Telekom /Abuse sperrt meinen MailAccount. Versenden schädlicher Software
Hallo zusammen,
ich bekam dieses Schreiben schon mehrmals von der Sicherheitsabteilung (Abuse) der T-Kom.
Bis dato habe ich immer etwaige "Verdächtige" gefunden und beseitigt. Diesmal denke ich , dass ich ein Problem habe.
Ich verwende Windows 7 HP und Norton AV
Hier die Log Files:
Defrogger Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:57 on 08/01/2014 (Admin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-01-2014
Ran by Admin (administrator) on MONSTERDIDI on 08-01-2014 19:00:35
Running from C:\Users\Admin\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
() C:\Program Files\ASUS\AXSP\1.00.13\atkexComSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files\ASUS\AAHM\1.00.13\aaHMSvc.exe
() C:\Program Files\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
(DeviceVM, Inc.) C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Symantec Corporation) C:\Program Files\Norton AntiVirus\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Symantec Corporation) C:\Program Files\Norton AntiVirus\Engine\20.4.0.40\ccSvcHst.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\AI Suite II\AsRoutineController.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(DeviceVM, Inc.) C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(SHI Elektronische Medien GmbH) C:\Program Files\WEKA\Kommentierte Betriebsvereinbarungen\SHIWebOnDisk.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\AI Suite II\EPU\EPUHelp.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\AI Suite II\AI Suite II.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_11_9_900_170_ActiveX.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [FreePDF Assistant] - C:\Program Files\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de)
HKLM\...\Run: [BCU] - C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe [411864 2010-03-05] (DeviceVM, Inc.)
HKLM\...\Run: [SHIWebOnDiskManager] - C:\Program Files\SHIWebOnDiskManager\SHIWebOnDiskManager.exe [233472 2011-09-23] (SHI Elektronische Medien GmbH)
HKLM\...\Run: [Nvtmru] - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Lexware\Update Manager\LxUpdateManager.exe [208424 2013-10-08] (Haufe-Lexware GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Policies\Explorer: [NoCDBurning] 0
AppInit_DLLs: ì)8ù qܱvb [ ] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
SearchScopes: HKLM - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=792919e9-9c7c-8293-6f85-ff1387632e08&searchtype=ds&q={searchTerms}&installDate=08/11/2013
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=792919e9-9c7c-8293-6f85-ff1387632e08&searchtype=ds&q={searchTerms}&installDate=08/11/2013
SearchScopes: HKCU - DefaultScope {426ED343-66B1-4eb2-BD46-51F2AB7D269B} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=792919e9-9c7c-8293-6f85-ff1387632e08&searchtype=ds&q={searchTerms}&installDate=08/11/2013
SearchScopes: HKCU - {292B7515-673D-41ef-A07A-854E5F903682} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms}
SearchScopes: HKCU - {426ED343-66B1-4eb2-BD46-51F2AB7D269B} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=IDSSNAV&chn=retail&geo=DE&ver=2014&locale=de_DE&gct=kwd&qsrc=2869
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\20.4.0.40\IPS\ipsbho.dll (Symantec Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File
Toolbar: HKCU - No Name - {724D43A0-0D85-11D4-9908-00400523E39A} - No File
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.de/common/asusTek_sys_ctrl.cab
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect119b.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onuftrsm.default
FF NewTab: about:blank
FF DefaultSearchEngine: Web Search
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Web Search
FF Homepage: google.de
FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=792919e9-9c7c-8293-6f85-ff1387632e08&searchtype=ds&installDate=08/11/2013&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.3.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.3.1 - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.450 - C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 - C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onuftrsm.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onuftrsm.default\searchplugins\safesearch.xml
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onuftrsm.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: SuperLyrics-16 - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onuftrsm.default\Extensions\58ad0086-1cfb-48bb-8ad2-33a8905572bc@5715d2be-69b9-4930-8f7e-64bdeb961cfd.com
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.4.0.40\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.4.0.40\IPSFF
========================== Services (Whitelisted) =================
R2 asComSvc; C:\Program Files\ASUS\AXSP\1.00.13\atkexComSvc.exe [918144 2010-11-03] ()
R2 asHmComSvc; C:\Program Files\ASUS\AAHM\1.00.13\aaHMSvc.exe [915584 2010-12-02] ()
R2 AsSysCtrlService; C:\Program Files\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2010-10-21] ()
R2 BCUService; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [235752 2010-03-05] (DeviceVM, Inc.)
R2 NAV; C:\Program Files\Norton AntiVirus\Engine\20.4.0.40\diMaster.dll [556336 2013-05-29] (Symantec Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14650144 2013-10-18] (NVIDIA Corporation)
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\System32\drivers\AsIO.sys [11456 2010-08-24] ()
R3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [98280 2011-01-27] (ASMedia Technology Inc)
R3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [304616 2011-01-27] (ASMedia Technology Inc)
