Trojaner-Board - Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefunden

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefunden (https://www.trojaner-board.de/147617-email-ebaykonto-missbraucht-tr-fraud-gen8-tr-crypt-tpm-gen-beim-virenscan-gefunden.html)

Email- und Ebaykonto missbraucht: TR/Fraud.Gen8 und TR/Crypt.TPM.Gen beim Virenscan gefunden

Hallo Trojaner-Board,

ich benötige bitte Eure Hilfe.

Ich habe vor einigen Tagen durch Zufall mitbekommen, dass mein Email- und mein Ebaykonto missbraucht wurden. Es war naheliegend, dass die Täter durch eine Schadsoftware an meine Zugangsdaten gekommen sind.

Der Virenscan hat folgende Trojaner gefunden:
TR/Fraud.Gen8 und TR/Crypt.TPM.Gen.

Das Virenprogramm hat diese gelöscht.

Da ich mir nicht sicher bin, ob der Rechner jetzt tatsächlich wieder sicher und virenfrei ist, habe ich Eure Anleitung befolgt und folgende Scans durchgeführt:
FRST.txt
Addition.txt
Gmer.zip
defogger_disable.txt.

Des Weiteren habe ich den Log mit den Funden von Avira angehangen. Der Scan mit Malwarebytes' Anti Malware ergab keine Funde.

defogger_disable.txt:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 23:58 on 08/01/2014 (*********)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

FRST.txt:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-01-2014 01

Ran by ********* (administrator) on ANGI on 09-01-2014 00:02:10

Running from C:\Users\*********\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe

(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe

(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe

() C:\Users\*********\Desktop\Defogger.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)

HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()

HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [LManager] - [x]

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-06] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)

HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)

AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)

Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com

SearchScopes: HKLM - DefaultScope {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = 

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)

DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Ghostery - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\firefox@ghostery.com.xpi

FF Extension: NoScript - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF Extension: Adblock Plus - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: BetterPrivacy - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2014-01-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)

R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

R2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)

R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-11] (Dritek System INC.)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-07-31] (Atheros)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-01-06] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-01-06] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)

S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)

S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)

S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-11] (Dritek System Inc.)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-09 00:02 - 2014-01-09 00:02 - 00013052 _____ C:\Users\*********\Desktop\FRST.txt

2014-01-09 00:01 - 2014-01-09 00:01 - 00000000 ____D C:\FRST

2014-01-08 23:59 - 2014-01-08 23:59 - 01931770 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe

2014-01-08 23:58 - 2014-01-08 23:58 - 00000480 _____ C:\Users\*********\Desktop\defogger_disable.log

2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable

2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe

2014-01-08 23:39 - 2014-01-08 23:39 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT

2014-01-08 23:36 - 2014-01-08 23:37 - 00000000 ____D C:\AdwCleaner

2014-01-08 23:35 - 2014-01-08 23:35 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe

2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-01-08 21:46 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Windows Live

2014-01-08 21:46 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll

2014-01-08 21:46 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll

2014-01-08 21:46 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll

2014-01-08 21:45 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll

2014-01-08 21:45 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll

2014-01-08 21:42 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live

2014-01-08 21:40 - 2014-01-08 21:41 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe

2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt

2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log

2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe

2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg

2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes

2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-08 17:42 - 2014-01-08 23:43 - 00000000 ____D C:\Program Files (x86)\FileHippo.com

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia

2014-01-06 18:43 - 2014-01-06 18:46 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett

2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
 

==================== One Month Modified Files and Folders =======
 

2014-01-09 00:02 - 2014-01-09 00:02 - 00013052 _____ C:\Users\*********\Desktop\FRST.txt

2014-01-09 00:01 - 2014-01-09 00:01 - 00000000 ____D C:\FRST

2014-01-09 00:00 - 2013-06-23 00:28 - 00003594 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-627669732-214247668-4251278340-1002

2014-01-09 00:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru

2014-01-08 23:59 - 2014-01-08 23:59 - 01931770 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe

2014-01-08 23:58 - 2014-01-08 23:58 - 00000480 _____ C:\Users\*********\Desktop\defogger_disable.log

2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable

2014-01-08 23:58 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********

2014-01-08 23:56 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files\Microsoft Office 15

2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe

2014-01-08 23:43 - 2014-01-08 17:42 - 00000000 ____D C:\Program Files (x86)\FileHippo.com

2014-01-08 23:40 - 2013-08-30 20:49 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-08 23:39 - 2014-01-08 23:39 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT

2014-01-08 23:39 - 2013-06-28 18:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-08 23:39 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-08 23:38 - 2013-06-23 00:21 - 01869891 _____ C:\Windows\WindowsUpdate.log

2014-01-08 23:38 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI

2014-01-08 23:37 - 2014-01-08 23:36 - 00000000 ____D C:\AdwCleaner

2014-01-08 23:35 - 2014-01-08 23:35 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe

