey\Desktop\Disavow WK.txt
2014-09-10 18:07 - 2014-09-10 18:07 - 00034269 _____ () C:\Users\Lumey\Desktop\baseline disavow.xlsx
2014-09-10 14:58 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-10 14:58 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-10 14:58 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-10 14:58 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-10 14:58 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 14:58 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-10 14:58 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-10 14:58 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-10 14:58 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-10 14:58 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-10 14:58 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-10 14:58 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-10 14:58 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-10 14:58 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-10 14:58 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-10 14:58 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-10 14:58 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-10 14:58 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-10 14:58 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-10 14:58 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-10 14:58 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 14:58 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-10 14:58 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-10 14:58 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 14:58 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-10 14:58 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-10 14:58 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-10 14:58 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-10 14:58 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-10 14:58 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-10 14:58 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-10 14:58 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-10 14:58 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-10 14:58 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-10 14:58 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-10 14:58 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-10 14:58 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-10 14:58 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-10 14:58 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-10 14:58 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 14:58 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-10 14:58 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-10 14:58 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-10 14:58 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-10 14:58 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-10 14:58 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-10 14:58 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-10 14:58 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-10 14:58 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-10 14:58 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-10 14:58 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-10 14:58 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-10 14:58 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-10 14:58 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-10 14:58 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-10 14:58 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-10 14:51 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 14:51 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-10 14:41 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-09-10 14:41 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-09-10 13:57 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-10 13:57 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-10 13:57 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-10 13:57 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-10 13:57 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-10 13:57 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-10 13:57 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-10 13:57 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-10 13:57 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-10 13:57 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-10 13:57 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-10 13:57 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-09-10 13:57 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-09-10 13:41 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-09-10 13:41 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-09-10 13:41 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-09-10 13:41 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-09-10 13:41 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-09-10 13:41 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-09-10 13:41 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-09-10 13:41 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-09-10 13:41 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-09-10 13:41 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-09-10 13:41 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-09-10 13:41 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-09-10 13:41 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-09-10 13:41 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-09-10 13:41 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-09-10 13:41 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-09-10 13:40 - 2014-09-10 13:40 - 00000000 ____D () C:\Users\Lumey\AppData\Local\NVIDIA
2014-09-10 13:40 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-09-10 13:40 - 2012-08-23 16:12 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\terminpt.sys
2014-09-10 13:40 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-09-10 13:40 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2014-09-10 13:40 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-09-10 13:40 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-09-10 13:38 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-09-10 13:32 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-10 13:32 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-10 13:31 - 2014-09-10 15:43 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-10 13:30 - 2014-09-10 13:30 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-10 13:30 - 2014-09-10 13:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-10 13:30 - 2014-09-10 13:30 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-10 13:30 - 2014-09-10 13:30 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-10 13:30 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-10 13:30 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-10 13:30 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-10 13:30 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-09-10 13:30 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-09-09 18:03 - 2014-09-09 18:03 - 00006331 _____ () C:\Users\Lumey\Desktop\Datenschutz Backup.txt
2014-09-09 17:42 - 2014-09-09 18:14 - 00000000 ____D () C:\Users\Lumey\Desktop\AGB Partnerprogramm
2014-09-08 21:03 - 2014-09-08 21:03 - 742038432 _____ () C:\Windows\MEMORY.DMP
2014-09-08 21:03 - 2014-09-08 21:03 - 00295224 _____ () C:\Windows\Minidump\090814-14554-01.dmp
2014-09-08 21:03 - 2014-09-08 21:03 - 00000000 ____D () C:\Windows\Minidump
2014-09-07 10:27 - 2014-09-07 10:27 - 00000000 ____D () C:\Windows\Hewlett-Packard
2014-08-28 17:02 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 17:02 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 17:02 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-24 23:47 - 2014-08-24 23:47 - 00262546 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-08-24 21:39 - 2014-08-24 21:39 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - 527f303c31834cdd9517ffb0ce0818a1bc84fb9b6bcb4e22a417a56da853e660
2014-08-23 11:52 - 2014-08-23 12:26 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\MAGIX
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\Documents\MAGIX_MusicEditor
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Xara
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Magix
2014-08-23 11:51 - 2014-08-23 11:51 - 00000000 ____D () C:\Users\Public\Documents\MAGIX
2014-08-23 11:51 - 2014-08-23 11:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2014-08-23 11:29 - 2014-08-23 12:26 - 00000000 ___RD () C:\Users\Lumey\Documents\MAGIX
2014-08-23 11:29 - 2014-08-23 11:40 - 00000000 ____D () C:\Program Files (x86)\MAGIX
2014-08-23 11:28 - 2014-08-23 12:26 - 00000000 ____D () C:\ProgramData\MAGIX
2014-08-23 11:28 - 2014-08-23 11:28 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-08-21 16:47 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-21 16:47 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-21 16:47 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-21 16:47 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-21 16:47 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-21 16:47 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-21 16:47 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-21 16:47 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-21 16:47 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-21 16:47 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-21 16:47 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-21 16:47 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-21 16:47 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-21 16:47 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-19 22:15 - 2014-08-19 22:15 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-19 22:14 - 2014-08-19 22:14 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-19 22:14 - 2014-08-19 22:14 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-19 22:13 - 2014-08-19 22:13 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-17 16:56 - 2014-09-16 09:53 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Adobe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-16 10:07 - 2014-09-16 10:07 - 00000000 ____D () C:\FRST
2014-09-16 10:07 - 2014-09-15 10:35 - 00000000 ____D () C:\Users\Lumey\Desktop\Virus entfernen
2014-09-16 10:04 - 2014-09-16 10:04 - 00000000 _____ () C:\Users\Lumey\defogger_reenable
2014-09-16 10:04 - 2012-12-19 20:03 - 00000000 ____D () C:\Users\Lumey
2014-09-16 09:59 - 2012-12-19 20:03 - 01887124 _____ () C:\Windows\WindowsUpdate.log
2014-09-16 09:59 - 2009-07-14 06:45 - 00031616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-16 09:59 - 2009-07-14 06:45 - 00031616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-16 09:56 - 2012-12-20 04:54 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-09-16 09:56 - 2012-12-20 04:54 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-09-16 09:56 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-16 09:54 - 2012-12-19 20:46 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001UA.job
2014-09-16 09:53 - 2014-09-14 13:07 - 00000000 ___RD () C:\Users\Lumey\Google Drive
2014-09-16 09:53 - 2014-09-14 13:05 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-16 09:53 - 2014-08-17 16:56 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Adobe
2014-09-16 09:52 - 2012-12-19 20:09 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-16 09:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-16 09:52 - 2009-07-14 06:51 - 00081148 _____ () C:\Windows\setupact.log
2014-09-15 16:22 - 2013-01-22 20:02 - 00000401 _____ () C:\Windows\system32\checkdnsid.xml
2014-09-15 16:10 - 2014-09-14 13:05 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-15 16:10 - 2013-07-23 07:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-15 10:54 - 2012-12-19 20:46 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001Core.job
2014-09-15 08:40 - 2014-09-15 08:40 - 00000000 ____D () C:\Users\Lumey\Documents\Befund
2014-09-15 08:40 - 2014-04-21 09:42 - 00000000 ____D () C:\Users\Lumey\Documents\Anastasia
2014-09-14 15:51 - 2014-09-14 15:51 - 00000000 ____D () C:\Users\Lumey\Desktop\Navi
2014-09-14 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-14 13:07 - 2014-09-14 13:07 - 00001715 _____ () C:\Users\Lumey\Desktop\Google Drive.lnk
2014-09-14 13:05 - 2014-09-14 13:05 - 00895120 _____ (Google Inc.) C:\Users\Lumey\Downloads\googledrivesync.exe
2014-09-14 13:05 - 2014-09-14 13:05 - 00003892 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-09-14 13:05 - 2014-09-14 13:05 - 00003640 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-09-14 13:05 - 2014-09-14 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-09-14 13:05 - 2014-09-14 13:05 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-14 13:05 - 2012-12-19 20:46 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Google
2014-09-14 10:48 - 2014-09-14 10:40 - 00000000 ____D () C:\Users\Lumey\Desktop\Vattenfall Problematik
2014-09-14 10:34 - 2013-12-04 21:46 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\HpUpdate
2014-09-13 13:30 - 2013-01-12 16:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-13 10:20 - 2014-09-13 10:20 - 02772915 _____ () C:\Users\Lumey\Desktop\bookmarks-2014-09-13.json
2014-09-13 10:19 - 2014-09-13 10:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 20:45 - 2014-09-12 20:43 - 00071550 _____ () C:\Users\Lumey\Desktop\Hausverwaltungen Berlin Brandenburg.xlsx
2014-09-12 14:37 - 2014-09-12 14:37 - 00000000 ____D () C:\Users\Lumey\Desktop\Symbole
2014-09-12 14:33 - 2014-09-12 14:01 - 00017070 _____ () C:\Users\Lumey\Desktop\ERP Software.xlsx
2014-09-11 09:09 - 2014-09-11 09:09 - 00000073 _____ () C:\Users\Lumey\Desktop\Disavow WK.txt
2014-09-10 21:00 - 2010-11-21 05:47 - 03755028 _____ () C:\Windows\PFRO.log
2014-09-10 18:07 - 2014-09-10 18:07 - 00034269 _____ () C:\Users\Lumey\Desktop\baseline disavow.xlsx
2014-09-10 15:43 - 2014-09-10 13:31 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-10 15:33 - 2009-07-14 07:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-09-10 15:31 - 2014-08-07 19:04 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\Security System 2
2014-09-10 14:58 - 2012-12-19 21:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-10 14:57 - 2013-12-22 19:50 - 01594028 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-10 14:56 - 2013-07-25 10:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-10 14:52 - 2012-12-19 20:41 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 14:51 - 2014-05-06 17:32 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-10 14:29 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-10 14:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-09-10 13:40 - 2014-09-10 13:40 - 00000000 ____D () C:\Users\Lumey\AppData\Local\NVIDIA
2014-09-10 13:40 - 2012-12-19 20:08 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-10 13:40 - 2012-12-19 20:08 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-09-10 13:39 - 2012-12-19 20:08 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-09-10 13:30 - 2014-09-10 13:30 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-10 13:30 - 2014-09-10 13:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-10 13:30 - 2014-09-10 13:30 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-10 13:30 - 2014-09-10 13:30 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-09 23:09 - 2014-04-05 12:02 - 00000988 _____ () C:\Users\Lumey\Desktop\LS Wood Workflow.lnk