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.4.0.40\Definitions\BASHDefs\20131218.001\BHDrvx86.sys [1098968 2013-12-18] (Symantec Corporation)
R1 ccSet_NAV; C:\Windows\system32\drivers\NAV\1404000.028\ccSetx86.sys [134744 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-11-21] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-11-21] (Symantec Corporation)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-07-18] ()
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.4.0.40\Definitions\IPSDefs\20140107.001\IDSvix86.sys [394456 2013-12-13] (Symantec Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [41088 2010-10-19] (Intel Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.4.0.40\Definitions\VirusDefs\20140108.003\NAVENG.SYS [93272 2014-01-03] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.4.0.40\Definitions\VirusDefs\20140108.003\NAVEX15.SYS [1612376 2014-01-03] (Symantec Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [33568 2013-09-28] (NVIDIA Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NAV\1404000.028\SRTSP.SYS [603224 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NAV\1404000.028\SRTSPX.SYS [32344 2013-03-04] (Symantec Corporation)
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [182680 2013-10-28] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2007-10-25] ()
R0 SymDS; C:\Windows\System32\drivers\NAV\1404000.028\SYMDS.SYS [367704 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NAV\1404000.028\SYMEFA.SYS [934488 2013-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2013-06-23] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NAV\1404000.028\Ironx86.SYS [175264 2013-03-04] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NAV\1404000.028\SYMNETS.SYS [339544 2013-04-24] (Symantec Corporation)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Admin\AppData\Local\Temp\catchme.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-08 19:00 - 2014-01-08 19:00 - 00015606 _____ C:\Users\Admin\Desktop\FRST.txt
2014-01-08 19:00 - 2014-01-08 19:00 - 00000000 ____D C:\FRST
2014-01-08 18:59 - 2014-01-08 18:59 - 01065719 _____ (Farbar) C:\Users\Admin\Desktop\FRST.exe
2014-01-08 18:57 - 2014-01-08 18:57 - 00000472 _____ C:\Users\Admin\Desktop\defogger_disable.log
2014-01-08 18:57 - 2014-01-08 18:57 - 00000000 _____ C:\Users\Admin\defogger_reenable
2014-01-08 18:47 - 2014-01-08 18:47 - 00000324 _____ C:\Windows\PFRO.log
2014-01-08 18:35 - 2014-01-08 18:35 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-01-08 18:34 - 2014-01-08 18:34 - 00001070 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-08 18:34 - 2014-01-08 18:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 18:34 - 2014-01-08 18:34 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-08 18:34 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-08 18:31 - 2014-01-08 18:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-08 18:23 - 2014-01-08 18:23 - 04745728 _____ (AVAST Software) C:\Users\Admin\Desktop\aswMBR.exe
2014-01-08 18:23 - 2014-01-08 18:23 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe
2014-01-08 18:22 - 2014-01-08 18:22 - 00688992 _____ (Swearware) C:\Users\Admin\Desktop\dds.exe
2014-01-08 18:22 - 2014-01-08 18:22 - 00050477 _____ C:\Users\Admin\Desktop\Defogger.exe
2014-01-08 17:26 - 2014-01-08 17:26 - 00000000 ____D C:\Program Files\EPSViewer
2014-01-08 17:23 - 2014-01-08 17:24 - 07097337 _____ C:\Users\Admin\Downloads\Typenschild.eps
2014-01-07 21:15 - 2014-01-07 21:15 - 08886413 _____ C:\Users\Admin\Downloads\philz_touch_6.08.9-jfltexx.zip
2014-01-06 19:31 - 2014-01-06 19:31 - 01376581 _____ C:\Users\Admin\Downloads\GravityBox_2.7.6.apk
2014-01-06 19:18 - 2014-01-06 19:18 - 04457988 _____ C:\Users\Admin\Downloads\NottachXposed_v12.apk
2014-01-06 19:04 - 2014-01-06 19:04 - 00543253 _____ C:\Users\Admin\Downloads\de.robv.android.xposed.installer_v25_36cbbc.apk
2014-01-06 16:08 - 2014-01-06 16:08 - 00707836 _____ C:\Users\Admin\Downloads\threeminitsettings.apk
2014-01-06 16:07 - 2014-01-06 16:08 - 51693444 _____ C:\Users\Admin\Downloads\3Minit_Framework_0.4_ML6_MD5_97752B504F0184FC14333E97CA9F8B73.zip
2014-01-06 00:37 - 2014-01-06 16:35 - 579811384 _____ C:\Users\Admin\Downloads\Echoe_Rom_V12_ULTRA_SLIM_by_adl_&_Spevil.zip
2014-01-05 22:33 - 2014-01-05 22:33 - 31776279 _____ C:\Users\Admin\Downloads\BatteryIconCreator_V32.0.zip
2014-01-05 16:25 - 2014-01-05 16:25 - 00135136 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-05 12:18 - 2014-01-05 12:16 - 04790259 ____N C:\Users\Admin\Downloads\systemuiupdate.zip
2014-01-05 12:16 - 2014-01-05 21:22 - 34695113 _____ C:\Users\Admin\Downloads\oggupdate.zip
2014-01-05 11:42 - 2014-01-05 11:41 - 38616581 ____N C:\Users\Admin\Downloads\ogbattupdate.zip
2014-01-03 09:30 - 2014-01-03 09:34 - 04586659 _____ C:\Users\Admin\Downloads\SystemUI.apk
2014-01-02 22:34 - 2014-01-02 22:35 - 00001385 _____ C:\Windows\IE10_main.log
2014-01-02 22:33 - 2014-01-02 22:33 - 30091776 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\IE10-Windows6.1-x86-de-de.exe
2014-01-02 22:03 - 2014-01-02 23:15 - 1557379932 _____ C:\Users\Admin\Downloads\Duxter_Rom_v22.zip
2014-01-02 19:04 - 2014-01-02 19:06 - 25381969 _____ C:\Users\Admin\Downloads\Hot Fudge Theme by HS™ V1.0.zip
2014-01-02 17:20 - 2014-01-08 18:48 - 00004841 _____ C:\Windows\setupact.log
2014-01-02 17:20 - 2014-01-02 17:20 - 03871784 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-02 17:20 - 2014-01-02 17:20 - 00000000 _____ C:\Windows\setuperr.log
2014-01-02 06:45 - 2014-01-02 06:45 - 00000000 ____D C:\Users\Admin\Documents\WEKA
2013-12-31 16:42 - 2013-12-31 16:40 - 09310082 _____ C:\Users\Admin\Downloads\OGBatteryMod.apk
2013-12-31 16:37 - 2013-12-31 16:35 - 02435595 ____N C:\Users\Admin\Downloads\v12-Stock_SystemUI_OGBatteryMod_ML6.zip