2014-01-08 23:31 - 2013-11-30 17:12 - 00000000 ____D C:\ProgramData\Skype

2014-01-08 23:27 - 2013-09-22 10:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-01-08 23:04 - 2013-08-30 20:49 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-01-08 21:47 - 2014-01-08 21:46 - 00000000 ____D C:\Program Files (x86)\Windows Live

2014-01-08 21:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared

2014-01-08 21:42 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live

2014-01-08 21:41 - 2014-01-08 21:40 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe

2014-01-08 21:37 - 2012-10-11 17:27 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9REGET.dll

2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt

2014-01-08 21:34 - 2012-10-11 17:28 - 00001024 ___RH C:\Users\Public\Documents\NTILiveUpdateV9.dll

2014-01-08 21:34 - 2012-10-11 17:27 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9Acer.dll

2014-01-08 21:33 - 2012-10-11 17:28 - 00000000 ____D C:\ProgramData\NTI Launcher

2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log

2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe

2014-01-08 20:24 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********\AppData\Local\VirtualStore

2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg

2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes

2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-08 17:47 - 2013-12-01 11:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-08 17:41 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent

2014-01-08 17:36 - 2013-10-31 16:01 - 00000000 ____D C:\Users\*********\AppData\Local\CrashDumps

2014-01-08 17:36 - 2012-09-03 12:56 - 00000000 ____D C:\Windows\Panther

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia

2014-01-06 18:57 - 2013-06-22 19:01 - 00000000 ____D C:\Users\*********\AppData\Roaming\vlc

2014-01-06 18:46 - 2014-01-06 18:43 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett

2014-01-06 18:42 - 2012-10-12 02:44 - 00753134 _____ C:\Windows\system32\perfh007.dat

2014-01-06 18:42 - 2012-10-12 02:44 - 00155826 _____ C:\Windows\system32\perfc007.dat

2014-01-06 18:42 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI

2014-01-06 17:27 - 2013-09-22 10:48 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk

2014-01-06 16:58 - 2013-08-30 20:49 - 00000000 ____D C:\Program Files (x86)\Google

2014-01-06 16:58 - 2013-06-23 20:19 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-01-06 16:58 - 2013-06-23 20:14 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-01-06 16:58 - 2013-06-23 20:14 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-01-06 16:55 - 2013-08-05 18:13 - 00000000 ___RD C:\Users\*********\Dropbox

2014-01-06 16:55 - 2013-08-05 18:10 - 00000000 ____D C:\Users\*********\AppData\Roaming\Dropbox
 

Some content of TEMP:

====================

C:\Users\*********\AppData\Local\Temp\avgnt.exe

C:\Users\*********\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-06 22:55
 

==================== End Of Log ============================

Addition.txt:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-01-2014 01

Ran by ********* at 2014-01-09 00:02:39

Running from C:\Users\*********\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

 clear.fi SDK - Video 2 (x32 Version: 2.1.1925 - CyberLink Corp.) Hidden

 clear.fi SDK- Movie 2 (x32 Version: 2.1.2008 - CyberLink Corp.) Hidden

Acer Backup Manager (x32 Version: 4.0.0.0059 - NTI Corporation)

Acer Device Fast-lane (Version: 1.00.3007 - Acer Incorporated)

Acer Instant Update Service (Version: 1.00.3013 - Acer Incorporated)

Acer Power Management (Version: 7.00.3006 - Acer Incorporated)

Acer Recovery Management (Version: 6.00.3011 - Acer Incorporated)

AcerCloud (x32 Version: 2.01.3115 - Acer Incorporated)

AcerCloud Docs (x32 Version: 1.00.3201 - Acer Incorporated)

Adobe AIR (x32 Version: 3.7.0.2090 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.7.0.2090 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)

Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)

Backup Manager v4 (x32 Version: 4.0.0.0059 - NTI Corporation) Hidden

Broadcom Card Reader Driver Installer (Version: 15.4.7.1 - Broadcom Corporation)

clear.fi Media (x32 Version: 2.01.3108 - Acer Incorporated)

clear.fi Photo (x32 Version: 2.01.3108 - Acer Incorporated)

CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.)

CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3103_44819 - CyberLink Corp.) Hidden

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

dm-Fotowelt (x32 Version: 5.0.4 - CEWE COLOR AG u Co. OHG)

Dolby Home Theater v4 (x32 Version: 7.2.8000.13 - Dolby Laboratories Inc)

Dropbox (HKCU Version: 2.2.13 - Dropbox, Inc.)

ETDWare PS/2-X64 11.6.8.001_WHQL (Version: 11.6.8.001 - ELAN Microelectronic Corp.)

Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

GIMP 2.8.6 (Version: 2.8.6 - The GIMP Team)

Google Earth (x32 Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden

Identity Card (x32 Version: 2.00.3004 - Acer Incorporated)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.0.1207 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Launch Manager (x32 Version: 7.0.5 - Acer Inc.)