2014-09-09 23:09 - 2013-05-18 19:24 - 00000884 _____ () C:\Users\Lumey\Desktop\Zugang.lnk
2014-09-09 23:08 - 2014-04-05 12:07 - 00001114 _____ () C:\Users\Lumey\Desktop\M U&R Workflow.lnk
2014-09-09 23:08 - 2014-04-05 12:01 - 00001318 _____ () C:\Users\Lumey\Desktop\baseline Workflow.lnk
2014-09-09 23:08 - 2014-04-05 12:00 - 00001072 _____ () C:\Users\Lumey\Desktop\AFC Workflow.lnk
2014-09-09 23:08 - 2014-04-05 11:58 - 00001072 _____ () C:\Users\Lumey\Desktop\DCI Workflow.lnk
2014-09-09 23:08 - 2014-04-05 11:55 - 00001079 _____ () C:\Users\Lumey\Desktop\WK Workflow.lnk
2014-09-09 23:08 - 2013-10-27 18:09 - 00001372 _____ () C:\Users\Lumey\Desktop\M U&R Belege.lnk
2014-09-09 23:08 - 2013-10-27 18:07 - 00001333 _____ () C:\Users\Lumey\Desktop\WK Belege.lnk
2014-09-09 23:08 - 2013-10-27 18:06 - 00001330 _____ () C:\Users\Lumey\Desktop\AFC Belege.lnk
2014-09-09 23:07 - 2014-04-05 11:56 - 00001330 _____ () C:\Users\Lumey\Desktop\DCI Belege.lnk
2014-09-09 21:10 - 2013-07-23 07:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-09 21:10 - 2012-12-20 19:57 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-09 21:10 - 2012-12-20 19:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-09 18:18 - 2012-12-20 21:04 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\FileZilla
2014-09-09 18:17 - 2013-01-15 20:53 - 00001456 _____ () C:\Users\Lumey\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-09-09 18:14 - 2014-09-09 17:42 - 00000000 ____D () C:\Users\Lumey\Desktop\AGB Partnerprogramm
2014-09-09 18:03 - 2014-09-09 18:03 - 00006331 _____ () C:\Users\Lumey\Desktop\Datenschutz Backup.txt
2014-09-08 21:03 - 2014-09-08 21:03 - 742038432 _____ () C:\Windows\MEMORY.DMP
2014-09-08 21:03 - 2014-09-08 21:03 - 00295224 _____ () C:\Windows\Minidump\090814-14554-01.dmp
2014-09-08 21:03 - 2014-09-08 21:03 - 00000000 ____D () C:\Windows\Minidump
2014-09-08 07:24 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-07 10:27 - 2014-09-07 10:27 - 00000000 ____D () C:\Windows\Hewlett-Packard
2014-09-07 10:27 - 2014-07-08 18:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-09-05 18:09 - 2013-01-15 19:48 - 00000132 _____ () C:\Users\Lumey\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen
2014-09-05 04:10 - 2014-09-10 13:57 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-10 13:57 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-28 20:23 - 2009-07-14 06:45 - 05132456 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-24 23:47 - 2014-08-24 23:47 - 00262546 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-08-24 21:39 - 2014-08-24 21:39 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - 527f303c31834cdd9517ffb0ce0818a1bc84fb9b6bcb4e22a417a56da853e660
2014-08-24 14:34 - 2012-12-19 20:46 - 00153000 _____ () C:\Users\Lumey\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 12:26 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\MAGIX
2014-08-23 12:26 - 2014-08-23 11:29 - 00000000 ___RD () C:\Users\Lumey\Documents\MAGIX
2014-08-23 12:26 - 2014-08-23 11:28 - 00000000 ____D () C:\ProgramData\MAGIX
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\Documents\MAGIX_MusicEditor
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Xara
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Magix
2014-08-23 11:51 - 2014-08-23 11:51 - 00000000 ____D () C:\Users\Public\Documents\MAGIX
2014-08-23 11:51 - 2014-08-23 11:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2014-08-23 11:40 - 2014-08-23 11:29 - 00000000 ____D () C:\Program Files (x86)\MAGIX
2014-08-23 11:28 - 2014-08-23 11:28 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-08-23 04:07 - 2014-08-28 17:02 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 17:02 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 17:02 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-19 22:15 - 2014-08-19 22:15 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-19 22:15 - 2014-08-19 22:15 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-08-19 22:15 - 2013-02-26 00:32 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-19 22:15 - 2013-02-26 00:32 - 00965312 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-08-19 22:15 - 2012-12-19 20:09 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-08-19 22:15 - 2012-12-19 20:09 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 14498552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-19 22:14 - 2014-08-19 22:14 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-19 22:14 - 2014-08-19 22:14 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-08-19 22:14 - 2014-08-19 22:14 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-19 22:14 - 2013-02-26 00:32 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-08-19 22:14 - 2013-02-26 00:32 - 03196816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-08-19 22:14 - 2012-10-10 22:22 - 00026353 _____ () C:\Windows\system32\nvinfo.pb
2014-08-19 22:13 - 2014-08-19 22:13 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-19 20:05 - 2014-09-10 14:58 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 19:39 - 2014-09-10 14:58 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 01:01 - 2014-09-10 14:58 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-10 14:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-10 14:58 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-10 14:58 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-10 14:58 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-10 14:58 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-10 14:58 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-10 14:58 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-10 14:58 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-10 14:58 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:08 - 2014-09-10 14:58 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:08 - 2014-09-10 14:58 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-10 14:58 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:05 - 2014-09-10 14:58 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-10 14:58 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-10 14:58 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-10 14:58 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-10 14:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-10 14:58 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-10 14:58 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-10 14:58 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-10 14:58 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-10 14:58 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-10 14:58 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-10 14:58 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-10 14:58 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-10 14:58 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-10 14:58 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-10 14:58 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-10 14:58 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-10 14:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-10 14:58 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-10 14:58 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-10 14:58 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:27 - 2014-09-10 14:58 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-10 14:58 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-10 14:58 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-10 14:58 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:23 - 2014-09-10 14:58 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:22 - 2014-09-10 14:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-10 14:58 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-10 14:58 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-10 14:58 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-10 14:58 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-10 14:58 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-10 14:58 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-10 14:58 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-10 14:58 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-10 14:58 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-10 14:58 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-10 14:58 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-10 14:58 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:38 - 2014-09-10 14:58 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:36 - 2014-09-10 14:58 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-17 09:34 - 2013-10-01 18:54 - 00000000 ____D () C:\Users\Lumey\Documents\Bewerbung
Some content of TEMP:
====================
C:\Users\Lumey\AppData\Local\Temp\AskSLib.dll
C:\Users\Lumey\AppData\Local\Temp\Foxit Updater.exe
C:\Users\Lumey\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Lumey\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Lumey\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Lumey\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Lumey\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Lumey\AppData\Local\Temp\Lifecam3.0.204.0.exe
C:\Users\Lumey\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Lumey\AppData\Local\Temp\nvStInst.exe
C:\Users\Lumey\AppData\Local\Temp\pdf24-creator-update.exe
C:\Users\Lumey\AppData\Local\Temp\setup_292.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 09:21
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Lumey at 2014-09-16 10:07:41
Running from C:\Users\Lumey\Desktop\Virus entfernen
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Bitdefender Virenschutz (Enabled - Up to date) {9B5F5313-CAF9-DD97-C460-E778420237B4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Bitdefender Spyware-Schutz (Enabled - Up to date) {203EB2F7-ECC3-D219-FED0-DC0A39857D09}
FW: Bitdefender Firewall (Enabled) {A364D236-8096-DCCF-EF3F-4E4DBCD170CF}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.7.0.1860 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.7.0.1860 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Advanced Renamer (HKLM-x32\...\Advanced Renamer_is1) (Version: 3.60 - Hulubulu Software)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.2.0.591 - Amazon Services LLC)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Balsamiq Mockups For Desktop (HKLM-x32\...\BalsamiqMockupsForDesktop.EDE15CF69E11F7F7D45B5430C7D37CC6C3545E3C.1) (Version: 2.2.9 - Balsamiq SRL)
Balsamiq Mockups For Desktop (x32 Version: 2.2.9 - Balsamiq SRL) Hidden
BeCyPDFMetaEdit (HKLM-x32\...\BeCyPDFMetaEdit) (Version: 2.37.0 - Benjamin Bentmann)
Bitdefender Internet Security 2013 (HKLM\...\Bitdefender) (Version: 16.25.0.1710 - Bitdefender)
Boxer Text Editor v14.0 (HKLM-x32\...\Boxer Text Editor) (Version: v14.0 - Boxer Software)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{650DE870-ECA3-4E63-8D77-778512BE5D4C}) (Version: - Microsoft)
FileZilla Client 3.6.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{39AB2E37-1A55-4292-A5D3-971E9F70D0F8}) (Version: 2.1.32.0 - MAGIX AG)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 5.4.4.1023 - Foxit Corporation)
Fresco Logic USB3.0 Host Controller (HKLM\...\{C337776C-6BB7-4E18-B556-3609059ECC4F}) (Version: 3.5.93.0 - Fresco Logic Inc.)
Google Chrome (HKCU\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Drive (HKLM-x32\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8600 Hilfe (HKLM-x32\...\{FDE820DD-CC88-4395-AD5C-801365B8F316}) (Version: 28.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
InetStat (HKCU\...\InetStat) (Version: 0.5b - InetStat)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
MAGIX Speed burnR (MSI) (HKLM-x32\...\MX.{4A5D0EEC-885E-4190-83AA-32942142514E}) (Version: 7.0.2.6 - MAGIX Software GmbH)
MAGIX Speed burnR (MSI) (Version: 7.0.2.6 - MAGIX Software GmbH) Hidden
MAGIX Video deluxe 2014 Premium (HKLM-x32\...\MX.{9AF04633-AA10-49EC-8969-2792531D34BA}) (Version: 13.0.3.14 - MAGIX Software GmbH)
MAGIX Video deluxe 2014 Premium (Version: 13.0.3.14 - MAGIX Software GmbH) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft Corporation (x32 Version: 9.1.0.0 - Microsoft Corporation) Hidden
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.154.1150 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.4.0 - NVIDIA Corporation) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 5.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Phase 5 HTML-Editor (HKLM-x32\...\{20B1B020-DEAE-48D1-9960-D4C3185D758B}) (Version: 5.6.2.3 - Systemberatung Schommer)
RocketDock 1.3.5 (HKLM-x32\...\RocketDock_is1) (Version: - Punk Software)
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Samsung SSD Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 3.1 - Samsung Electronics)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9179FC17-97A8-4D98-9E09-05720AF5D44E}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3438328156-4283695920-827838287-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3438328156-4283695920-827838287-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3438328156-4283695920-827838287-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3438328156-4283695920-827838287-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
==================== Restore Points =========================
11-09-2014 06:42:46 Windows-Sicherung
11-09-2014 18:00:11 Windows-Sicherung
12-09-2014 18:52:52 Windows-Sicherung
13-09-2014 23:00:23 Windows-Sicherung
15-09-2014 06:48:04 Windows-Sicherung
16-09-2014 08:02:38 Windows-Sicherung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1096045B-CC58-43E9-A8C3-E7D01A26704E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001UA => C:\Users\Lumey\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.)
Task: {21FA1E37-FC41-45DA-8BCC-42429B9EE7ED} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {34C91C47-D0E4-44B9-851E-4DC9B886A821} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-09] (Adobe Systems Incorporated)
Task: {3CCC3AB3-B90A-47DD-A4DF-A8AC54376757} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
Task: {55BCBB04-1C79-417C-9111-CEC83EBC0471} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {657AFABC-74CC-482F-A2CB-282EEE436F65} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {65DB467C-F374-4392-B6DF-09AB3CB7B57A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {6E2D0C83-DA8A-47C2-9720-B5D40A9FDD4D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-14] (Google Inc.)
Task: {87FF7803-6C7D-490D-8050-11E548A632EA} - System32\Tasks\HP AR Program Upload - 527f303c31834cdd9517ffb0ce0818a1bc84fb9b6bcb4e22a417a56da853e660 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {95ED8A9D-DC1C-477B-86F4-6699B3C106DC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001Core => C:\Users\Lumey\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.)
Task: {9BBEAFF3-AEA2-437A-B104-E1A1364FE83A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-09-14] (Google Inc.)