2013-12-31 15:29 - 2013-12-19 22:14 - 11739433 _____ C:\Users\Admin\Downloads\SPlanner.apk
2013-12-31 10:05 - 2014-01-02 19:57 - 1058079272 _____ C:\Users\Admin\Downloads\S4_Echoe_v12_30DEC2013.zip
2013-12-30 14:12 - 2013-12-30 19:05 - 2073729101 _____ C:\Users\Admin\Downloads\PhoeniX.ROM.V7.0.XXUEML1.I9505.by.tamirda.zip
2013-12-29 15:04 - 2013-12-29 15:05 - 00000000 ____D C:\Users\Admin\Downloads\prime 95
2013-12-29 15:03 - 2013-12-29 15:03 - 04277073 _____ C:\Users\Admin\Downloads\p95v279.win32.zip
2013-12-28 14:39 - 2013-12-28 14:42 - 05348016 _____ C:\Users\Admin\Downloads\VP700M1N2N_18827ad160da44c59eefefb4ce72cc0d.zip
2013-12-26 09:56 - 2013-12-26 10:24 - 596713502 _____ C:\Users\Admin\Downloads\Echoe_Rom_V11_ULTRA_SLIM_by_adl_&_Spevil.zip
2013-12-26 00:35 - 2013-12-26 00:35 - 00001978 _____ C:\Users\Admin\Desktop\Tiny Hexer.lnk
2013-12-26 00:35 - 2013-12-26 00:35 - 00000000 ____D C:\Users\Admin\AppData\Roaming\mirkes.de
2013-12-26 00:35 - 2013-12-26 00:35 - 00000000 ____D C:\Program Files\mirkes.de
2013-12-26 00:09 - 2013-12-26 00:09 - 00007655 _____ C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
2013-12-22 20:57 - 2013-12-22 21:03 - 00000000 ____D C:\Users\Admin\Downloads\apk_tool
2013-12-22 20:57 - 2013-12-22 21:01 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Android
2013-12-21 22:33 - 2013-12-21 22:48 - 524370513 _____ C:\Users\Admin\Downloads\Echoe_KitKat_v2.1_18DEC2013.zip
2013-12-19 16:59 - 2013-12-19 16:59 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-18 19:15 - 2013-12-18 19:15 - 03226940 _____ C:\Users\Admin\Downloads\178.zip
2013-12-18 19:14 - 2013-12-18 19:14 - 03070641 _____ C:\Users\Admin\Downloads\176.zip
2013-12-17 11:30 - 2013-12-17 11:30 - 00609095 _____ C:\Users\Admin\Downloads\echoekitchen.zip
2013-12-16 19:07 - 2014-01-06 19:10 - 00001220 _____ C:\Users\Admin\Downloads\Xposed-Disabler-Recovery.zip
2013-12-16 15:26 - 2013-12-16 15:27 - 52370762 _____ C:\Users\Admin\Downloads\Echoe Settings and Kitchen v9.zip
2013-12-15 18:32 - 2013-12-15 18:33 - 52386816 _____ C:\Users\Admin\Downloads\modem.bin
2013-12-14 22:41 - 2013-12-14 22:56 - 479621178 _____ C:\Users\Admin\Downloads\Echoe_KitKat_v1.2_10Dec2013.zip
2013-12-14 14:42 - 2013-12-16 12:59 - 00000000 ____D C:\Users\Admin\Downloads\wallpaper
2013-12-13 20:21 - 2013-12-13 20:21 - 00966872 _____ C:\Users\Admin\Downloads\DE-SAMSUNGNIZER_SCRIPT_V4.1.zip
2013-12-12 21:18 - 2013-12-14 15:18 - 00012755 _____ C:\Users\Admin\Downloads\lens_flare_lock.ogg
2013-12-12 21:18 - 2013-09-02 08:43 - 00013878 _____ C:\Users\Admin\Downloads\lens_flare_lock1.ogg
2013-12-12 20:44 - 2013-12-12 20:44 - 00000000 ____D C:\ProgramData\Qualcomm
2013-12-12 16:41 - 2013-12-16 13:27 - 702820351 _____ C:\Users\Admin\Downloads\Echoe_SLIM_v9_26Nov2013.zip
2013-12-12 16:29 - 2013-12-12 16:34 - 15365072 _____ (SAMSUNG Electronics Co., Ltd.) C:\Users\Admin\Downloads\USB_Drivers_1.5.27.0.exe
2013-12-12 12:05 - 2013-12-12 12:05 - 01828801 _____ C:\Users\Admin\Downloads\PAS30.zip
2013-12-12 12:03 - 2013-12-12 12:03 - 01823613 _____ C:\Users\Admin\Downloads\PAS29.zip
2013-12-11 23:32 - 2013-12-11 23:33 - 08714305 _____ C:\Users\Admin\Downloads\philz_touch_6.03.4-jfltexx.tar.md5
2013-12-11 22:50 - 2013-12-11 22:50 - 01160801 _____ C:\Users\Admin\Downloads\UPDATE-SuperSU-v1.80.zip
2013-12-11 22:47 - 2013-12-11 22:47 - 00464072 _____ C:\Users\Admin\Downloads\Odin3.07.zip
2013-12-11 20:39 - 2013-12-11 20:39 - 00000000 ____D C:\Program Files\Qualcomm
2013-12-11 20:37 - 2014-01-02 23:08 - 00000000 ____D C:\Users\Admin\Downloads\efs.back
2013-12-11 13:22 - 2013-12-22 10:41 - 00000000 ____D C:\Users\Admin\Downloads\cfautoroot
2013-12-11 12:57 - 2013-12-11 13:26 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-12-11 06:55 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-11 06:55 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-11 06:52 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-11 06:52 - 2013-10-25 05:45 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-11 06:52 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-11 06:52 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-11 06:52 - 2013-10-25 05:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-11 06:52 - 2013-10-25 04:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-11 06:52 - 2013-10-25 03:49 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-11 06:43 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 06:43 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 06:43 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 06:43 - 2013-10-30 02:27 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 06:43 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 06:43 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 06:43 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 06:43 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 06:43 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 06:43 - 2013-10-04 02:49 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 06:43 - 2013-10-04 02:17 - 00177152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
==================== One Month Modified Files and Folders =======
2014-01-08 19:00 - 2014-01-08 19:00 - 00015606 _____ C:\Users\Admin\Desktop\FRST.txt
2014-01-08 19:00 - 2014-01-08 19:00 - 00000000 ____D C:\FRST
2014-01-08 18:59 - 2014-01-08 18:59 - 01065719 _____ (Farbar) C:\Users\Admin\Desktop\FRST.exe
2014-01-08 18:57 - 2014-01-08 18:57 - 00000472 _____ C:\Users\Admin\Desktop\defogger_disable.log
2014-01-08 18:57 - 2014-01-08 18:57 - 00000000 _____ C:\Users\Admin\defogger_reenable
2014-01-08 18:57 - 2011-06-16 12:04 - 00000000 ____D C:\Users\Admin
2014-01-08 18:55 - 2009-07-14 05:34 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-08 18:55 - 2009-07-14 05:34 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-08 18:52 - 2011-06-16 18:01 - 01156369 _____ C:\Windows\WindowsUpdate.log