Live Updater (x32 Version: 2.00.3004 - Acer Incorporated)

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Office 365 Home Premium - de-de (Version: 15.0.4551.1011 - Microsoft Corporation)

Microsoft SkyDrive (HKCU Version: 17.0.2003.1112 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)

Mozilla Thunderbird 24.1.1 (x86 de) (x32 Version: 24.1.1 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

MyWinLocker (Version: 4.0.14.35 - Egis Technology Inc.) Hidden

MyWinLocker 4 (x32 Version: 4.0.14.35 - Egis Technology Inc.) Hidden

MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.)

MyWinLocker Suite (x32 Version: 4.0.14.24 - Egis Technology Inc.) Hidden

NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation)

NTI Media Maker 9 (x32 Version: 9.0.2.9008 - NTI Corporation) Hidden

NVIDIA Grafiktreiber 306.97 (Version: 306.97 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.85.551 - NVIDIA Corporation) Hidden

NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.12.0613 - NVIDIA Corporation) Hidden

NVIDIA PhysX-Systemsoftware 9.12.0613 (Version: 9.12.0613 - NVIDIA Corporation)

NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden

NVIDIA Update 1.10.8 (Version: 1.10.8 - NVIDIA Corporation)

NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1011 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1011 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1011 - Microsoft Corporation) Hidden

Office Addin (x32 Version: 2.01.3200 - Acer)

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)

Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.206 - Ihr Firmenname)

Qualcomm Atheros WiFi Driver Installation (x32 Version: 11.05 - Qualcomm Atheros)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6657 - Realtek Semiconductor Corp.)

Saal Design Software (x32 Version: 3.1.26 - SSW Software GmbH)

Saal Design Software (x32 Version: 3.1.26 - SSW Software GmbH) Hidden

Shared C Run-time for x64 (Version: 10.0.0 - McAfee)

Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden

Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden

Spotify (x32 Version: 0.8.4.99.ga249b5f1 - Spotify AB)

Visual Studio 2005 Tools for Office Second Edition Runtime (x32 Version:  - Microsoft Corporation)

Visual Studio Tools for the Office system 3.0 Runtime (x32 Version:  - Microsoft Corporation)

Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden

Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (x32 Version: 1 - Microsoft Corporation)

VLC media player 2.0.7 (x32 Version: 2.0.7 - VideoLAN)

Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
 

==================== Restore Points  =========================
 

30-11-2013 16:20:51 Geplanter Prüfpunkt

06-01-2014 22:31:32 Geplanter Prüfpunkt

08-01-2014 20:42:35 Windows Live Essentials

08-01-2014 20:44:59 DirectX wurde installiert
 

==================== Hosts content: ==========================
 

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {1C5FFE65-693F-4FF6-B38B-7BB11A6BE63E} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-01-06] (Microsoft Corporation)

Task: {1F069D73-D2DA-4AAF-A370-6B1C036D7A3D} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.)

Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {356FB18C-819E-4EDA-A16B-7FDC6D1C607F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30] (Google Inc.)

Task: {3B04812C-632E-440A-9B5B-B3AEF5B353AF} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-22] ()

Task: {93FBD9F6-5C1F-4B2F-840C-7D2248B7EAF7} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated)

Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {AC55B1E4-5529-46F4-A4BB-ED179CA6C012} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-11-02] (Microsoft Corporation)

Task: {B7FF15ED-EA7E-4BD3-861B-A8B8547E91C3} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2012-07-04] (CyberLink)

Task: {C29914B2-FB69-4A6D-ADCA-C1C36A633DD5} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] ()

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {CEDAB060-F54A-42B8-BFD4-65CDCA82D8CE} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PmmUpdate.exe [2012-07-12] (Egis Technology Inc.)

Task: {D006E8A2-BFD0-4652-AB90-5D00FE4B91F3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30] (Google Inc.)

Task: {E1B232EC-44E8-4A4C-974B-D2ECB59CF591} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-22] ()

Task: {E3A2E92C-8A5E-469E-83FB-DFCC1F111F33} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()

Task: {E93B81FF-7E59-4CB3-85D0-CB8E5CF6B286} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-06] (Adobe Systems Incorporated)

Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-06-22 02:12 - 2012-06-22 02:12 - 01407568 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll

2012-09-03 12:50 - 2012-08-08 16:48 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-08-10 17:28 - 2012-08-10 17:28 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll

2012-08-10 17:23 - 2012-08-10 17:23 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll

2013-06-23 20:14 - 2013-01-25 09:25 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2012-08-23 07:26 - 2012-08-23 07:26 - 00465384 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll

2012-08-23 07:25 - 2012-08-23 07:25 - 00125504 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll

2012-08-23 07:26 - 2012-08-23 07:26 - 00155712 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\VolumeSnapshot.dll

2012-08-23 07:25 - 2012-08-23 07:25 - 00118336 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\Online.dll

2012-08-23 07:25 - 2012-08-23 07:25 - 01081408 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll

2012-08-23 07:25 - 2012-08-23 07:25 - 00052288 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OsSettingPort.dll

2012-08-23 07:26 - 2012-08-23 07:26 - 00727616 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OutlookShadow.dll

2012-10-11 17:06 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2013-12-01 11:25 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 

Name: Bluetooth USB Module

Description: Bluetooth USB Module

Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}

Manufacturer: Qualcomm Atheros Communications

Service: BTHUSB

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/08/2014 11:57:25 PM) (Source: Application Hang) (User: )

Description: Programm soffice.bin, Version 3.4.9593.500 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 718
 

Startzeit: 01cf0cc4be9b5ae5
 

Endzeit: 0
 

Anwendungspfad: C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
 

Berichts-ID: 38bb39a2-78b8-11e3-bea3-b888e3a652b8
 

Vollständiger Name des fehlerhaften Pakets: 
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
 

Error: (01/08/2014 11:39:48 PM) (Source: ETDService) (User: )

Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
 

Error: (01/08/2014 09:45:39 PM) (Source: Microsoft-Windows-CAPI2) (User: )

Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
 
 

Details:

AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed
 

System Error:

Das System kann die angegebene Datei nicht finden.

.
 

Error: (01/08/2014 09:43:58 PM) (Source: Microsoft-Windows-CAPI2) (User: )

Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
 
 

Details:

AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed
 

System Error:

Das System kann die angegebene Datei nicht finden.

.
 

Error: (01/08/2014 08:37:40 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
 

Error: (01/08/2014 07:53:06 PM) (Source: Office 2013 Licensing Service) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (01/08/2014 06:55:36 PM) (Source: Application Hang) (User: )

Description: Programm iuEmailOutlookAgent.exe, Version 1.0.3013.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 11c8
 

Startzeit: 01cf0af7ecb5c314
 

Endzeit: 188
 

Anwendungspfad: C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
 

Berichts-ID: f4d64800-788d-11e3-bea2-b888e3a652b8
 

Vollständiger Name des fehlerhaften Pakets: 
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
 

Error: (01/08/2014 05:21:05 PM) (Source: Office 2013 Licensing Service) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (01/06/2014 10:21:31 PM) (Source: Office 2013 Licensing Service) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (01/06/2014 04:52:44 PM) (Source: ETDService) (User: )

Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
 
 

System errors:

=============

Error: (01/06/2014 04:52:44 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (12/06/2013 00:24:59 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (12/06/2013 10:10:22 AM) (Source: DCOM) (User: Angi)

Description: App.wwa
 

Error: (12/06/2013 10:08:17 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (12/02/2013 08:53:27 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (12/01/2013 11:24:34 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst defragsvc erreicht.
 

Error: (11/30/2013 04:41:52 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (11/30/2013 00:11:30 AM) (Source: Tcpip) (User: )

Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.0.101 mit dem Computer mit der

Netzwerkhardwareadresse 88-30-8A-7D-B1-43 ermittelt. Netzwerkvorgänge könnten daher auf diesem

System unterbrochen werden.
 

Error: (11/29/2013 09:06:10 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (11/29/2013 07:19:39 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 
 

Microsoft Office Sessions:

=========================

Error: (01/08/2014 11:57:25 PM) (Source: Application Hang)(User: )

Description: soffice.bin3.4.9593.50071801cf0cc4be9b5ae50C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin38bb39a2-78b8-11e3-bea3-b888e3a652b8
 

Error: (01/08/2014 11:39:48 PM) (Source: ETDService)(User: )

Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
 

Error: (01/08/2014 09:45:39 PM) (Source: Microsoft-Windows-CAPI2)(User: )

Description: 

Details:

AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed
 

System Error:

Das System kann die angegebene Datei nicht finden.
 

Error: (01/08/2014 09:43:58 PM) (Source: Microsoft-Windows-CAPI2)(User: )

Description: 

Details:

AddWin32ServiceFiles: Unable to back up image of service McAfee SiteAdvisor Service since QueryServiceConfig API failed
 

System Error:

Das System kann die angegebene Datei nicht finden.
 

Error: (01/08/2014 08:37:40 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\*********\AppData\Local\Temp\IDC2.tmp\ESETSmartInstaller.exe
 

Error: (01/08/2014 07:53:06 PM) (Source: Office 2013 Licensing Service)(User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (01/08/2014 06:55:36 PM) (Source: Application Hang)(User: )

Description: iuEmailOutlookAgent.exe1.0.3013.011c801cf0af7ecb5c314188C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exef4d64800-788d-11e3-bea2-b888e3a652b8
 

Error: (01/08/2014 05:21:05 PM) (Source: Office 2013 Licensing Service)(User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (01/06/2014 10:21:31 PM) (Source: Office 2013 Licensing Service)(User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (01/06/2014 04:52:44 PM) (Source: ETDService)(User: )

Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 23%

Total physical RAM: 8007.27 MB

Available physical RAM: 6164.89 MB

Total Pagefile: 9223.27 MB

Available Pagefile: 7239.14 MB

Total Virtual: 8192 MB

Available Virtual: 8191.75 MB
 

==================== Drives ================================
 

Drive c: (Acer) (Fixed) (Total:913.19 GB) (Free:531.86 GB) NTFS

Drive e: (My Passport) (Fixed) (Total:298.02 GB) (Free:249.26 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 932 GB) (Disk ID: 6B73424A)
 

Partition: GPT Partition Type

========================================================

Disk: 1 (Size: 298 GB) (Disk ID: B13D6473)

Partition 1: (Not Active) - (Size=298 GB) - (Type=0C)
 

==================== End Of Log ============================

Gmer.txt:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2014-01-09 00:14:08

Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000039 ST1000LM024_HN-M101MBB rev.2AR10001 931,51GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\******~1\AppData\Local\Temp\uglorpod.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text   C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                     000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                     000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\dwm.exe[492] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                   000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                        000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                        000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[336] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                      000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!GradientFill + 690                                                  000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!GradientFill + 698                                                  000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246                                                000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                        000007f81fa8177a 4 bytes [A8, 1F, F8, 07]

.text   C:\Windows\system32\nvvsvc.exe[128] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                        000007f81fa81782 4 bytes [A8, 1F, F8, 07]

.text   C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                             000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                             000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\taskhostex.exe[2712] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                           000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                          000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                          000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Elantech\ETDCtrl.exe[3080] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                        000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                        000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                        000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                      000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742                                                            000007f80e581b32 4 bytes [58, 0E, F8, 07]

.text   C:\Windows\Explorer.EXE[3212] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750                                                            000007f80e581b3a 4 bytes [58, 0E, F8, 07]

.text   C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                          000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                          000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\wbem\unsecapp.exe[3708] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                        000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                    000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                    000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[3720] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                  000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                             000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                             000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                           000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\igfxext.exe[3820] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                              000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                         000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                         000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1868] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                       000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                               000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                               000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\igfxtray.exe[1624] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                             000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                  000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                  000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\hkcmd.exe[1404] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                     000007f81fa8177a 4 bytes [A8, 1F, F8, 07]

.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                     000007f81fa81782 4 bytes [A8, 1F, F8, 07]

.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                               000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                               000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\System32\igfxpers.exe[4084] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                             000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                 000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[236] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                               000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                 000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                 000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2200] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                               000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                       000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                       000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Dolby PCEE4\pcee4.exe[4548] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                     000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4920] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306            000007f81fa8177a 4 bytes [A8, 1F, F8, 07]

.text   C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[4920] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314            000007f81fa81782 4 bytes [A8, 1F, F8, 07]

.text   C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                               000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                               000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\igfxsrvc.exe[4980] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                             000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                          000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                          000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Windows\system32\wbem\unsecapp.exe[5008] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                        000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                    000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                    000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[5036] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                  000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                              000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                              000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[1148] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                            000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                            000007f81ad61532 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                            000007f81ad6153a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                          000007f81ad6165a 4 bytes [D6, 1A, F8, 07]

.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742                                000007f80e581b32 4 bytes [58, 0E, F8, 07]

.text   C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[1944] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750                                000007f80e581b3a 4 bytes [58, 0E, F8, 07]

.text   C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe[2132] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306  000007f81fa8177a 4 bytes [A8, 1F, F8, 07]

.text   C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe[2132] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314  000007f81fa81782 4 bytes [A8, 1F, F8, 07]
 

---- Threads - GMER 2.1 ----
 

Thread  C:\Windows\system32\csrss.exe [592:636]                                                                                                 fffff960009235e8
 

---- Disk sectors - GMER 2.1 ----
 

Disk    \Device\Harddisk0\DR0                                                                                                                   unknown MBR code
 

---- EOF - GMER 2.1 ----

avira.txt:

Code:

Exportierte Ereignisse:
 

08.01.2014 17:11 [System-Scanner] Malware gefunden

      Die Datei 

      'C:\Users\*********\Desktop\Festplatte\Magix.Fotos.auf.CD.und.DVD.Deluxe.6.5.Ger

      man.DVD-RESTORE\mfotos65dlx\RESTORE\scheduler.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Fraud.Gen8' [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde gelöscht.
 

08.01.2014 17:11 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\*********\Desktop\Festplatte\Ansys\MAGNiTUDE\a11calc.exe'

      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.TPM.Gen' [trojan].

      Durchgeführte Aktion(en):

      Die Datei wurde gelöscht.

Ich hoffe Ihr könnt mir weiterhelfen.
Vielen Dank schon einmal.:dankeschoen:

Viele Grüße
anwo

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo schrauber,

vielen Dank für deine Antwort.