Task: {E2BB8189-AE0A-4975-B229-9E3B4A89BE80} - System32\Tasks\AdobeAAMUpdater-1.0-Superspeed-Lumey => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {E2D22D02-C4BD-4FC2-8609-EF851AFCB11B} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001Core.job => C:\Users\Lumey\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001UA.job => C:\Users\Lumey\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-12-19 20:11 - 2013-10-24 18:44 - 00265080 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\txmlutil.dll
2013-10-24 18:45 - 2013-10-24 18:45 - 00003072 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\UI\accessl.ui
2012-12-19 20:11 - 2011-11-14 21:17 - 00153680 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\bdfwcore.dll
2012-12-19 20:11 - 2013-10-24 18:44 - 00005120 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\UI\IMSecurityAL.ui
2014-07-24 10:42 - 2014-07-24 10:42 - 00780592 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00047_030\ashttpbr.mdl
2014-07-24 10:42 - 2014-07-24 10:42 - 00568400 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00047_030\ashttpdsp.mdl
2014-07-24 10:42 - 2014-07-24 10:42 - 02602680 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00047_030\ashttpph.mdl
2014-07-24 10:42 - 2014-07-24 10:42 - 01323408 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00047_030\ashttprbl.mdl
2012-12-19 20:09 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-12-19 20:45 - 2007-09-02 14:58 - 00495616 _____ () C:\Program Files (x86)\RocketDock\RocketDock.exe
2014-06-13 17:42 - 2014-07-22 22:46 - 03356480 _____ () C:\Users\Lumey\AppData\Local\Amazon Music\Amazon Music Helper.exe
2014-08-07 19:05 - 2014-08-07 19:05 - 00706544 _____ () C:\Users\Lumey\AppData\Roaming\InetStat\inetstat.exe
2014-09-15 10:28 - 2014-09-15 10:28 - 00050477 _____ () C:\Users\Lumey\Desktop\Virus entfernen\Defogger.exe
2012-12-19 20:45 - 2007-09-02 14:57 - 00069632 _____ () C:\Program Files (x86)\RocketDock\RocketDock.dll
2012-11-29 23:59 - 2012-11-29 23:59 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2014-09-16 09:53 - 2014-09-16 09:53 - 00098816 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32api.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00110080 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\pywintypes27.dll
2014-09-16 09:53 - 2014-09-16 09:53 - 00364544 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\pythoncom27.dll
2014-09-16 09:53 - 2014-09-16 09:53 - 00045568 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\_socket.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 01160704 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\_ssl.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00320512 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32com.shell.shell.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00713216 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\_hashlib.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 01175040 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\wx._core_.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00805888 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\wx._gdi_.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00811008 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\wx._windows_.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 01062400 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\wx._controls_.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00735232 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\wx._misc_.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00128512 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\_elementtree.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00127488 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\pyexpat.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00557056 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\pysqlite2._sqlite.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00007168 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\hashobjs_ext.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00087552 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\_ctypes.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00119808 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32file.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00108544 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32security.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00018432 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32event.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00038912 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32inet.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00070656 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\wx._html2.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00167936 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32gui.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00011264 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32crypt.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00027136 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\_multiprocessing.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00686080 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\unicodedata.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00122368 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\wx._wizard.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00010240 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\select.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00024064 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32pipe.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00025600 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32pdh.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00525640 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\windows._lib_cacheinvalidation.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00035840 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32process.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00017408 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32profile.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00022528 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\win32ts.pyd
2014-09-16 09:53 - 2014-09-16 09:53 - 00078336 _____ () C:\Users\Lumey\AppData\Local\Temp\_MEI38442\wx._animate.pyd
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Lumey\Downloads\googledrivesync.exe:BDU
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
Name: Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter
Description: Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek Semiconductor Corp.
Service: RTL8187
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/16/2014 09:53:55 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/15/2014 09:35:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/15/2014 08:15:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/15/2014 08:39:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/14/2014 10:30:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/14/2014 00:51:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/13/2014 09:57:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/13/2014 09:45:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/12/2014 08:44:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/12/2014 06:51:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (09/16/2014 09:54:26 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (09/16/2014 09:54:26 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (09/15/2014 09:36:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (09/15/2014 09:36:29 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (09/15/2014 08:16:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (09/15/2014 08:16:25 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (09/15/2014 04:33:34 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (09/15/2014 08:59:00 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (09/15/2014 08:58:59 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Error: (09/15/2014 08:58:58 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
Microsoft Office Sessions:
=========================
Error: (09/16/2014 09:53:55 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/15/2014 09:35:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/15/2014 08:15:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/15/2014 08:39:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/14/2014 10:30:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/14/2014 00:51:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/13/2014 09:57:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/13/2014 09:45:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/12/2014 08:44:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/12/2014 06:51:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2013-01-30 22:03:02.590
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 21:42:59.048
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 21:28:30.307
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 20:41:34.211
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 20:28:31.871
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 19:39:29.878
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 19:23:52.106
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 18:42:21.153
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 18:08:27.615
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00176_006\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-01-30 17:51:21.769
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Bitdefender\Bitdefender 2013\active virus control\Avc3_00175_005\avcuf64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz
Percentage of memory in use: 41%
Total physical RAM: 4095.12 MB
Available physical RAM: 2405.54 MB
Total Pagefile: 8188.41 MB
Available Pagefile: 6048.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:238.37 GB) (Free:131.09 GB) NTFS
Drive f: (Backup) (Fixed) (Total:1269.53 GB) (Free:1037.86 GB) NTFS
Drive g: (Business) (Fixed) (Total:593.48 GB) (Free:560.12 GB) NTFS
Drive h: (MAIL) (Removable) (Total:14.43 GB) (Free:7.92 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: EEEDD2A1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 7860E5FB)
Partition 1: (Not Active) - (Size=1269.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=593.5 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 14.4 GB) (Disk ID: 58774E02)
Partition 1: (Not Active) - (Size=14.4 GB) - (Type=0C)
==================== End Of Log ============================
Danke für eure Hilfe |
|
16.09.2014, 10:25
| #2 |
| /// the machine /// TB-Ausbilder    | Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. hi,
__________________Scan mit Combofix
__________________ |
|
16.09.2014, 11:53
| #3 |
| | Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. Combofix log (keine Fehlermeldungen):
__________________Code:
ATTFilter ComboFix 14-09-16.01 - Lumey 16.09.2014 12:35:14.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.4095.3016 [GMT 2:00]
ausgeführt von:: c:\users\Lumey\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\1410863455.bdinstall.bin
c:\programdata\1410863608.bdinstall.bin
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{0C3240D0-4B68-42BB-8496-2ADCF675FB16}.xps
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{11C055FF-A863-4F5F-AE1C-F2F6C6038D25}.xps
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1CC4B664-992C-43A6-BABC-E157DF5F55CF}.xps
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{3615464D-FED4-4A66-826E-D9BF890AD373}.xps
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{3A1F3166-5958-4C3A-90AF-C595452DE27B}.xps
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{4B1B02C8-5BB2-4B3F-8478-8BBBE9CB22E8}.xps
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{58468AE7-73F0-4C53-9DEB-ACEB718B6974}.xps
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{9EC63458-799C-4BDF-8332-B5590074A36E}.xps
c:\users\Lumey\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A4200A93-7A2A-4BF5-9599-69764ECECC55}.xps
c:\users\Lumey\AppData\Roaming\.#
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-08-16 bis 2014-09-16 ))))))))))))))))))))))))))))))
.
.