2014-01-08 18:48 - 2014-01-02 17:20 - 00004841 _____ C:\Windows\setupact.log
2014-01-08 18:48 - 2011-06-30 11:34 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-08 18:48 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-08 18:47 - 2014-01-08 18:47 - 00000324 _____ C:\Windows\PFRO.log
2014-01-08 18:47 - 2011-06-16 13:45 - 00000000 ____D C:\ProgramData\NVIDIA
2014-01-08 18:35 - 2014-01-08 18:35 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-01-08 18:34 - 2014-01-08 18:34 - 00001070 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-08 18:34 - 2014-01-08 18:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-08 18:34 - 2014-01-08 18:34 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-08 18:31 - 2014-01-08 18:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Admin\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-08 18:23 - 2014-01-08 18:23 - 04745728 _____ (AVAST Software) C:\Users\Admin\Desktop\aswMBR.exe
2014-01-08 18:23 - 2014-01-08 18:23 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe
2014-01-08 18:22 - 2014-01-08 18:22 - 00688992 _____ (Swearware) C:\Users\Admin\Desktop\dds.exe
2014-01-08 18:22 - 2014-01-08 18:22 - 00050477 _____ C:\Users\Admin\Desktop\Defogger.exe
2014-01-08 18:06 - 2011-06-30 11:34 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-08 17:26 - 2014-01-08 17:26 - 00000000 ____D C:\Program Files\EPSViewer
2014-01-08 17:24 - 2014-01-08 17:23 - 07097337 _____ C:\Users\Admin\Downloads\Typenschild.eps
2014-01-07 21:15 - 2014-01-07 21:15 - 08886413 _____ C:\Users\Admin\Downloads\philz_touch_6.08.9-jfltexx.zip
2014-01-06 19:31 - 2014-01-06 19:31 - 01376581 _____ C:\Users\Admin\Downloads\GravityBox_2.7.6.apk
2014-01-06 19:18 - 2014-01-06 19:18 - 04457988 _____ C:\Users\Admin\Downloads\NottachXposed_v12.apk
2014-01-06 19:10 - 2013-12-16 19:07 - 00001220 _____ C:\Users\Admin\Downloads\Xposed-Disabler-Recovery.zip
2014-01-06 19:04 - 2014-01-06 19:04 - 00543253 _____ C:\Users\Admin\Downloads\de.robv.android.xposed.installer_v25_36cbbc.apk
2014-01-06 16:35 - 2014-01-06 00:37 - 579811384 _____ C:\Users\Admin\Downloads\Echoe_Rom_V12_ULTRA_SLIM_by_adl_&_Spevil.zip
2014-01-06 16:08 - 2014-01-06 16:08 - 00707836 _____ C:\Users\Admin\Downloads\threeminitsettings.apk
2014-01-06 16:08 - 2014-01-06 16:07 - 51693444 _____ C:\Users\Admin\Downloads\3Minit_Framework_0.4_ML6_MD5_97752B504F0184FC14333E97CA9F8B73.zip
2014-01-05 22:34 - 2012-10-05 07:30 - 00000000 ____D C:\Users\Admin\Downloads\BatteryIconCreator
2014-01-05 22:33 - 2014-01-05 22:33 - 31776279 _____ C:\Users\Admin\Downloads\BatteryIconCreator_V32.0.zip
2014-01-05 21:22 - 2014-01-05 12:16 - 34695113 _____ C:\Users\Admin\Downloads\oggupdate.zip
2014-01-05 18:01 - 2011-06-16 13:18 - 00010240 _____ C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-01-05 17:59 - 2011-06-16 12:08 - 01658180 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-05 16:25 - 2014-01-05 16:25 - 00135136 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-05 12:16 - 2014-01-05 12:18 - 04790259 ____N C:\Users\Admin\Downloads\systemuiupdate.zip
2014-01-05 11:41 - 2014-01-05 11:42 - 38616581 ____N C:\Users\Admin\Downloads\ogbattupdate.zip
2014-01-03 09:34 - 2014-01-03 09:30 - 04586659 _____ C:\Users\Admin\Downloads\SystemUI.apk
2014-01-03 00:22 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2014-01-02 23:37 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF
2014-01-02 23:15 - 2014-01-02 22:03 - 1557379932 _____ C:\Users\Admin\Downloads\Duxter_Rom_v22.zip
2014-01-02 23:08 - 2013-12-11 20:37 - 00000000 ____D C:\Users\Admin\Downloads\efs.back
2014-01-02 22:53 - 2011-06-16 18:58 - 00000000 ____D C:\Windows\Panther
2014-01-02 22:48 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2014-01-02 22:35 - 2014-01-02 22:34 - 00001385 _____ C:\Windows\IE10_main.log
2014-01-02 22:33 - 2014-01-02 22:33 - 30091776 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\IE10-Windows6.1-x86-de-de.exe
2014-01-02 19:57 - 2013-12-31 10:05 - 1058079272 _____ C:\Users\Admin\Downloads\S4_Echoe_v12_30DEC2013.zip
2014-01-02 19:06 - 2014-01-02 19:04 - 25381969 _____ C:\Users\Admin\Downloads\Hot Fudge Theme by HS™ V1.0.zip
2014-01-02 17:20 - 2014-01-02 17:20 - 03871784 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-02 17:20 - 2014-01-02 17:20 - 00000000 _____ C:\Windows\setuperr.log
2014-01-02 15:43 - 2012-10-01 04:59 - 00000000 ____D C:\Windows\Minidump
2014-01-02 15:43 - 2011-07-02 10:32 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2014-01-02 06:45 - 2014-01-02 06:45 - 00000000 ____D C:\Users\Admin\Documents\WEKA
2014-01-01 23:06 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2014-01-01 19:50 - 2011-09-03 09:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\vlc
2014-01-01 10:10 - 2011-06-28 08:51 - 00458752 ___SH C:\Users\Admin\Documents\Thumbs.db
2014-01-01 07:05 - 2009-07-14 05:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-01 01:49 - 2013-10-22 00:09 - 00000000 ____D C:\Users\Admin\Desktop\van
2013-12-31 16:40 - 2013-12-31 16:42 - 09310082 _____ C:\Users\Admin\Downloads\OGBatteryMod.apk
2013-12-31 16:35 - 2013-12-31 16:37 - 02435595 ____N C:\Users\Admin\Downloads\v12-Stock_SystemUI_OGBatteryMod_ML6.zip
2013-12-31 06:35 - 2012-11-22 08:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-30 23:33 - 2012-04-30 06:38 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-12-30 23:33 - 2011-10-13 07:22 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-30 23:33 - 2011-06-16 12:55 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-12-30 19:05 - 2013-12-30 14:12 - 2073729101 _____ C:\Users\Admin\Downloads\PhoeniX.ROM.V7.0.XXUEML1.I9505.by.tamirda.zip