Hier die Combofix.txt:

Code:

ComboFix 14-01-08.03 - ********* 09.01.2014  13:44:16.1.4 - x64

Microsoft Windows 8  6.2.9200.0.1252.49.1031.18.8007.6536 [GMT 1:00]

ausgeführt von:: c:\users\*********\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\*********\AppData\Local\assembly\tmp

c:\users\Public\Documents\NTILiveUpdateV9.dll

c:\users\Public\Documents\NTIMMV9Acer.dll

c:\users\Public\Documents\NTIMMV9REGET.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-12-09 bis 2014-01-09  ))))))))))))))))))))))))))))))

.

.

2014-01-09 12:38 . 2013-12-03 18:28        10315576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{42212923-B9F7-4788-9332-A40749E27AA9}\mpengine.dll

2014-01-09 12:38 . 2013-11-19 10:21        267936        ------w-        c:\windows\system32\MpSigStub.exe

2014-01-09 01:28 . 2014-01-09 01:28        --------        d-----w-        c:\program files (x86)\HyperCam 2

2014-01-08 23:01 . 2014-01-08 23:01        --------        d-----w-        C:\FRST

2014-01-08 22:36 . 2014-01-08 22:37        --------        d-----w-        C:\AdwCleaner

2014-01-08 20:48 . 2014-01-08 20:48        --------        d-----w-        c:\windows\de

2014-01-08 20:47 . 2014-01-08 20:47        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server Compact Edition

2014-01-08 20:47 . 2014-01-08 20:47        --------        d-----w-        c:\windows\PCHEALTH

2014-01-08 20:46 . 2014-01-08 20:47        --------        d-----w-        c:\program files (x86)\Windows Live

2014-01-08 20:46 . 2010-06-02 03:55        77656        ----a-w-        c:\windows\system32\XAPOFX1_5.dll

2014-01-08 20:46 . 2010-06-02 03:55        74072        ----a-w-        c:\windows\SysWow64\XAPOFX1_5.dll

2014-01-08 20:46 . 2010-06-02 03:55        527192        ----a-w-        c:\windows\SysWow64\XAudio2_7.dll

2014-01-08 20:46 . 2010-06-02 03:55        518488        ----a-w-        c:\windows\system32\XAudio2_7.dll

2014-01-08 20:46 . 2010-05-26 10:41        2526056        ----a-w-        c:\windows\system32\D3DCompiler_43.dll

2014-01-08 20:46 . 2010-05-26 10:41        2106216        ----a-w-        c:\windows\SysWow64\D3DCompiler_43.dll

2014-01-08 20:46 . 2010-05-26 10:41        276832        ----a-w-        c:\windows\system32\d3dx11_43.dll

2014-01-08 20:46 . 2010-05-26 10:41        248672        ----a-w-        c:\windows\SysWow64\d3dx11_43.dll

2014-01-08 20:46 . 2009-09-04 16:29        453456        ----a-w-        c:\windows\SysWow64\d3dx10_42.dll

2014-01-08 20:46 . 2009-09-04 16:29        523088        ----a-w-        c:\windows\system32\d3dx10_42.dll

2014-01-08 20:45 . 2006-11-29 12:06        4398360        ----a-w-        c:\windows\system32\d3dx9_32.dll

2014-01-08 20:45 . 2006-11-29 12:06        3426072        ----a-w-        c:\windows\SysWow64\d3dx9_32.dll

2014-01-08 20:42 . 2014-01-09 00:39        --------        d-----w-        c:\users\*********\AppData\Local\Windows Live

2014-01-08 20:42 . 2014-01-08 20:42        --------        d-----w-        c:\program files (x86)\Common Files\Windows Live

2014-01-08 20:34 . 2014-01-08 20:34        --------        d-----w-        c:\programdata\NTIRegEt

2014-01-08 17:00 . 2014-01-08 17:00        --------        d-----w-        c:\users\*********\AppData\Roaming\Malwarebytes

2014-01-08 16:59 . 2014-01-08 16:59        --------        d-----w-        c:\programdata\Malwarebytes

2014-01-08 16:47 . 2013-12-05 19:41        272496        ----a-w-        c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll

2014-01-08 16:42 . 2014-01-08 22:43        --------        d-----w-        c:\program files (x86)\FileHippo.com

2014-01-08 16:30 . 2014-01-08 16:30        --------        d-----w-        c:\users\*********\AppData\Local\Secunia PSI

2014-01-08 16:30 . 2014-01-08 16:30        --------        d-----w-        c:\program files (x86)\Secunia

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-01-06 16:11 . 2013-08-13 19:58        566480        ----a-w-        c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

2014-01-06 15:58 . 2013-06-23 19:19        84720        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2014-01-06 15:58 . 2013-06-23 19:14        131576        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2014-01-06 15:58 . 2013-06-23 19:14        108440        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-11-27 22:14 . 2013-06-23 19:14        28600        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2013-08-13 20:07        222712        ----a-w-        c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2013-08-13 20:07        222712        ----a-w-        c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2013-08-13 20:07        222712        ----a-w-        c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-08-03 00:56        130736        ----a-w-        c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-08-03 00:56        130736        ----a-w-        c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-08-03 00:56        130736        ----a-w-        c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dolby Home Theater v4"="c:\dolby pcee4\pcee4.exe" [2012-04-23 508256]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-01-06 684600]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"IsMyWinLockerReboot"="msiexec.exe" [2012-07-26 62976]