2014-09-16 10:41 . 2014-09-16 10:41 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-09-16 10:41 . 2014-09-16 10:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-09-16 10:31 . 2014-09-16 10:31 -------- d-----w- c:\program files\Bitdefender
2014-09-16 08:33 . 2013-11-04 13:47 74512 ----a-w- c:\windows\SysWow64\bdsandboxuiskin32.dll
2014-09-16 08:32 . 2014-09-16 08:32 0 ----a-w- c:\windows\system32\BDSandBoxUISkin32.dll
2014-09-16 08:32 . 2013-11-04 13:47 84848 ----a-w- c:\windows\system32\BDSandBoxUISkin.dll
2014-09-16 08:32 . 2013-11-04 13:46 34384 ----a-w- c:\windows\system32\BDSandBoxUH.dll
2014-09-16 08:30 . 2014-09-16 08:30 -------- d-----w- c:\program files (x86)\Common Files\Bitdefender
2014-09-16 08:07 . 2014-09-16 08:08 -------- d-----w- C:\FRST
2014-09-14 11:07 . 2014-09-16 07:53 -------- d-----r- c:\users\Lumey\Google Drive
2014-09-14 11:05 . 2014-09-14 11:05 -------- d-----w- c:\program files (x86)\Google
2014-09-10 12:51 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-10 12:51 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-10 12:41 . 2014-01-09 02:22 5694464 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-09-10 12:41 . 2014-01-03 22:44 6574592 ----a-w- c:\windows\system32\mstscax.dll
2014-09-10 11:41 . 2013-10-02 04:51 3584 ----a-w- c:\windows\system32\drivers\de-DE\tsusbflt.sys.mui
2014-09-10 11:40 . 2012-08-23 14:12 29696 ----a-w- c:\windows\system32\drivers\terminpt.sys
2014-09-10 11:40 . 2012-08-23 14:10 19456 ----a-w- c:\windows\system32\drivers\rdpvideominiport.sys
2014-09-10 11:40 . 2012-08-23 14:08 30208 ----a-w- c:\windows\system32\drivers\TsUsbGD.sys
2014-09-10 11:40 . 2012-08-23 14:13 243200 ----a-w- c:\windows\system32\rdpudd.dll
2014-09-10 11:40 . 2012-08-23 11:12 192000 ----a-w- c:\windows\SysWow64\rdpendp_winip.dll
2014-09-10 11:40 . 2012-08-23 10:51 228864 ----a-w- c:\windows\system32\rdpendp_winip.dll
2014-09-10 11:40 . 2014-09-10 11:40 -------- d-----w- c:\users\Lumey\AppData\Local\NVIDIA
2014-09-10 11:38 . 2014-07-02 17:44 609240 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2014-09-10 11:35 . 2014-09-10 11:35 -------- d-----w- c:\program files\Microsoft Silverlight
2014-09-10 11:35 . 2014-09-10 11:35 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2014-09-10 11:32 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2014-09-10 11:32 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-09-10 11:30 . 2014-09-10 11:30 -------- d-----w- c:\programdata\Malwarebytes
2014-09-10 11:30 . 2011-05-13 10:16 493056 ----a-w- c:\windows\SysWow64\dhRichClient3.dll
2014-09-10 11:30 . 2011-03-25 18:42 338432 ----a-w- c:\windows\SysWow64\sqlite36_engine.dll
2014-09-07 08:27 . 2014-09-07 08:27 -------- d-----w- c:\windows\Hewlett-Packard
2014-08-28 15:02 . 2014-08-23 02:07 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-28 15:02 . 2014-08-23 01:45 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-28 15:02 . 2014-08-23 00:59 3163648 ----a-w- c:\windows\system32\win32k.sys
2014-08-23 09:52 . 2014-08-23 09:52 -------- d-----w- c:\users\Lumey\AppData\Local\Magix
2014-08-23 09:52 . 2014-08-23 09:52 -------- d-----w- c:\users\Lumey\AppData\Local\Xara
2014-08-23 09:52 . 2014-08-23 10:26 -------- d-----w- c:\users\Lumey\AppData\Roaming\MAGIX
2014-08-23 09:42 . 2014-08-23 09:42 -------- d-----w- c:\program files (x86)\Common Files\MAGIX Shared
2014-08-23 09:29 . 2014-08-23 09:40 -------- d-----w- c:\program files (x86)\MAGIX
2014-08-23 09:28 . 2014-08-23 10:26 -------- d-----w- c:\programdata\MAGIX
2014-08-23 09:28 . 2014-08-23 09:29 -------- d-----w- c:\program files (x86)\Common Files\MAGIX Services
2014-08-23 09:28 . 2014-08-23 09:28 -------- d-----w- c:\program files (x86)\MSXML 4.0
2014-08-19 20:15 . 2014-08-19 20:15 16122344 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2014-08-19 20:15 . 2014-08-19 20:15 846832 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2014-08-19 20:15 . 2014-08-19 20:15 13922752 ----a-w- c:\windows\system32\nvopencl.dll
2014-08-19 20:15 . 2014-08-19 20:15 11283344 ----a-w- c:\windows\SysWow64\nvopencl.dll
2014-08-19 20:15 . 2014-08-19 20:15 31512520 ----a-w- c:\windows\system32\nvoglv64.dll
2014-08-19 20:15 . 2014-08-19 20:15 24196896 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2014-08-19 20:13 . 2014-08-19 20:13 2814656 ----a-w- c:\windows\SysWow64\nvapi.dll
2014-08-17 14:56 . 2014-09-16 08:11 -------- d-----w- c:\users\Lumey\AppData\Local\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-10 12:52 . 2012-12-19 18:41 101694776 ----a-w- c:\windows\system32\MRT.exe
2014-09-09 19:10 . 2012-12-20 17:57 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-09 19:10 . 2012-12-20 17:57 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-08-19 20:15 . 2012-12-19 18:09 75040 ----a-w- c:\windows\system32\OpenCL.dll
2014-08-19 20:15 . 2012-12-19 18:09 61912 ----a-w- c:\windows\SysWow64\OpenCL.dll
2014-08-19 20:15 . 2013-02-25 22:32 18626304 ----a-w- c:\windows\system32\nvwgf2umx.dll
2014-08-19 20:15 . 2013-02-25 22:32 965312 ----a-w- c:\windows\system32\nvumdshimx.dll
2014-08-19 20:14 . 2013-02-25 22:32 17555104 ----a-w- c:\windows\system32\nvd3dumx.dll
2014-08-19 20:14 . 2013-02-25 22:32 3196816 ----a-w- c:\windows\system32\nvapi64.dll
2014-08-11 16:39 . 2014-08-11 16:39 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-16 03:23 . 2014-08-14 18:11 2048 ----a-w- c:\windows\system32\tzres.dll
2014-07-16 02:46 . 2014-08-14 18:11 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-07-14 02:02 . 2014-08-14 18:08 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
2014-07-14 01:40 . 2014-08-14 18:08 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2014-07-09 02:03 . 2014-08-14 18:11 7168 ----a-w- c:\windows\system32\KBDYAK.DLL
2014-07-09 02:03 . 2014-08-14 18:11 7168 ----a-w- c:\windows\system32\KBDTAT.DLL
2014-07-09 02:03 . 2014-08-14 18:11 7168 ----a-w- c:\windows\system32\KBDRU1.DLL
2014-07-09 02:03 . 2014-08-14 18:11 6656 ----a-w- c:\windows\system32\KBDRU.DLL
2014-07-09 02:03 . 2014-08-14 18:11 7168 ----a-w- c:\windows\system32\KBDBASH.DLL
2014-07-09 01:31 . 2014-08-14 18:11 7168 ----a-w- c:\windows\SysWow64\KBDYAK.DLL
2014-07-09 01:31 . 2014-08-14 18:11 6656 ----a-w- c:\windows\SysWow64\KBDBASH.DLL
2014-07-02 18:55 . 2012-12-19 18:09 6783776 ----a-w- c:\windows\system32\nvcpl.dll
2014-07-02 18:55 . 2012-12-19 18:09 3522392 ----a-w- c:\windows\system32\nvsvc64.dll
2014-07-02 18:55 . 2012-12-19 18:09 935368 ----a-w- c:\windows\system32\nvvsvc.exe
2014-07-02 18:55 . 2012-12-19 18:09 62808 ----a-w- c:\windows\system32\nvshext.dll
2014-07-02 18:55 . 2012-12-19 18:09 386520 ----a-w- c:\windows\system32\nvmctray.dll
2014-07-02 18:55 . 2012-12-19 18:09 2559960 ----a-w- c:\windows\system32\nvsvcr.dll
2014-07-02 10:14 . 2012-12-19 18:09 3826628 ----a-w- c:\windows\system32\nvcoproc.bin
2014-06-30 22:24 . 2014-08-14 18:52 8856 ----a-w- c:\windows\system32\icardres.dll
2014-06-30 22:14 . 2014-08-14 18:52 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2014-06-25 02:05 . 2014-08-14 18:11 14175744 ----a-w- c:\windows\system32\shell32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Amazon Music"="c:\users\Lumey\AppData\Local\Amazon Music\Amazon Music Helper.exe" [2014-07-22 3356480]
"HP Officejet Pro 8600 (NET)"="c:\program files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
"InetStat"="c:\users\Lumey\AppData\Roaming\InetStat\inetstat.exe" [2014-08-07 706544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-07-22 162856]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2013-05-30 96056]
.
c:\users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Samsung SSD Magician.lnk - c:\program files (x86)\Samsung SSD Magician\Samsung SSD Magician.exe /AUTOHIDE [2012-12-19 2056192]
Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Officejet Pro 8600\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN34RB3HMV05KD;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8187.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys;c:\windows\SYSNATIVE\DRIVERS\FLxHCIc.sys [x]
S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys;c:\windows\SYSNATIVE\DRIVERS\FLxHCIh.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-20 19:10]
.
2014-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-09-14 11:05]
.
2014-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-09-14 11:05]
.
2014-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001Core.job
- c:\users\Lumey\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-19 18:46]
.
2014-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001UA.job
- c:\users\Lumey\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-19 18:46]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-08-08 08:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VX1000"="c:\windows\vVX1000.exe" [2010-05-20 762736]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-08-19 1796056]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.zanox.com/de/ | hxxp://www.affili.net/de/Startseite.aspx | hxxp://www.baseline.de/admin/login.html | hxxp://www.belboon.com/de/
FF - user.js: extensions.blocklist.enabled - false
FF - user.js: app.update.auto - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-09-16 12:49:09
ComboFix-quarantined-files.txt 2014-09-16 10:49
.
Vor Suchlauf: 12 Verzeichnis(se), 140.017.278.976 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 143.559.712.768 Bytes frei
.
- - End Of File - - 4E29CDF2F002A067D9D9E96206309F34
A36C5E4F47E84449FF07ED3517B43A31
|
|
17.09.2014, 05:43
| #4 |
| /// the machine /// TB-Ausbilder | Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.09.2014, 19:08
| #5 |
| | Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. Malewarebytes log: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 21.09.2014 Scan Time: 19:17:53 Logfile: mbam.txt Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.09.21.06 Rootkit Database: v2014.09.19.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Lumey Scan Type: Threat Scan Result: Completed Objects Scanned: 362671 Time Elapsed: 5 min, 11 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.310 - Bericht erstellt am 21/09/2014 um 19:41:16
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Lumey - SUPERSPEED
# Gestartet von : C:\Users\Lumey\Desktop\AdwCleaner_3.310.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat
Ordner Gelöscht : C:\Users\Lumey\AppData\Roaming\InetStat
Ordner Gelöscht : C:\Users\Lumey\AppData\Roaming\Security System 2
Ordner Gelöscht : C:\Users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
Datei Gelöscht : C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\inetstat.exe
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [InetStat]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\InetStat
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17280
-\\ Mozilla Firefox v32.0.2 (x86 de)
[ Datei : C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.contact@unique.protegere.org.install-event-fired", true);
-\\ Google Chrome v
[ Datei : C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [2099 octets] - [21/09/2014 19:29:16]
AdwCleaner[R1].txt - [2159 octets] - [21/09/2014 19:39:35]
AdwCleaner[S0].txt - [1983 octets] - [21/09/2014 19:41:16]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2043 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.9 (09.20.2014:1)
OS: Windows 7 Ultimate x64
Ran by Lumey on 21.09.2014 at 19:45:50,77
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Emptied folder: C:\Users\Lumey\AppData\Roaming\mozilla\firefox\profiles\02a9stml.default\minidumps [99 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.09.2014 at 19:58:46,79
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Lumey (administrator) on SUPERSPEED on 21-09-2014 19:59:37
Running from C:\Users\Lumey\Desktop
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Microsoft Corporation) C:\Windows\vVX1000.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
() C:\Users\Lumey\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [VX1000] => C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [Amazon Music] => C:\Users\Lumey\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] ()
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
Startup: C:\Users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung SSD Magician.lnk
ShortcutTarget: Samsung SSD Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung SSD Magician.exe (Samsung Electronics.)