2013-12-29 15:05 - 2013-12-29 15:04 - 00000000 ____D C:\Users\Admin\Downloads\prime 95
2013-12-29 15:03 - 2013-12-29 15:03 - 04277073 _____ C:\Users\Admin\Downloads\p95v279.win32.zip
2013-12-28 14:42 - 2013-12-28 14:39 - 05348016 _____ C:\Users\Admin\Downloads\VP700M1N2N_18827ad160da44c59eefefb4ce72cc0d.zip
2013-12-26 10:24 - 2013-12-26 09:56 - 596713502 _____ C:\Users\Admin\Downloads\Echoe_Rom_V11_ULTRA_SLIM_by_adl_&_Spevil.zip
2013-12-26 01:17 - 2009-07-14 05:52 - 00000000 ____D C:\Program Files\MSBuild
2013-12-26 00:35 - 2013-12-26 00:35 - 00001978 _____ C:\Users\Admin\Desktop\Tiny Hexer.lnk
2013-12-26 00:35 - 2013-12-26 00:35 - 00000000 ____D C:\Users\Admin\AppData\Roaming\mirkes.de
2013-12-26 00:35 - 2013-12-26 00:35 - 00000000 ____D C:\Program Files\mirkes.de
2013-12-26 00:09 - 2013-12-26 00:09 - 00007655 _____ C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
2013-12-24 17:56 - 2013-10-30 09:06 - 00000000 ____D C:\Users\UpdatusUser.MONSTERDIDI
2013-12-24 17:56 - 2012-04-28 07:37 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-12-22 21:03 - 2013-12-22 20:57 - 00000000 ____D C:\Users\Admin\Downloads\apk_tool
2013-12-22 21:01 - 2013-12-22 20:57 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Android
2013-12-22 10:41 - 2013-12-11 13:22 - 00000000 ____D C:\Users\Admin\Downloads\cfautoroot
2013-12-21 22:48 - 2013-12-21 22:33 - 524370513 _____ C:\Users\Admin\Downloads\Echoe_KitKat_v2.1_18DEC2013.zip
2013-12-19 22:14 - 2013-12-31 15:29 - 11739433 _____ C:\Users\Admin\Downloads\SPlanner.apk
2013-12-19 16:59 - 2013-12-19 16:59 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-18 19:15 - 2013-12-18 19:15 - 03226940 _____ C:\Users\Admin\Downloads\178.zip
2013-12-18 19:14 - 2013-12-18 19:14 - 03070641 _____ C:\Users\Admin\Downloads\176.zip
2013-12-17 11:30 - 2013-12-17 11:30 - 00609095 _____ C:\Users\Admin\Downloads\echoekitchen.zip
2013-12-16 18:08 - 2011-06-16 13:16 - 00000000 ____D C:\Program Files\Google
2013-12-16 15:27 - 2013-12-16 15:26 - 52370762 _____ C:\Users\Admin\Downloads\Echoe Settings and Kitchen v9.zip
2013-12-16 13:27 - 2013-12-12 16:41 - 702820351 _____ C:\Users\Admin\Downloads\Echoe_SLIM_v9_26Nov2013.zip
2013-12-16 13:00 - 2012-06-20 05:38 - 00000000 ____D C:\Users\Admin\Downloads\babe
2013-12-16 12:59 - 2013-12-14 14:42 - 00000000 ____D C:\Users\Admin\Downloads\wallpaper
2013-12-15 18:33 - 2013-12-15 18:32 - 52386816 _____ C:\Users\Admin\Downloads\modem.bin
2013-12-14 22:56 - 2013-12-14 22:41 - 479621178 _____ C:\Users\Admin\Downloads\Echoe_KitKat_v1.2_10Dec2013.zip
2013-12-14 15:18 - 2013-12-12 21:18 - 00012755 _____ C:\Users\Admin\Downloads\lens_flare_lock.ogg
2013-12-13 20:21 - 2013-12-13 20:21 - 00966872 _____ C:\Users\Admin\Downloads\DE-SAMSUNGNIZER_SCRIPT_V4.1.zip
2013-12-12 20:44 - 2013-12-12 20:44 - 00000000 ____D C:\ProgramData\Qualcomm
2013-12-12 16:34 - 2013-12-12 16:29 - 15365072 _____ (SAMSUNG Electronics Co., Ltd.) C:\Users\Admin\Downloads\USB_Drivers_1.5.27.0.exe
2013-12-12 12:05 - 2013-12-12 12:05 - 01828801 _____ C:\Users\Admin\Downloads\PAS30.zip
2013-12-12 12:03 - 2013-12-12 12:03 - 01823613 _____ C:\Users\Admin\Downloads\PAS29.zip
2013-12-12 01:00 - 2011-06-16 13:16 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-12-11 23:33 - 2013-12-11 23:32 - 08714305 _____ C:\Users\Admin\Downloads\philz_touch_6.03.4-jfltexx.tar.md5
2013-12-11 22:50 - 2013-12-11 22:50 - 01160801 _____ C:\Users\Admin\Downloads\UPDATE-SuperSU-v1.80.zip
2013-12-11 22:47 - 2013-12-11 22:47 - 00464072 _____ C:\Users\Admin\Downloads\Odin3.07.zip
2013-12-11 20:39 - 2013-12-11 20:39 - 00000000 ____D C:\Program Files\Qualcomm
2013-12-11 13:26 - 2013-12-11 12:57 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-12-11 09:37 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-12-11 08:49 - 2011-06-17 13:09 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-11 06:55 - 2013-07-29 15:42 - 00000000 ____D C:\Windows\system32\MRT
2013-12-11 06:55 - 2011-06-16 13:39 - 88123800 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-30 09:25
==================== End Of Log ============================
Addition Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 08-01-2014
Ran by Admin at 2014-01-08 19:01:01
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Norton AntiVirus (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton AntiVirus (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (Version: - Microsoft)
7-Zip 9.20 (Version: - )
AC3Filter 1.62b (Version: 1.62b - Alexander Vigovsky)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Media Player (Version: 1.8 - Adobe Systems Incorporated)
Adobe Media Player (Version: 1.8 - Adobe Systems Incorporated) Hidden
Adobe Photoshop Album 2.0 Starter Edition (Version: 2.00.100 - Adobe Systems, Inc.)
Adobe Photoshop CS6 (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (Version: 11.6.3.633 - Adobe Systems, Inc.)
AI Suite II (Version: 1.01.14 - ASUSTeK)
Allgemeine Runtime Files (x86) (Version: 1.0.3.0 - Sereby Corporation)
Asmedia ASM104x USB 3.0 Host Controller Driver (Version: 1.6.3.0 - Asmedia Technology)
Bejeweled 3 (Version: - PopCap Games)
Bejeweled Twist (Version: - PopCap Games)
BG BAU Aus Unfällen lernen 2012 (Version: 1.2.3.1. - Jedermann-Verlag)
BG BAU Info-CD 2011 (Version: - )
BG BAU Regelwerke 2012 (Version: 20120601 - Jedermann-Verlag GmbH)
BG BAU Startbildschirm (Version: 20120601 - Jedermann-Verlag GmbH)
BG-Bau-Wegweiser-12 (Version: 12.0.8.22 - Jedermann-Verlag)
Big Fish Games: Game Manager (Version: 3.0.1.60 - )
Browser Configuration Utility (Version: 1.0.12.1 - DeviceVM, Inc.)
calibre (Version: 1.10.0 - Kovid Goyal)
CameraHelperMsi (Version: 13.51.815.0 - Logitech) Hidden
CCleaner (Version: 4.04 - Piriform)
Citrix XenApp Web Plugin (Version: 11.0.0.5357 - Citrix Systems, Inc.)