.

c:\users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-8-3 28057256]

OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\

Acer Backup Manager Tray.lnk - c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe -h -k [2012-8-23 533568]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"EnableCursorSuppression"= 1 (0x1)

"ConsentPromptBehaviorUser"= 3 (0x3)

"DisableCAD"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]

R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]

R3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]

R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\System32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]

R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]

R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\System32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x]

R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]

R3 BthLEEnum;Treiber für energiearme Bluetooth-Geräte;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]

R3 DeviceFastLaneService;Device Fast-lane Service;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [x]

R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]

R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]

S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]

S2 BrcmCardReader;Broadcom Card Reader Service;c:\program files\Broadcom\MemoryCard\BrcmCardReader.exe;c:\program files\Broadcom\MemoryCard\BrcmCardReader.exe [x]

S2 CCDMonitorService;CCDMonitorService;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [x]

S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]

S2 ETDService;Elan Service;c:\program files\Elantech\ETDService.exe;c:\program files\Elantech\ETDService.exe [x]

S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]

S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]

S2 OfficeSvc;Microsoft Office-Dienst;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe [x]

S2 RfButtonDriverService;Dritek RF Button Command Service;c:\windows\RfBtnSvc64.exe;c:\windows\RfBtnSvc64.exe [x]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S2 ZAtheros Wlan Agent;ZAtheros Wlan Agent;c:\program files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe;c:\program files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [x]

S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\System32\drivers\b57xdbd.sys;c:\windows\SYSNATIVE\drivers\b57xdbd.sys [x]

S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\System32\drivers\b57xdmp.sys;c:\windows\SYSNATIVE\drivers\b57xdmp.sys [x]

S3 bScsiMSa;bScsiMSa;c:\windows\System32\drivers\bScsiMSa.sys;c:\windows\SYSNATIVE\drivers\bScsiMSa.sys [x]

S3 bScsiSDa;bScsiSDa;c:\windows\System32\drivers\bScsiSDa.sys;c:\windows\SYSNATIVE\drivers\bScsiSDa.sys [x]

S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\System32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]

S3 ePowerSvc;ePower Service;c:\program files\Acer\Acer Power Management\ePowerSvc.exe;c:\program files\Acer\Acer Power Management\ePowerSvc.exe [x]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]

S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 k57nd60a;Broadcom NetLink (TM)-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]

S3 Ps2Kb2Hid;PS/2 Keyboard to HID Driver;c:\windows\System32\drivers\aPs2Kb2Hid.sys;c:\windows\SYSNATIVE\drivers\aPs2Kb2Hid.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2014-01-09 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-23 16:27]

.

2014-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30 19:49]

.

2014-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-30 19:49]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2013-08-13 20:07        261624        ----a-w-        c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2013-08-13 20:07        261624        ----a-w-        c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2013-08-13 20:07        261624        ----a-w-        c:\users\*********\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2014-01-06 16:12        2331336        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2014-01-06 16:12        2331336        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2014-01-06 16:12        2331336        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-08-03 00:56        164016        ----a-w-        c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-08-03 00:56        164016        ----a-w-        c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-08-03 00:56        164016        ----a-w-        c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-08-03 00:56        164016        ----a-w-        c:\users\*********\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-08-08 170304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-08-08 398656]

"Persistence"="c:\windows\system32\igfxpers.exe" [2012-08-08 440640]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]

"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-06-07 1212048]

"BtPreLoad"="c:\program files (x86)\Bluetooth Suite\BtPreLoad.exe" [2012-08-10 64640]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\windows\System32\nvinitx.dll

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = https://www.google.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.0.1

FF - ProfilePath - c:\users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\

FF - ExtSQL: 2014-01-08 17:39; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF - ExtSQL: 2014-01-08 17:40; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-LManager - (no file)

Toolbar-Locked - (no file)

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]

@Denied: (A) (Everyone)

"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]

"Key"="ActionsPane"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

@SACL=(02 0000)

.

Zeit der Fertigstellung: 2014-01-09  13:49:15

ComboFix-quarantined-files.txt  2014-01-09 12:49

.

Vor Suchlauf: 11 Verzeichnis(se), 567.488.360.448 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 567.147.814.912 Bytes frei

.

- - End Of File - - BE55BE7B761D07BF142D403CC201BE8B

Des Weiteren kam von Avira trotz Deaktivierung noch folgende Warnung:

Code:

Exportierte Ereignisse:
 

09.01.2014 13:42 [Echtzeit-Scanner] Registry blockiert

      Der Administrator hat per Sicherheitsrichtlinie den Zugriff auf die Registry 

      blockiert.