Startup: C:\Users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default
FF Homepage: hxxp://www.zanox.com/de/ | hxxp://www.affili.net/de/Startseite.aspx | hxxp://www.baseline.de/admin/login.html | hxxp://www.belboon.com/de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\youtubeunblocker@unblocker.yt [2014-09-16]
FF Extension: Autofill Forms - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\autofillForms@blueimp.net.xpi [2013-01-20]
FF Extension: YSlow - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\yslow@yahoo-inc.com.xpi [2013-06-18]
FF Extension: {218a9a75-7903-4a92-9365-f3afb1e33538} - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{218a9a75-7903-4a92-9365-f3afb1e33538}.xpi [2013-10-31]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2012-12-20]
FF Extension: QuickTime Manager Pro - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{69bae1d9-901c-435e-9c3a-2147b37f64d8}.xpi [2013-11-06]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR HomePage: Default ->
CHR Profile: C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (RoboForm Lite Password Manager) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\kidhjpmgjfbkmcfpfakmdddddgfbhahj [2013-01-20]
CHR Extension: (Google Wallet) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Lumey\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-09-14]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-23] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [77040 2012-11-02] (Fresco Logic)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-21 19:59 - 2014-09-21 19:59 - 00013843 _____ () C:\Users\Lumey\Desktop\FRST.txt
2014-09-21 19:58 - 2014-09-21 19:58 - 00000957 _____ () C:\Users\Lumey\Desktop\JRT.txt
2014-09-21 19:45 - 2014-09-21 19:45 - 00000000 ____D () C:\Windows\ERUNT
2014-09-21 19:44 - 2014-09-21 19:44 - 00261960 _____ () C:\ProgramData\1411321407.bdinstall.bin
2014-09-21 19:43 - 2014-09-21 19:43 - 00002123 _____ () C:\Users\Lumey\Desktop\AdwCleaner[S0].txt
2014-09-21 19:29 - 2014-09-21 19:41 - 00000000 ____D () C:\AdwCleaner
2014-09-21 19:28 - 2014-09-21 19:28 - 01373475 _____ () C:\Users\Lumey\Desktop\AdwCleaner_3.310.exe
2014-09-21 19:27 - 2014-09-21 19:27 - 00001054 _____ () C:\Users\Lumey\Desktop\mbam.txt
2014-09-21 19:16 - 2014-09-21 19:45 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-21 19:16 - 2014-09-21 19:16 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-21 19:16 - 2014-09-21 19:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-21 19:16 - 2014-09-21 19:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-21 19:16 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-21 19:16 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-21 19:16 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-21 19:15 - 2014-09-21 19:15 - 01027006 _____ (Thisisu) C:\Users\Lumey\Desktop\JRT.exe
2014-09-21 19:14 - 2014-09-21 19:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lumey\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-20 22:03 - 2014-09-21 19:16 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\Thunderbird
2014-09-19 09:52 - 2014-09-19 09:52 - 02785546 _____ () C:\Users\Lumey\Desktop\bookmarks-2014-09-19.json
2014-09-19 09:52 - 2014-09-19 09:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-16 13:12 - 2014-09-16 13:12 - 00074512 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll
2014-09-16 12:49 - 2014-09-16 12:49 - 00019734 _____ () C:\ComboFix.txt
2014-09-16 12:34 - 2014-09-16 12:49 - 00000000 ____D () C:\Qoobox
2014-09-16 12:34 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-16 12:34 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-16 12:34 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-16 12:34 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-16 12:34 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-16 12:34 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-16 12:34 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-16 12:34 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-16 12:33 - 2014-09-16 12:46 - 00000000 ____D () C:\Windows\erdnt
2014-09-16 12:31 - 2014-09-16 12:31 - 00000000 ____D () C:\Program Files\Bitdefender
2014-09-16 11:39 - 2014-09-16 11:40 - 05579386 ____R (Swearware) C:\Users\Lumey\Desktop\ComboFix.exe
2014-09-16 11:34 - 2014-09-16 11:34 - 00000000 ____D () C:\Users\Lumey\Desktop\Homestaging
2014-09-16 10:35 - 2014-09-16 10:35 - 00292200 _____ () C:\Windows\Minidump\091614-26098-01.dmp
2014-09-16 10:33 - 2013-11-04 15:47 - 00074512 _____ (BitDefender SRL) C:\Windows\SysWOW64\bdsandboxuiskin32.dll
2014-09-16 10:32 - 2013-11-04 15:47 - 00084848 _____ (BitDefender SRL) C:\Windows\system32\BDSandBoxUISkin.dll
2014-09-16 10:32 - 2013-11-04 15:46 - 00034384 _____ (BitDefender SRL) C:\Windows\system32\BDSandBoxUH.dll
2014-09-16 10:18 - 2014-09-16 10:18 - 07040424 _____ () C:\Users\Lumey\Downloads\bitdefender_isecurity_2015.exe
2014-09-16 10:07 - 2014-09-21 19:59 - 00000000 ____D () C:\FRST
2014-09-16 10:06 - 2014-09-16 10:06 - 02105856 _____ (Farbar) C:\Users\Lumey\Desktop\FRST64.exe
2014-09-16 10:04 - 2014-09-16 10:04 - 00000000 _____ () C:\Users\Lumey\defogger_reenable
2014-09-15 10:35 - 2014-09-21 19:59 - 00000000 ____D () C:\Users\Lumey\Desktop\Virus entfernen
2014-09-15 08:40 - 2014-09-15 08:40 - 00000000 ____D () C:\Users\Lumey\Documents\Befund
2014-09-14 13:07 - 2014-09-16 09:53 - 00000000 ___RD () C:\Users\Lumey\Google Drive
2014-09-14 13:07 - 2014-09-14 13:07 - 00001715 _____ () C:\Users\Lumey\Desktop\Google Drive.lnk
2014-09-14 13:05 - 2014-09-21 19:45 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-14 13:05 - 2014-09-21 19:10 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-14 13:05 - 2014-09-14 13:05 - 00895120 _____ (Google Inc.) C:\Users\Lumey\Downloads\googledrivesync.exe
2014-09-14 13:05 - 2014-09-14 13:05 - 00003892 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-09-14 13:05 - 2014-09-14 13:05 - 00003640 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-09-14 13:05 - 2014-09-14 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-09-14 13:05 - 2014-09-14 13:05 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-13 10:20 - 2014-09-13 10:20 - 02772915 _____ () C:\Users\Lumey\Desktop\bookmarks-2014-09-13.json
2014-09-12 20:43 - 2014-09-12 20:45 - 00071550 _____ () C:\Users\Lumey\Desktop\Hausverwaltungen Berlin Brandenburg.xlsx
2014-09-11 09:09 - 2014-09-11 09:09 - 00000073 _____ () C:\Users\Lumey\Desktop\Disavow WK.txt
2014-09-10 14:58 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-10 14:58 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-10 14:58 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-10 14:58 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-10 14:58 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 14:58 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-10 14:58 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-10 14:58 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-10 14:58 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-10 14:58 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-10 14:58 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-10 14:58 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-10 14:58 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-10 14:58 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-10 14:58 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-10 14:58 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-10 14:58 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-10 14:58 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-10 14:58 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-10 14:58 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-10 14:58 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 14:58 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-10 14:58 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-10 14:58 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 14:58 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-10 14:58 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-10 14:58 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-10 14:58 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-10 14:58 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-10 14:58 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-10 14:58 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-10 14:58 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-10 14:58 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-10 14:58 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-10 14:58 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-10 14:58 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-10 14:58 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-10 14:58 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-10 14:58 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-10 14:58 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-10 14:58 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-10 14:58 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-10 14:58 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-10 14:58 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-10 14:58 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-10 14:58 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-10 14:58 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-10 14:58 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-10 14:58 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-10 14:58 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-10 14:58 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-10 14:58 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-10 14:58 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-10 14:58 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-10 14:58 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-10 14:58 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-10 14:51 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 14:51 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-10 14:41 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-09-10 14:41 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-09-10 13:57 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-10 13:57 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-10 13:57 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-10 13:57 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-10 13:57 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-10 13:57 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-10 13:57 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-10 13:57 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-10 13:57 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-10 13:57 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-10 13:57 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-10 13:57 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-09-10 13:57 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-09-10 13:41 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-09-10 13:41 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-09-10 13:41 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-09-10 13:41 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-09-10 13:41 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-09-10 13:41 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-09-10 13:41 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-09-10 13:41 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-09-10 13:41 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-09-10 13:41 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-09-10 13:41 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-09-10 13:41 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-09-10 13:41 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-09-10 13:41 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-09-10 13:41 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-09-10 13:41 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-09-10 13:40 - 2014-09-10 13:40 - 00000000 ____D () C:\Users\Lumey\AppData\Local\NVIDIA
2014-09-10 13:40 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-09-10 13:40 - 2012-08-23 16:12 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\terminpt.sys