DirectX 9.0c Extra Files (x86) (Version: 1.10.06.0 - Sereby Corporation)
DirectX for Managed Code (Version: 1.0.0.0 - Sereby Corporation)
DivX-Setup (Version: 2.5.0.11 - DivX, LLC)
Easy XML Editor 1.6.6 (Version: - hxxp://www.easy-xml-editor.de)
EPS Viewer (Version: - IdeaMK)
erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Exact Audio Copy 1.0beta3 (Version: 1.0beta3 - Andre Wiethoff)
FreePDF (Remove only) (Version: - )
FRITZ!Box-Fernzugang einrichten (Version: 1.0.3 - AVM Berlin)
GB Hoch- und Tiefbau-Gewerke (Version: - )
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Drive (Version: 1.13.5782.599 - Google, Inc.)
Google Earth Plug-in (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
GPL Ghostscript (Version: 9.02 - Artifex Software Inc.)
Greenfish Icon Editor Pro 3.25 (Version: - Greenfish Corporation)
HP Officejet 6500 E710a-f - Grundlegende Software für das Gerät (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6500 E710a-f Hilfe (Version: 140.0.2.2 - Hewlett Packard)
HP Product Detection (Version: 11.14.0004 - HP)
I.R.I.S. OCR (Version: 12.3.4.0 - HP)
Intel(R) Management Engine Components (Version: 7.0.0.1144 - Intel Corporation)
IrfanView (remove only) (Version: 4.27 - Irfan Skiljan)
IsoBuster 2.8.5 (Version: 2.8.5 - Smart Projects)
Java Auto Updater (Version: 2.1.6.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 7 Update 3 (Version: 7.0.30 - Oracle)
Java(TM) SE Development Kit 7 Update 1 (Version: 1.7.0.10 - Oracle)
JavaFX 2.0.3 (Version: 2.0.3 - Oracle Corporation)
Jedermann-Verlag Symbolbibliothek (Version: 6.0 - )
Lexware Info Service (Version: 4.00.00.0075 - Haufe-Lexware GmbH & Co.KG)
Logitech Vid HD (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam-Software (Version: 2.51 - Logitech Inc.)
LWS Facebook (Version: 13.50.854.0 - Logitech) Hidden
LWS Gallery (Version: 13.51.827.0 - Logitech) Hidden
LWS Help_main (Version: 13.51.828.0 - Logitech) Hidden
LWS Launcher (Version: 13.51.828.0 - Logitech) Hidden
LWS Motion Detection (Version: 13.51.815.0 - Logitech) Hidden
LWS Pictures And Video (Version: 13.51.815.0 - Logitech) Hidden
LWS Twitter (Version: 13.30.1346.0 - Logitech) Hidden
LWS Webcam Software (Version: 13.51.815.0 - Logitech) Hidden
LWS WLM Plugin (Version: 1.30.1201.0 - Logitech) Hidden
LWS YouTube Plugin (Version: 13.31.1038.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 1.1 German Language Pack (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 1.1 Security Update (KB979906) (Version: - )
Microsoft .NET Framework 1.1 SP1 + KB928366 (Version: - )
Microsoft .NET Framework 1.1 SP1 + KB928366 (Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (Version: - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (Version: 2.0.50727 - Microsoft Corporation) Hidden
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (Version: 1.00.0000 - Adobe) Hidden
mirkes.de Tiny Hexer (Version: 1.8 - markus stephany)
MozBackup 1.4.10 (Version: - Pavel Cvrcek)
Mozilla Firefox 25.0.1 (x86 de) (Version: 25.0.1 - Mozilla)
Mozilla Maintenance Service (Version: 25.0.1 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (Version: 24.2.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
MyTomTom 3.2.0.700 (Version: 3.2.0.700 - TomTom)
Nero 7 Ultra Edition (Version: 7.02.2620 - Nero AG)
NewsLeecher v4.0 Final (Version: - )
Norton AntiVirus (Version: 20.4.0.40 - Symantec Corporation)
Notepad++ (Version: 5.9.4 - )
NVIDIA 3D Vision Controller Driver (Version: 275.33 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller-Treiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA Display Control Panel (Version: 6.14.11.9745 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.7 (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.3165 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.9 (Version: 1.2.9 - NVIDIA Corporation)
Octoshape add-in for Adobe Flash Player (Version: - )
Paint.NET v3.5.5 (Version: 3.55.0 - dotPDN LLC)
PDF Settings CS6 (Version: 11.0 - Adobe Systems Incorporated) Hidden
Planet Horse (Version: - )
QPST 2.7 (Version: 2.7.378 - Qualcomm)
QuickSteuer 2012 (Version: 18.06.00.0009 - Haufe-Lexware GmbH & Co.KG)
QuickSteuer 2013 (Version: 19.04.00.0009 - Haufe-Lexware GmbH & Co.KG)
QuickSteuer 2014 (Version: 20.00.00.0035 - Haufe-Lexware GmbH & Co.KG)
Real Alternative 2.0.2 (Version: 2.0.2 - )
Realtek Ethernet Controller Driver (Version: 7.69.304.2013 - Realtek)
RedMon - Redirection Port Monitor (Version: - )
Samsung Kies (Version: 2.1.0.11095_121 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.1.0.11095_121 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation) Hidden
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab (Version: - )
Total Commander (Remove or Repair) (Version: 7.50a - Ghisler Software GmbH)
Trinklit Supreme (Version: - )
Ubuntu (Version: 12.10-rev273 - Ubuntu)
Update for 2007 Microsoft Office System (KB967642) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (Version: - Microsoft)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden
Visual C++ 2008 x86 Runtime - (v9.0.30729.5026) (Version: 9.0.30729.5026 - Microsoft Corporation) Hidden
Visual C++ 2008 x86 Runtime - v9.0.30729.5026 (Version: 9.0.30729.5026 - Microsoft Corporation)
Visual Studio C++ 10.0 Runtime (Version: 10.0.0 - TomTom International B.V.)