2014-09-10 13:40 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-09-10 13:40 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2014-09-10 13:40 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-09-10 13:40 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-09-10 13:38 - 2014-07-02 19:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-09-10 13:32 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-10 13:32 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-10 13:30 - 2014-09-10 13:30 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-10 13:30 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-09-10 13:30 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-09-09 17:42 - 2014-09-16 11:51 - 00000000 ____D () C:\Users\Lumey\Desktop\AGB Partnerprogramm
2014-09-08 21:03 - 2014-09-16 10:35 - 551857696 _____ () C:\Windows\MEMORY.DMP
2014-09-08 21:03 - 2014-09-16 10:35 - 00000000 ____D () C:\Windows\Minidump
2014-09-08 21:03 - 2014-09-08 21:03 - 00295224 _____ () C:\Windows\Minidump\090814-14554-01.dmp
2014-09-07 10:27 - 2014-09-07 10:27 - 00000000 ____D () C:\Windows\Hewlett-Packard
2014-08-28 17:02 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 17:02 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 17:02 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-24 23:47 - 2014-08-24 23:47 - 00262546 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-08-24 21:39 - 2014-08-24 21:39 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - 527f303c31834cdd9517ffb0ce0818a1bc84fb9b6bcb4e22a417a56da853e660
2014-08-23 11:52 - 2014-08-23 12:26 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\MAGIX
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\Documents\MAGIX_MusicEditor
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Xara
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Magix
2014-08-23 11:51 - 2014-08-23 11:51 - 00000000 ____D () C:\Users\Public\Documents\MAGIX
2014-08-23 11:51 - 2014-08-23 11:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2014-08-23 11:29 - 2014-08-23 12:26 - 00000000 ___RD () C:\Users\Lumey\Documents\MAGIX
2014-08-23 11:29 - 2014-08-23 11:40 - 00000000 ____D () C:\Program Files (x86)\MAGIX
2014-08-23 11:28 - 2014-08-23 12:26 - 00000000 ____D () C:\ProgramData\MAGIX
2014-08-23 11:28 - 2014-08-23 11:28 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-21 19:59 - 2014-09-21 19:59 - 00013843 _____ () C:\Users\Lumey\Desktop\FRST.txt
2014-09-21 19:59 - 2014-09-16 10:07 - 00000000 ____D () C:\FRST
2014-09-21 19:59 - 2014-09-15 10:35 - 00000000 ____D () C:\Users\Lumey\Desktop\Virus entfernen
2014-09-21 19:58 - 2014-09-21 19:58 - 00000957 _____ () C:\Users\Lumey\Desktop\JRT.txt
2014-09-21 19:54 - 2012-12-19 20:46 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001UA.job
2014-09-21 19:52 - 2009-07-14 06:45 - 00031616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-21 19:52 - 2009-07-14 06:45 - 00031616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-21 19:50 - 2012-12-20 04:54 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-09-21 19:50 - 2012-12-20 04:54 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-09-21 19:50 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-21 19:45 - 2014-09-21 19:45 - 00000000 ____D () C:\Windows\ERUNT
2014-09-21 19:45 - 2014-09-21 19:16 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-21 19:45 - 2014-09-16 12:31 - 00000000 ____D () C:\Program Files\Bitdefender
2014-09-21 19:45 - 2014-09-14 13:05 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-21 19:45 - 2012-12-19 20:09 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-21 19:45 - 2010-11-21 05:47 - 03782208 _____ () C:\Windows\PFRO.log
2014-09-21 19:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-21 19:45 - 2009-07-14 06:51 - 00083067 _____ () C:\Windows\setupact.log
2014-09-21 19:44 - 2014-09-21 19:44 - 00261960 _____ () C:\ProgramData\1411321407.bdinstall.bin
2014-09-21 19:44 - 2012-12-19 20:07 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2014-09-21 19:43 - 2014-09-21 19:43 - 00002123 _____ () C:\Users\Lumey\Desktop\AdwCleaner[S0].txt
2014-09-21 19:41 - 2014-09-21 19:29 - 00000000 ____D () C:\AdwCleaner
2014-09-21 19:41 - 2012-12-19 20:03 - 01258075 _____ () C:\Windows\WindowsUpdate.log
2014-09-21 19:28 - 2014-09-21 19:28 - 01373475 _____ () C:\Users\Lumey\Desktop\AdwCleaner_3.310.exe
2014-09-21 19:27 - 2014-09-21 19:27 - 00001054 _____ () C:\Users\Lumey\Desktop\mbam.txt
2014-09-21 19:16 - 2014-09-21 19:16 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-21 19:16 - 2014-09-21 19:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-21 19:16 - 2014-09-21 19:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-21 19:16 - 2014-09-20 22:03 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\Thunderbird
2014-09-21 19:15 - 2014-09-21 19:15 - 01027006 _____ (Thisisu) C:\Users\Lumey\Desktop\JRT.exe
2014-09-21 19:14 - 2014-09-21 19:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lumey\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-21 19:10 - 2014-09-14 13:05 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-21 19:10 - 2013-07-23 07:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-21 11:08 - 2013-12-04 21:46 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\HpUpdate
2014-09-21 10:54 - 2012-12-19 20:46 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001Core.job
2014-09-21 10:27 - 2014-08-17 16:56 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Adobe
2014-09-20 19:15 - 2012-12-20 21:04 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\FileZilla
2014-09-20 19:09 - 2013-11-29 22:29 - 00000000 ____D () C:\Zithali
2014-09-19 16:56 - 2013-01-12 16:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-19 14:24 - 2013-01-15 20:53 - 00001456 _____ () C:\Users\Lumey\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-09-19 09:52 - 2014-09-19 09:52 - 02785546 _____ () C:\Users\Lumey\Desktop\bookmarks-2014-09-19.json
2014-09-19 09:52 - 2014-09-19 09:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-16 13:12 - 2014-09-16 13:12 - 00074512 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll
2014-09-16 12:49 - 2014-09-16 12:49 - 00019734 _____ () C:\ComboFix.txt
2014-09-16 12:49 - 2014-09-16 12:34 - 00000000 ____D () C:\Qoobox
2014-09-16 12:46 - 2014-09-16 12:33 - 00000000 ____D () C:\Windows\erdnt
2014-09-16 12:42 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-16 11:51 - 2014-09-09 17:42 - 00000000 ____D () C:\Users\Lumey\Desktop\AGB Partnerprogramm
2014-09-16 11:40 - 2014-09-16 11:39 - 05579386 ____R (Swearware) C:\Users\Lumey\Desktop\ComboFix.exe
2014-09-16 11:34 - 2014-09-16 11:34 - 00000000 ____D () C:\Users\Lumey\Desktop\Homestaging
2014-09-16 11:33 - 2014-04-08 09:33 - 00000000 ____D () C:\Users\Lumey\Documents\Vattenfall
2014-09-16 10:35 - 2014-09-16 10:35 - 00292200 _____ () C:\Windows\Minidump\091614-26098-01.dmp
2014-09-16 10:35 - 2014-09-08 21:03 - 551857696 _____ () C:\Windows\MEMORY.DMP
2014-09-16 10:35 - 2014-09-08 21:03 - 00000000 ____D () C:\Windows\Minidump
2014-09-16 10:18 - 2014-09-16 10:18 - 07040424 _____ () C:\Users\Lumey\Downloads\bitdefender_isecurity_2015.exe
2014-09-16 10:07 - 2013-01-22 20:02 - 00000401 _____ () C:\Windows\system32\checkdnsid.xml
2014-09-16 10:06 - 2014-09-16 10:06 - 02105856 _____ (Farbar) C:\Users\Lumey\Desktop\FRST64.exe
2014-09-16 10:04 - 2014-09-16 10:04 - 00000000 _____ () C:\Users\Lumey\defogger_reenable
2014-09-16 10:04 - 2012-12-19 20:03 - 00000000 ____D () C:\Users\Lumey
2014-09-16 09:53 - 2014-09-14 13:07 - 00000000 ___RD () C:\Users\Lumey\Google Drive
2014-09-15 08:40 - 2014-09-15 08:40 - 00000000 ____D () C:\Users\Lumey\Documents\Befund
2014-09-15 08:40 - 2014-04-21 09:42 - 00000000 ____D () C:\Users\Lumey\Documents\Anastasia
2014-09-14 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-14 13:07 - 2014-09-14 13:07 - 00001715 _____ () C:\Users\Lumey\Desktop\Google Drive.lnk
2014-09-14 13:05 - 2014-09-14 13:05 - 00895120 _____ (Google Inc.) C:\Users\Lumey\Downloads\googledrivesync.exe
2014-09-14 13:05 - 2014-09-14 13:05 - 00003892 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-09-14 13:05 - 2014-09-14 13:05 - 00003640 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-09-14 13:05 - 2014-09-14 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-09-14 13:05 - 2014-09-14 13:05 - 00000000 ____D () C:\Program Files (x86)\Google
2014-09-14 13:05 - 2012-12-19 20:46 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Google
2014-09-13 10:20 - 2014-09-13 10:20 - 02772915 _____ () C:\Users\Lumey\Desktop\bookmarks-2014-09-13.json
2014-09-12 20:45 - 2014-09-12 20:43 - 00071550 _____ () C:\Users\Lumey\Desktop\Hausverwaltungen Berlin Brandenburg.xlsx
2014-09-11 09:09 - 2014-09-11 09:09 - 00000073 _____ () C:\Users\Lumey\Desktop\Disavow WK.txt
2014-09-10 15:33 - 2009-07-14 07:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-09-10 14:58 - 2012-12-19 21:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-10 14:57 - 2013-12-22 19:50 - 01594028 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-10 14:56 - 2013-07-25 10:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-10 14:52 - 2012-12-19 20:41 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 14:51 - 2014-05-06 17:32 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-10 14:29 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-09-10 14:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-09-10 13:40 - 2014-09-10 13:40 - 00000000 ____D () C:\Users\Lumey\AppData\Local\NVIDIA
2014-09-10 13:40 - 2012-12-19 20:08 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-09-10 13:40 - 2012-12-19 20:08 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-09-10 13:39 - 2012-12-19 20:08 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-09-10 13:35 - 2014-09-10 13:35 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-09-10 13:30 - 2014-09-10 13:30 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-09 23:09 - 2014-04-05 12:02 - 00000988 _____ () C:\Users\Lumey\Desktop\LS Wood Workflow.lnk
2014-09-09 23:09 - 2013-05-18 19:24 - 00000884 _____ () C:\Users\Lumey\Desktop\Zugang.lnk
2014-09-09 23:08 - 2014-04-05 12:07 - 00001114 _____ () C:\Users\Lumey\Desktop\M U&R Workflow.lnk
2014-09-09 23:08 - 2014-04-05 12:01 - 00001318 _____ () C:\Users\Lumey\Desktop\baseline Workflow.lnk
2014-09-09 23:08 - 2014-04-05 12:00 - 00001072 _____ () C:\Users\Lumey\Desktop\AFC Workflow.lnk
2014-09-09 23:08 - 2014-04-05 11:58 - 00001072 _____ () C:\Users\Lumey\Desktop\DCI Workflow.lnk
2014-09-09 23:08 - 2014-04-05 11:55 - 00001079 _____ () C:\Users\Lumey\Desktop\WK Workflow.lnk
2014-09-09 23:08 - 2013-10-27 18:09 - 00001372 _____ () C:\Users\Lumey\Desktop\M U&R Belege.lnk
2014-09-09 23:08 - 2013-10-27 18:07 - 00001333 _____ () C:\Users\Lumey\Desktop\WK Belege.lnk
2014-09-09 23:08 - 2013-10-27 18:06 - 00001330 _____ () C:\Users\Lumey\Desktop\AFC Belege.lnk
2014-09-09 23:07 - 2014-04-05 11:56 - 00001330 _____ () C:\Users\Lumey\Desktop\DCI Belege.lnk
2014-09-09 21:10 - 2013-07-23 07:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-09 21:10 - 2012-12-20 19:57 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-09 21:10 - 2012-12-20 19:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-08 21:03 - 2014-09-08 21:03 - 00295224 _____ () C:\Windows\Minidump\090814-14554-01.dmp
2014-09-08 07:24 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-07 10:27 - 2014-09-07 10:27 - 00000000 ____D () C:\Windows\Hewlett-Packard
2014-09-07 10:27 - 2014-07-08 18:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-09-05 18:09 - 2013-01-15 19:48 - 00000132 _____ () C:\Users\Lumey\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen
2014-09-05 04:10 - 2014-09-10 13:57 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-10 13:57 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-28 20:23 - 2009-07-14 06:45 - 05132456 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-24 23:47 - 2014-08-24 23:47 - 00262546 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-08-24 21:39 - 2014-08-24 21:39 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - 527f303c31834cdd9517ffb0ce0818a1bc84fb9b6bcb4e22a417a56da853e660
2014-08-24 14:34 - 2012-12-19 20:46 - 00153000 _____ () C:\Users\Lumey\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 12:26 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\MAGIX
2014-08-23 12:26 - 2014-08-23 11:29 - 00000000 ___RD () C:\Users\Lumey\Documents\MAGIX
2014-08-23 12:26 - 2014-08-23 11:28 - 00000000 ____D () C:\ProgramData\MAGIX