VLC media player 1.1.11 (Version: 1.1.11 - VideoLAN)
WEKA Kommentierte Betriebsvereinbarungen Oktober 2011 (Version: Oktober 2011 - WEKA)
WinRAR 4.00 (32-Bit) (Version: 4.00.0 - win.rar GmbH)
XAMPP 1.7.7 (Version: - )
xrecode II 1.0.0.140 (Version: - )
==================== Restore Points =========================
29-12-2013 16:21:56 Geplanter Prüfpunkt
01-01-2014 18:00:39 Windows-Sicherung
02-01-2014 21:46:25 Windows Modules Installer
==================== Hosts content: ==========================
2009-07-14 03:04 - 2012-06-30 15:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {26534F4C-2C60-4A1C-8379-C2C13B4BE605} - \DealPlyUpdate No Task File
Task: {36F7C6B3-26DE-4465-B741-310C86C208E9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-30] (Adobe Systems Incorporated)
Task: {4177085D-8129-4EFE-9ED6-5A8112ABCCA4} - System32\Tasks\Norton AntiVirus\Norton Error Analyzer => C:\Program Files\Norton AntiVirus\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation)
Task: {448EFBA6-45D7-4918-928A-A5D2974AE4A5} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files\Norton Identity Safe\Engine\2014.5.0.67\SymErr.exe
Task: {4ADBC274-F1F4-40B3-B060-DF8CC0DEA341} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-06-30] (Google Inc.)
Task: {781748DA-F809-4A78-8E80-5766B5FFF25F} - System32\Tasks\{5CDEA5B8-9211-4ACE-9152-70A0AE66D8DC} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.3.0.120/de/abandoninstall?page=tsGoogle&installinfo=google-toolbar:offered-installed,google-chrome:notoffered;toolbaroffered
Task: {8731E1AB-C410-4175-B18D-98A8F94E647E} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton AntiVirus\Engine\20.4.0.40\WSCStub.exe [2013-06-03] (Symantec Corporation)
Task: {8C719D6B-040A-4922-A35D-4C67D077C427} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-06-30] (Google Inc.)
Task: {8D52240F-D509-4523-AC49-2838669B419E} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files\Norton Identity Safe\Engine\2014.5.0.67\SymErr.exe
Task: {9D1DE175-5640-47D5-90E0-62EEDCCBB911} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {B9FEA4AB-33BC-41F5-AD30-A102CC5F67CD} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files\ASUS\AI Suite II\AsRoutineController.exe [2010-11-26] (ASUSTeK Computer Inc.)
Task: {C7199B42-F633-4918-BD4C-86303B1D2CB2} - System32\Tasks\Norton AntiVirus\Norton Error Processor => C:\Program Files\Norton AntiVirus\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation)
Task: {C787FDE7-D03C-4C41-8D30-2A51686F030A} - System32\Tasks\{2975EC6C-E375-4365-97F5-3F8577440DFC} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.1.59.129/de/abandoninstall?page=tsProgressBar
Task: {CDCC03F9-0013-441C-AFA8-4CD055A462DB} - System32\Tasks\Open URL by RoboForm => Rundll32.exe url.dll,FileProtocolHandler "hxxp://www.roboform.com/uninstall.html?aaa=KICMJJNMNMLJMJNMMMJJCNNJIMNMGMCNLMMMOJIMCNHMOJOJKMCNIMLMKJNMJMGMLMLMKMMMGMNMJNJICMIMCNGMCNOMFMGMCNOMPMCNGMNMPMPMFMJMCNOMCNIMJMPMOMCNNMJNPICMPMFMFMKMGMJNHICMEKMICNJJCKJNBJCMOLLJCJGJBJJNKJCMJNNICMJNDJCMLJKJ"
Task: {E486DE01-113D-4509-8C5B-D226E101088D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-10-08 09:46 - 2011-03-02 11:40 - 00140288 _____ () C:\Program Files\WinRAR\rarext.dll
2011-07-18 22:04 - 2011-07-18 22:04 - 00296448 _____ () C:\Program Files\Notepad++\NppShell_04.dll
2009-07-31 20:39 - 2009-07-31 20:39 - 00503202 _____ () C:\Program Files\DeviceVM\Browser Configuration Utility\sqlite3.dll
2012-10-26 14:25 - 2011-09-23 12:52 - 01351168 ____N () C:\Program Files\WEKA\Kommentierte Betriebsvereinbarungen\ip-engine\StdFTS\cpl25m.dll
2012-10-26 14:25 - 2011-09-23 12:52 - 00655360 ____N () C:\PROGRAM FILES\WEKA\KOMMENTIERTE BETRIEBSVEREINBARUNGEN\IP-ENGINE\STDFTS\CONFIG\PROD\RCA\SHICplUni.dll
2012-10-26 14:25 - 2011-09-23 12:52 - 00226816 ____N () C:\PROGRAM FILES\WEKA\KOMMENTIERTE BETRIEBSVEREINBARUNGEN\IP-ENGINE\STDFTS\CONFIG\PROD\LSS\lss_back.dll
2012-10-26 14:25 - 2011-09-23 12:52 - 00296960 ____N () C:\PROGRAM FILES\WEKA\KOMMENTIERTE BETRIEBSVEREINBARUNGEN\IP-ENGINE\STDFTS\CONFIG\PROD\LSS\lss_unic.dll
2012-10-26 14:26 - 2011-09-23 12:52 - 00045056 ____N () C:\Program Files\WEKA\Kommentierte Betriebsvereinbarungen\webapp\standard\dll\SHINativeUtil.dll
2011-06-16 15:38 - 2009-05-21 03:14 - 00053248 ____N () C:\Program Files\ASUS\AI Suite II\TurboV EVO\HookKey32.dll
2011-06-16 15:38 - 2009-05-21 09:14 - 00253952 _____ () C:\Program Files\ASUS\AI Suite II\TurboV EVO\pngio.dll
2011-06-16 15:36 - 2010-08-23 03:17 - 00662016 ____R () C:\Program Files\ASUS\AAHM\1.00.13\aaHMLib.dll
2011-06-16 15:37 - 2010-12-02 16:28 - 00143360 _____ () C:\Program Files\ASUS\AI Suite II\AssistFunc.dll
2011-06-16 15:37 - 2010-06-21 14:21 - 00208896 _____ () C:\Program Files\ASUS\AI Suite II\ImageHelper.dll
2011-06-16 15:37 - 2009-08-12 19:15 - 00253952 _____ () C:\Program Files\ASUS\AI Suite II\pngio.dll
2011-06-16 15:37 - 2010-11-19 09:53 - 00963584 _____ () C:\Program Files\ASUS\AI Suite II\BarGadget\BarGadget.dll
2011-06-16 15:38 - 2011-01-06 09:38 - 01027072 _____ () C:\Program Files\ASUS\AI Suite II\Probe_II\ProbeII.dll
2011-06-16 15:37 - 2010-09-27 19:51 - 00881664 _____ () C:\Program Files\ASUS\AI Suite II\Sensor\Sensor.dll
2011-06-16 15:37 - 2010-09-27 19:51 - 01607168 _____ () C:\Program Files\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
2011-06-16 15:37 - 2010-11-19 09:55 - 01246208 _____ () C:\Program Files\ASUS\AI Suite II\Settings\Settings.dll
2011-06-16 15:37 - 2010-08-06 17:11 - 00850944 _____ () C:\Program Files\ASUS\AI Suite II\Splitter\Splitter.dll
2011-06-16 15:37 - 2010-08-06 17:13 - 00886272 _____ () C:\Program Files\ASUS\AI Suite II\TabGadget\TabGadget.dll
2011-06-16 15:37 - 2010-06-21 14:21 - 00208896 _____ () C:\Program Files\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:09CD1DC6
AlternateDataStreams: C:\ProgramData\Temp:0C9CD455