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\Documents\MAGIX_MusicEditor
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Xara
2014-08-23 11:52 - 2014-08-23 11:52 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Magix
2014-08-23 11:51 - 2014-08-23 11:51 - 00000000 ____D () C:\Users\Public\Documents\MAGIX
2014-08-23 11:51 - 2014-08-23 11:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2014-08-23 11:40 - 2014-08-23 11:29 - 00000000 ____D () C:\Program Files (x86)\MAGIX
2014-08-23 11:28 - 2014-08-23 11:28 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-08-23 04:07 - 2014-08-28 17:02 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 17:02 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 17:02 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
Some content of TEMP:
====================
C:\Users\Lumey\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-18 14:50
==================== End Of Log ============================
--- --- --- |
|
22.09.2014, 09:40
| #6 |
| /// the machine /// TB-Ausbilder | Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw.ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. |
|
27.10.2014, 00:52
| #7 |
| | Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. Heute aus dem Urlaub zurück, daher die lange Antwortzeit. Danke für die Hilfe, die Audiowerbung ist weg. Was mir noch aufgefallen ist: mein Firefox Browser zeigt mir komische Suchergebnisse bei Google, wenn ich es mit Chrome vergleiche. Immer 1-2 Links offensichtliche Werbung (Themenfremd aber mir dem eingegebenem Key im Titel) in den organischen Suchergebnissen (nicht die gekennzeichnete Googlewerbung). Eventuell ist der Browser auch beeinträchtigt? Hier die logs: ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=98b676d843026b42b647706c798cea3a
# engine=20786
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-10-26 11:23:15
# local_time=2014-10-27 12:23:15 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 40750171 165995645 0 0
# scanned=771166
# found=61
# cleaned=0
# scan_time=14642
sh=502D74A96065A471FAA12E30E85E8DCBAFA3A447 ft=1 fh=aa0497a2b71c6df7 vn="Variante von Win32/RiskWare.Astori.B Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Lumey\AppData\Roaming\InetStat\inetstat.exe.vir"
sh=1AC26CB8FDF81414EB4B18F4E03D03526CBFDDE2 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Lumey\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\4ad27955-7c774ed9"
sh=7D3889ECF1BE9CB4B015609108BD1B56C29A54A0 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Lumey\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\baec76-773d845e"
sh=43308A5150365DF47314DBE1BF2201D94D31F27F ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-09 221802\Backup Files 2014-09-09 221802\Backup files 14.zip"
sh=CDC66459C31B3295326604E9D1D4537275F716FD ft=0 fh=0000000000000000 vn="Variante von Generik.DGMLMAM Trojaner" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-09 221802\Backup Files 2014-09-09 221802\Backup files 302.zip"
sh=234F4469A14B1A4F7D1C215FC314B1213257DF13 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-09 221802\Backup Files 2014-09-09 221802\Backup files 33.zip"
sh=92AFE623F1E1880453226DB359FDA85B5F39B19C ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-09 221802\Backup Files 2014-09-09 221802\Backup files 34.zip"
sh=BB4D8633527666F586C660DB31BB317103D12599 ft=0 fh=0000000000000000 vn="Variante von Win32/RiskWare.Astori.B Anwendung" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-09 221802\Backup Files 2014-09-09 221802\Backup files 6.zip"
sh=87B0625A66DF64FDDB9AF06829A1CCC62AA67ACE ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-11 084232\Backup Files 2014-09-11 084232\Backup files 14.zip"
sh=86A15D9D40295E38DF647AA76ED433F41472D6FC ft=0 fh=0000000000000000 vn="Variante von Win32/RiskWare.Astori.B Anwendung" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-11 084232\Backup Files 2014-09-11 084232\Backup files 6.zip"
sh=A3BECC0C1B0F55A6FDDAC2AB3DE02E7C1166AB0C ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-21 100655\Backup Files 2014-09-21 100655\Backup files 14.zip"
sh=828C2AD3CD210E496CB97A52F4F16624ED7751F6 ft=0 fh=0000000000000000 vn="Variante von Win32/RiskWare.Astori.B Anwendung" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-21 100655\Backup Files 2014-09-21 100655\Backup files 6.zip"
sh=5732073208C1F49F7F78B810005341BABBC91770 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="F:\SUPERSPEED\Backup Set 2014-09-21 100655\Backup Files 2014-10-17 234352\Backup files 1.zip"
sh=DB401069B207EFD79BD83C51E9E3F175B9835A1E ft=0 fh=0000000000000000 vn="Variante von Generik.DGMLMAM Trojaner" ac=I fn="G:\Eigene Unternehmen\Malediven Urlaub & Reisen\Workflow\Manuelle Dateneingabe\Diverses\Zitahli\ca.zip"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Sport\weight_lifting_pics_spe008\footer.php"
sh=8E047573692E04A9AB36AE805F938464C04D34F1 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Sport\weight_lifting_pics_spe008\functions.php"
sh=D88ECAFD0FBA8F51D11208747A298DA20F25CE0F ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Sport\fitness-center-20\footer.php"
sh=C965EDDF1EA9DA0AD804E268275CBBE4A41F141F ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Sport\fitness-center-20\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\world_of_business_bue028\footer.php"
sh=847B671788D82B2684450A876438CE806EF60F69 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\world_of_business_bue028\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\plenty_of_money_bags_bue031\footer.php"
sh=8CCC684F08879C61D898F3EF05AE9B21E83CC12D ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\plenty_of_money_bags_bue031\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\money_green_bue013\footer.php"
sh=1C19BACC5F4DB5D52165FB290A2BBD5206B6D19B ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\money_green_bue013\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\flows_of_cash_bue012\footer.php"
sh=A9827ECFD69F2CB3DAAFC6D2A9099090C1C8AFEB ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\flows_of_cash_bue012\functions.php"
sh=E4BBAEE9CECEA1CBA1D1CAF79B8DFB7CB6C4AE79 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\chess_theme\footer.php"
sh=4AB5F2E55CA7E46A57355D25C19193AF3F24E9E0 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AirPush.G evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\Backup Phone\Anwendungen\IQTest2_2.03.apk"
sh=B2F84F40A3BC8D0ADA791EA001B02BD66A43DF05 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.AppLovin.A evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\Backup Phone\Anwendungen\Music Volume EQ_1.9.apk"
sh=FFE10FC605C8D5229C549E0DAC973623836134A8 ft=0 fh=0000000000000000 vn="Variante von Android/AdDisplay.Ganlet.A evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Privat\Laptop Backup\Backup Phone\Anwendungen\Sex Positions_1.1.apk"
sh=E4BBAEE9CECEA1CBA1D1CAF79B8DFB7CB6C4AE79 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\chess_theme\footer.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\flows_of_cash_bue012\footer.php"
sh=A9827ECFD69F2CB3DAAFC6D2A9099090C1C8AFEB ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\flows_of_cash_bue012\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\money_green_bue013\footer.php"
sh=1C19BACC5F4DB5D52165FB290A2BBD5206B6D19B ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\money_green_bue013\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\plenty_of_money_bags_bue031\footer.php"
sh=8CCC684F08879C61D898F3EF05AE9B21E83CC12D ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\plenty_of_money_bags_bue031\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\world_of_business_bue028\footer.php"
sh=847B671788D82B2684450A876438CE806EF60F69 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Allrounder\world_of_business_bue028\functions.php"
sh=D88ECAFD0FBA8F51D11208747A298DA20F25CE0F ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Sport\fitness-center-20\footer.php"
sh=C965EDDF1EA9DA0AD804E268275CBBE4A41F141F ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Sport\fitness-center-20\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Sport\weight_lifting_pics_spe008\footer.php"
sh=8E047573692E04A9AB36AE805F938464C04D34F1 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\A_Projekt_Backup\Programme\Wordpress\Wordpress Templates\Sport\weight_lifting_pics_spe008\functions.php"
sh=E4BBAEE9CECEA1CBA1D1CAF79B8DFB7CB6C4AE79 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Projekte\Affiliate Projekt\Wordpress\Wordpress Templates\chess_theme\footer.php"
sh=E4BBAEE9CECEA1CBA1D1CAF79B8DFB7CB6C4AE79 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\chess_theme\footer.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\flows_of_cash_bue012\footer.php"
sh=A9827ECFD69F2CB3DAAFC6D2A9099090C1C8AFEB ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\flows_of_cash_bue012\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\money_green_bue013\footer.php"
sh=1C19BACC5F4DB5D52165FB290A2BBD5206B6D19B ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\money_green_bue013\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\plenty_of_money_bags_bue031\footer.php"
sh=8CCC684F08879C61D898F3EF05AE9B21E83CC12D ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\mobile phones cash\plenty_of_money_bags_bue031\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\world_of_business_bue028\footer.php"
sh=847B671788D82B2684450A876438CE806EF60F69 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Allrounder\world_of_business_bue028\functions.php"
sh=D88ECAFD0FBA8F51D11208747A298DA20F25CE0F ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Sport\fitness-center-20\footer.php"
sh=C965EDDF1EA9DA0AD804E268275CBBE4A41F141F ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Sport\fitness-center-20\functions.php"
sh=EDD0EA0EF1B44C5B4DA064094ACC9E613F32EE16 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Sport\weight_lifting_pics_spe008\footer.php"
sh=8E047573692E04A9AB36AE805F938464C04D34F1 ft=0 fh=0000000000000000 vn="PHP/Obfuscated.F evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Business\old\Aktuelle Arbeit\Ältere Daten\Stick Backup\Programme\Wordpress\Wordpress Templates\Sport\weight_lifting_pics_spe008\functions.php"
sh=B22621B2E760AEB8EE8DC609D4BEB5476D4BDAA2 ft=1 fh=92f0fff0bbfcb40b vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Eigene Dateien\Downloads\Format_Factory260DE.exe"
sh=F1DAA8FD7A64B1E36EB25DAF1FCE5AE1E49AE867 ft=1 fh=f01866555881a4dd vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Eigene Dateien\Downloads\TVersitySetup_1_9_3.exe"
sh=3974F0BD2142FF6F225C978298F538743BD99199 ft=1 fh=822143d5e72a3121 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="P:\Backups\Business\D Backup\Eigene Dateien\Downloads\x-powerpoint-to-video-converter-free-de.exe"
sh=DB401069B207EFD79BD83C51E9E3F175B9835A1E ft=0 fh=0000000000000000 vn="Variante von Generik.DGMLMAM Trojaner" ac=I fn="P:\Backups\Business\Interne Festplatte\Eigene Unternehmen\Malediven Urlaub & Reisen\Workflow\Manuelle Dateneingabe\Diverses\Zitahli\ca.zip"
Code:
ATTFilter Results of screen317's Security Check version 0.99.89
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 71
Java version out of Date!
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Mozilla Firefox 32.0.3 Firefox out of Date!
Google Chrome 37.0.2062.124
Google Chrome 38.0.2125.104
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014 (ATTENTION: ====> FRST version is 45 days old and could be outdated)
Ran by Lumey (administrator) on SUPERSPEED on 27-10-2014 00:28:09
Running from C:\Users\Lumey\Desktop
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Windows\vVX1000.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
() C:\Users\Lumey\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [VX1000] => C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [Amazon Music] => C:\Users\Lumey\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] ()
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3438328156-4283695920-827838287-1001\...\Run: [Google Update] => C:\Users\Lumey\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-12-19] (Google Inc.)
Startup: C:\Users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung SSD Magician.lnk
ShortcutTarget: Samsung SSD Magician.lnk -> C:\Program Files (x86)\Samsung SSD Magician\Samsung SSD Magician.exe (Samsung Electronics.)