AlternateDataStreams: C:\ProgramData\Temp:16A4620C
AlternateDataStreams: C:\ProgramData\Temp:193CB03B
AlternateDataStreams: C:\ProgramData\Temp:1F7A10DD
AlternateDataStreams: C:\ProgramData\Temp:2AE74FF9
AlternateDataStreams: C:\ProgramData\Temp:30E0D641
AlternateDataStreams: C:\ProgramData\Temp:4D551822
AlternateDataStreams: C:\ProgramData\Temp:51E83E25
AlternateDataStreams: C:\ProgramData\Temp:56C66609
AlternateDataStreams: C:\ProgramData\Temp:5BC73C48
AlternateDataStreams: C:\ProgramData\Temp:5E73E1C2
AlternateDataStreams: C:\ProgramData\Temp:603FD11D
AlternateDataStreams: C:\ProgramData\Temp:6DA3BBF2
AlternateDataStreams: C:\ProgramData\Temp:71AEFFEB
AlternateDataStreams: C:\ProgramData\Temp:7ADB695A
AlternateDataStreams: C:\ProgramData\Temp:880F0FEF
AlternateDataStreams: C:\ProgramData\Temp:88AA70D1
AlternateDataStreams: C:\ProgramData\Temp:8FF81EB0
AlternateDataStreams: C:\ProgramData\Temp:90108DD7
AlternateDataStreams: C:\ProgramData\Temp:9C8D5426
AlternateDataStreams: C:\ProgramData\Temp:A3E39C6A
AlternateDataStreams: C:\ProgramData\Temp:A4241298
AlternateDataStreams: C:\ProgramData\Temp:B285A50E
AlternateDataStreams: C:\ProgramData\Temp:BD34FFC5
AlternateDataStreams: C:\ProgramData\Temp:D6D084A5
AlternateDataStreams: C:\ProgramData\Temp:D987CB43
AlternateDataStreams: C:\ProgramData\Temp:DA5888A7
AlternateDataStreams: C:\ProgramData\Temp:E07EA07E
AlternateDataStreams: C:\ProgramData\Temp:E222F217
AlternateDataStreams: C:\ProgramData\Temp:E8C44CB4
AlternateDataStreams: C:\ProgramData\Temp:E9495818
AlternateDataStreams: C:\ProgramData\Temp:F1175E1D
AlternateDataStreams: C:\ProgramData\Temp:F33C37D5
AlternateDataStreams: C:\ProgramData\Temp:F9EDCFB0
AlternateDataStreams: C:\ProgramData\Temp:FBE5FDB9
AlternateDataStreams: C:\ProgramData\Temp:FFEAC7E5
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/08/2014 08:17:11 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (01/08/2014 08:11:59 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/08/2014 06:57:55 AM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.16750 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1498
Startzeit: 01cf0c367a530203
Endzeit: 32
Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
Berichts-ID:
Error: (01/06/2014 01:55:42 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (01/06/2014 01:53:33 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/04/2014 07:04:24 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (01/04/2014 07:02:40 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (01/03/2014 00:51:10 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.16750 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 3594
Startzeit: 01cf0876a8adf6dc
Endzeit: 80
Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
Berichts-ID:
Error: (01/03/2014 00:32:47 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (01/03/2014 00:30:53 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (01/08/2014 06:49:03 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/08/2014 06:14:03 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (01/08/2014 05:40:25 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (01/08/2014 05:40:25 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (01/08/2014 05:36:06 PM) (Source: DCOM) (User: MONSTERDIDI)
Description: AnwendungsspezifischLokalAktivierung{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}MONSTERDIDIAdminS-1-5-21-1507968218-3757338369-1811197512-1000LocalHost (unter Verwendung von LRPC)
Error: (01/08/2014 05:36:06 PM) (Source: DCOM) (User: MONSTERDIDI)
Description: AnwendungsspezifischLokalAktivierung{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}MONSTERDIDIAdminS-1-5-21-1507968218-3757338369-1811197512-1000LocalHost (unter Verwendung von LRPC)
Error: (01/08/2014 05:36:05 PM) (Source: DCOM) (User: MONSTERDIDI)
Description: AnwendungsspezifischLokalAktivierung{B77C4C36-0154-4C52-AB49-FAA03837E47F}{EA022610-0748-4C24-B229-6C507EBDFDBB}MONSTERDIDIAdminS-1-5-21-1507968218-3757338369-1811197512-1000LocalHost (unter Verwendung von LRPC)
Error: (01/08/2014 05:24:56 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (01/08/2014 05:24:56 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (01/08/2014 05:24:56 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 40%
Total physical RAM: 3573.25 MB
Available physical RAM: 2139.92 MB
Total Pagefile: 7144.78 MB
Available Pagefile: 5687.99 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.5 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:195.21 GB) (Free:116.36 GB) NTFS
Drive e: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: () (Fixed) (Total:148.95 GB) (Free:31.69 GB) NTFS
Drive g: (Volume) (Fixed) (Total:736.2 GB) (Free:650.2 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E983747F)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=736 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: F482F482)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
==================== End Of Log ============================
GMER Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-08 19:23:35
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD105SI rev.1AJ10001 931,51GB
Running: 5xcq4ty4.exe; Driver: C:\Users\Admin\AppData\Local\Temp\fwdyifoc.sys
---- System - GMER 2.1 ----
SSDT 874A6718 ZwAlpcConnectPort
SSDT 874A6160 ZwLoadDriver
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 8367FA15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 836B9212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 10FF 836C0494 4 Bytes [18, 67, 4A, 87]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1313 836C06A8 4 Bytes [60, 61, 4A, 87]
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{F0F78DEA-9839-11E0-A56C-806E6F6E6963} 21747449128
---- EOF - GMER 2.1 ----
Das ist erst mal alles was ich bieten kann.
Gruß Dieter |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