Startup: C:\Users\Lumey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default
FF Homepage: https://www.wunderlist.com/login | hxxp://www.zanox.com/de/ | hxxp://www.affili.net/de/Startseite.aspx | hxxp://www.baseline.de/admin/login.html
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Lumey\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\youtubeunblocker@unblocker.yt [2014-10-17]
FF Extension: Autofill Forms - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\autofillForms@blueimp.net.xpi [2013-01-20]
FF Extension: Add to Wunderlist for Firefox - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\jid1-3gu11JeYBiIuJA@jetpack.xpi [2014-10-04]
FF Extension: YSlow - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\yslow@yahoo-inc.com.xpi [2013-06-18]
FF Extension: {218a9a75-7903-4a92-9365-f3afb1e33538} - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{218a9a75-7903-4a92-9365-f3afb1e33538}.xpi [2013-10-31]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2012-12-20]
FF Extension: QuickTime Manager Pro - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\Extensions\{69bae1d9-901c-435e-9c3a-2147b37f64d8}.xpi [2013-11-06]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Lumey\AppData\Roaming\Mozilla\Firefox\Profiles\02a9stml.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR Profile: C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (RoboForm Lite Password Manager) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\kidhjpmgjfbkmcfpfakmdddddgfbhahj [2013-01-20]
CHR Extension: (Google Wallet) - C:\Users\Lumey\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Lumey\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-09-14]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-23] (MAGIX AG) [File not signed]
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [77040 2012-11-02] (Fresco Logic)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-27 00:28 - 2014-10-27 00:28 - 00014401 _____ () C:\Users\Lumey\Desktop\FRST.txt
2014-10-27 00:27 - 2014-10-27 00:27 - 00000873 _____ () C:\Users\Lumey\Desktop\Security Check checkup.txt
2014-10-26 20:16 - 2014-10-26 20:16 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-10-26 20:12 - 2014-10-26 20:12 - 00261094 _____ () C:\ProgramData\1414350634.bdinstall.bin
2014-10-26 20:09 - 2014-09-16 09:06 - 02105856 _____ (Farbar) C:\Users\Lumey\Desktop\FRST64.exe
2014-10-26 20:08 - 2014-10-26 20:08 - 00854448 _____ () C:\Users\Lumey\Desktop\SecurityCheck.exe
2014-10-26 20:06 - 2014-10-26 20:06 - 02347384 _____ (ESET) C:\Users\Lumey\Desktop\esetsmartinstaller_deu.exe
2014-10-26 16:31 - 2014-10-26 17:53 - 00004142 _____ () C:\Users\Lumey\Desktop\Avada Anleitung.txt
2014-10-26 16:29 - 2014-10-26 16:29 - 00000000 ____D () C:\Users\Lumey\Desktop\Neuer Ordner
2014-10-26 13:08 - 2014-10-26 13:08 - 00000132 _____ () C:\Users\Lumey\AppData\Roaming\Adobe CS6-AIFF-Format - Voreinstellungen
2014-10-25 17:01 - 2014-10-25 17:01 - 00000000 ____D () C:\Users\Lumey\Desktop\Post Affiliate Pro
2014-10-25 17:00 - 2014-10-25 17:00 - 14708930 _____ () C:\Users\Lumey\Downloads\download(1).zip
2014-10-25 16:57 - 2014-10-25 16:57 - 14708930 _____ () C:\Users\Lumey\Downloads\download.zip
2014-10-23 16:31 - 2014-10-25 11:45 - 00000000 ____D () C:\Users\Lumey\Desktop\DomiCore AVADA
2014-10-22 20:27 - 2014-10-22 20:27 - 00071540 _____ () C:\Users\Lumey\Desktop\Hausverwaltungen Berlin Brandenburg.xlsx
2014-10-22 19:33 - 2014-10-22 19:33 - 00043008 _____ () C:\Users\Lumey\Desktop\Linkquellen.xls
2014-10-21 11:53 - 2014-10-21 17:01 - 00000000 ____D () C:\Users\Lumey\Desktop\Backup
2014-10-21 09:51 - 2014-10-21 09:51 - 00107969 _____ () C:\Users\Lumey\Desktop\encyclopedia-pro-1-4-28.zip
2014-10-17 09:01 - 2014-10-17 09:01 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-10-17 09:01 - 2014-10-17 09:01 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-10-17 09:01 - 2014-10-17 09:01 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-10-17 09:01 - 2014-10-17 09:01 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-17 09:01 - 2014-10-17 09:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-17 09:01 - 2014-10-17 09:01 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-16 08:22 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 08:22 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 08:22 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 08:22 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 08:22 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 08:22 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 08:22 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 08:22 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 08:22 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 08:22 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 08:22 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 08:22 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 08:22 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 08:22 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 08:22 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 08:22 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 08:22 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 08:22 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 08:22 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 08:22 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 08:22 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 08:22 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 08:22 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 08:22 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 08:22 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 08:22 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 08:22 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 08:22 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 08:22 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 08:22 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 08:22 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 08:22 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 08:22 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 08:22 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 08:22 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 08:22 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 08:22 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 08:22 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 08:22 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 08:22 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 08:22 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 08:22 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 08:22 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 08:22 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 08:22 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 08:22 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 08:22 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 08:22 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 08:22 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 08:22 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 08:22 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 08:22 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 08:22 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 08:22 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 08:22 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 08:22 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 08:22 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 08:22 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 08:22 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 08:22 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 08:22 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 08:22 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 08:22 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 08:22 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 08:22 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 08:22 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 08:20 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 08:20 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 08:20 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 08:19 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 08:19 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-16 08:19 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 08:19 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 08:19 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 08:19 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 08:19 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 08:19 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 08:19 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 08:19 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 08:19 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 08:19 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 08:19 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 08:19 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 08:19 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 08:19 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 08:19 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-12 21:08 - 2014-10-12 21:08 - 00000000 ____D () C:\Users\Lumey\Documents\Verträge
2014-10-11 11:48 - 2014-10-11 11:48 - 00384127 _____ () C:\Users\Lumey\Downloads\Jpg.zip
2014-10-09 10:06 - 2014-10-09 10:06 - 00378896 _____ () C:\Users\Lumey\Desktop\responsive-lightbox.1.4.8.zip
2014-10-07 18:14 - 2014-10-22 14:55 - 00000000 ____D () C:\Users\Lumey\Desktop\Vergleichssoftware
2014-10-01 09:41 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 09:41 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-30 14:29 - 2014-09-30 14:44 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\vlc
2014-09-30 14:28 - 2014-09-30 14:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-09-30 14:28 - 2014-09-30 14:28 - 00000000 ____D () C:\Program Files\VideoLAN
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-27 00:28 - 2014-10-27 00:28 - 00014401 _____ () C:\Users\Lumey\Desktop\FRST.txt
2014-10-27 00:28 - 2014-09-16 09:07 - 00000000 ____D () C:\FRST
2014-10-27 00:27 - 2014-10-27 00:27 - 00000873 _____ () C:\Users\Lumey\Desktop\Security Check checkup.txt
2014-10-27 00:11 - 2014-09-14 12:05 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-27 00:10 - 2013-07-23 06:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-26 23:33 - 2012-12-19 19:46 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001UA.job
2014-10-26 20:38 - 2012-12-19 19:03 - 02028796 _____ () C:\Windows\WindowsUpdate.log
2014-10-26 20:20 - 2009-07-14 05:45 - 00031616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-26 20:20 - 2009-07-14 05:45 - 00031616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-26 20:17 - 2012-12-20 03:54 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-10-26 20:17 - 2012-12-20 03:54 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-10-26 20:17 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-26 20:16 - 2014-10-26 20:16 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-10-26 20:14 - 2014-09-14 12:05 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-26 20:13 - 2014-09-16 11:31 - 00000000 ____D () C:\Program Files\Bitdefender
2014-10-26 20:13 - 2012-12-19 19:09 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-26 20:13 - 2010-11-21 04:47 - 03785334 _____ () C:\Windows\PFRO.log
2014-10-26 20:13 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-26 20:13 - 2009-07-14 05:51 - 00091788 _____ () C:\Windows\setupact.log
2014-10-26 20:12 - 2014-10-26 20:12 - 00261094 _____ () C:\ProgramData\1414350634.bdinstall.bin
2014-10-26 20:11 - 2012-12-19 19:07 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2014-10-26 20:08 - 2014-10-26 20:08 - 00854448 _____ () C:\Users\Lumey\Desktop\SecurityCheck.exe
2014-10-26 20:06 - 2014-10-26 20:06 - 02347384 _____ (ESET) C:\Users\Lumey\Desktop\esetsmartinstaller_deu.exe
2014-10-26 19:19 - 2012-12-20 20:04 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\FileZilla
2014-10-26 17:53 - 2014-10-26 16:31 - 00004142 _____ () C:\Users\Lumey\Desktop\Avada Anleitung.txt
2014-10-26 16:33 - 2012-12-19 19:46 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001Core.job
2014-10-26 16:29 - 2014-10-26 16:29 - 00000000 ____D () C:\Users\Lumey\Desktop\Neuer Ordner
2014-10-26 16:28 - 2012-12-19 19:46 - 00004090 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001UA
2014-10-26 16:28 - 2012-12-19 19:46 - 00003694 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3438328156-4283695920-827838287-1001Core
2014-10-26 13:25 - 2013-01-15 19:53 - 00001456 _____ () C:\Users\Lumey\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-10-26 13:08 - 2014-10-26 13:08 - 00000132 _____ () C:\Users\Lumey\AppData\Roaming\Adobe CS6-AIFF-Format - Voreinstellungen
2014-10-26 11:12 - 2014-08-17 15:56 - 00000000 ____D () C:\Users\Lumey\AppData\Local\Adobe
2014-10-25 17:01 - 2014-10-25 17:01 - 00000000 ____D () C:\Users\Lumey\Desktop\Post Affiliate Pro
2014-10-25 17:00 - 2014-10-25 17:00 - 14708930 _____ () C:\Users\Lumey\Downloads\download(1).zip
2014-10-25 16:57 - 2014-10-25 16:57 - 14708930 _____ () C:\Users\Lumey\Downloads\download.zip
2014-10-25 11:45 - 2014-10-23 16:31 - 00000000 ____D () C:\Users\Lumey\Desktop\DomiCore AVADA
2014-10-22 20:27 - 2014-10-22 20:27 - 00071540 _____ () C:\Users\Lumey\Desktop\Hausverwaltungen Berlin Brandenburg.xlsx
2014-10-22 19:33 - 2014-10-22 19:33 - 00043008 _____ () C:\Users\Lumey\Desktop\Linkquellen.xls
2014-10-22 14:55 - 2014-10-07 18:14 - 00000000 ____D () C:\Users\Lumey\Desktop\Vergleichssoftware
2014-10-21 17:01 - 2014-10-21 11:53 - 00000000 ____D () C:\Users\Lumey\Desktop\Backup
2014-10-21 09:51 - 2014-10-21 09:51 - 00107969 _____ () C:\Users\Lumey\Desktop\encyclopedia-pro-1-4-28.zip
2014-10-18 14:36 - 2014-07-02 21:16 - 00000000 ____D () C:\Users\Lumey\Desktop\Sportgeräte Verkauf
2014-10-17 22:33 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-17 12:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-10-17 09:02 - 2013-11-01 09:23 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-17 09:01 - 2014-10-17 09:01 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-10-17 09:01 - 2014-10-17 09:01 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-10-17 09:01 - 2014-10-17 09:01 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-10-17 09:01 - 2014-10-17 09:01 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-17 09:01 - 2014-10-17 09:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-17 09:01 - 2014-10-17 09:01 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-16 16:48 - 2013-03-10 21:23 - 00000000 ____D () C:\Users\Lumey\Documents\Kündigungen und Widerrufe
2014-10-16 16:39 - 2009-07-14 05:45 - 05132120 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 16:38 - 2014-05-06 16:32 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 15:27 - 2012-12-19 20:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 15:24 - 2013-07-25 09:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 15:19 - 2012-12-19 19:41 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-16 08:14 - 2013-02-22 19:25 - 00000000 ____D () C:\Users\Lumey\Documents\Conny
2014-10-12 21:08 - 2014-10-12 21:08 - 00000000 ____D () C:\Users\Lumey\Documents\Verträge
2014-10-12 21:07 - 2013-09-25 19:18 - 00000000 ____D () C:\Users\Lumey\Desktop\Musik ordnen
2014-10-11 11:48 - 2014-10-11 11:48 - 00384127 _____ () C:\Users\Lumey\Downloads\Jpg.zip
2014-10-10 03:05 - 2014-10-16 08:22 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-10 03:05 - 2014-10-16 08:22 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-10 03:00 - 2014-10-16 08:22 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-09 10:06 - 2014-10-09 10:06 - 00378896 _____ () C:\Users\Lumey\Desktop\responsive-lightbox.1.4.8.zip
2014-10-07 11:40 - 2012-12-19 19:46 - 00153416 _____ () C:\Users\Lumey\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-07 03:54 - 2014-10-16 08:22 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-07 03:04 - 2014-10-16 08:22 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-30 14:44 - 2014-09-30 14:29 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\vlc
2014-09-30 14:28 - 2014-09-30 14:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-09-30 14:28 - 2014-09-30 14:28 - 00000000 ____D () C:\Program Files\VideoLAN
2014-09-29 01:58 - 2014-10-16 08:22 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-28 10:56 - 2013-12-04 20:46 - 00000000 ____D () C:\Users\Lumey\AppData\Roaming\HpUpdate
2014-09-28 10:02 - 2014-09-08 20:03 - 00000000 ____D () C:\Windows\Minidump
2014-09-28 10:02 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\Offline Web Pages
Some content of TEMP:
====================
C:\Users\Lumey\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-26 11:31
==================== End Of Log ============================
--- --- --- |
|
27.10.2014, 18:30
| #8 |
| /// the machine /// TB-Ausbilder | Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. Java updaten. Alle Backups löschen. Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win 7 Desktop PC - in regelmäßigen Abständen Audio Werbung, Nachrichten, Wetter usw. |
| 4d36e972-e325-11ce-bfc1-08002be10318, browser, desktop, error, excel, firefox, flash player, google, homepage, inetstat, internet, launch, mozilla, netzwerk, officejet, problem, programm, prozess, realtek, registry, security, software, svchost.exe, system, taskmanager, virus, werbung, windows, windows xp |
WARNUNG an die MITLESER: 