Weiterhin vielen Dank und viele Grüße
anwo

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo,

hier sind die neuen Logs.

mbam.txt:

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2014.01.10.08
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16660

********* :: **** [Administrator]
 

10.01.2014 23:23:04

mbam-log-2014-01-10 (23-23-04).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 238257

Laufzeit: 3 Minute(n), 5 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

AdwCleaner[S1].txt:

Code:

# AdwCleaner v3.016 - Bericht erstellt am 12/01/2014 um 14:43:04

# Aktualisiert 23/12/2013 von Xplode

# Betriebssystem : Windows 8  (64 bits)

# Benutzername : ********* - ****

# Gestartet von : C:\Users\*********\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16660
 
 

-\\ Mozilla Firefox v26.0 (de)
 

[ Datei : C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [962 octets] - [08/01/2014 23:36:54]

AdwCleaner[R1].txt - [903 octets] - [11/01/2014 09:51:19]

AdwCleaner[R2].txt - [962 octets] - [12/01/2014 14:38:45]

AdwCleaner[S0].txt - [1022 octets] - [08/01/2014 23:37:39]

AdwCleaner[S1].txt - [884 octets] - [12/01/2014 14:43:04]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [943 octets] ##########

JRT.txt:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.0 (01.07.2014:1)

OS: Windows 8 x64

Ran by ********* on 12.01.2014 at 14:52:30,89

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\*********\AppData\Roaming\mozilla\firefox\profiles\yahdabz0.default\minidumps [33 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 12.01.2014 at 14:56:19,55

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Und ein neues FRST Log:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2014

Ran by ********* (administrator) on **** on 12-01-2014 15:00:59

Running from C:\Users\*********\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe

(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)

HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()

HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-06] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)

AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)

Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = 

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Ghostery - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\firefox@ghostery.com.xpi [2013-08-20]

FF Extension: NoScript - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-08]

FF Extension: Adblock Plus - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-08]

FF Extension: BetterPrivacy - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-06-23]

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
 

==================== Services (Whitelisted) =================
 

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2014-01-06] (Avira Operations GmbH & Co. KG)

U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)

U2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)

U2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

U2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

U3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

U3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

U2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.)

U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

U2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

U2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)

U2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-11] (Dritek System INC.)

U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

U2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-07-31] (Atheros)
 

==================== Drivers (Whitelisted) ====================
 

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-01-06] (Avira Operations GmbH & Co. KG)

U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-01-06] (Avira Operations GmbH & Co. KG)

U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)

U3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)

U3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)

U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

U3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-11] (Dritek System Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

U3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-12 15:00 - 2014-01-12 15:00 - 00000000 ____D C:\Users\*********\Desktop\FRST-OlderVersion

2014-01-12 14:56 - 2014-01-12 14:56 - 00000752 _____ C:\Users\*********\Desktop\JRT.txt

2014-01-12 14:52 - 2014-01-12 14:52 - 00000000 ____D C:\Windows\ERUNT

2014-01-12 14:51 - 2014-01-12 14:51 - 01037068 _____ (Thisisu) C:\Users\*********\Desktop\JRT.exe

2014-01-12 14:43 - 2014-01-12 14:48 - 00001022 _____ C:\Users\*********\Desktop\AdwCleaner[S1].txt

2014-01-12 14:37 - 2014-01-12 14:37 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe

2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setuperr.log

2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setupact.log

2014-01-11 19:15 - 2014-01-11 19:52 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett - Kopie

2014-01-10 23:12 - 2014-01-10 23:12 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-10 23:12 - 2014-01-10 23:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-10 23:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-01-10 22:52 - 2014-01-10 22:53 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\*********\Desktop\mbam-setup-1.75.0.1300.exe

2014-01-10 21:54 - 2014-01-10 21:55 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT

2014-01-09 14:10 - 2014-01-09 14:10 - 00000378 _____ C:\Users\*********\Desktop\Avira_2.text

2014-01-09 13:49 - 2014-01-09 14:15 - 00021066 _____ C:\Users\*********\Desktop\ComboFix.txt

2014-01-09 13:42 - 2014-01-09 13:49 - 00000000 ____D C:\Qoobox

2014-01-09 13:42 - 2014-01-09 13:48 - 00000000 ____D C:\Windows\erdnt

2014-01-09 13:42 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2014-01-09 13:42 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2014-01-09 13:42 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2014-01-09 13:38 - 2013-11-19 11:21 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-01-09 13:36 - 2014-01-09 13:36 - 05162489 ____R (Swearware) C:\Users\*********\Desktop\ComboFix.exe

2014-01-09 02:55 - 2014-01-09 02:55 - 212230516 _____ C:\Users\*********\Documents\clip0008.avi

2014-01-09 02:52 - 2014-01-09 02:53 - 224291418 _____ C:\Users\*********\Documents\clip0007.avi

2014-01-09 02:50 - 2014-01-09 02:51 - 156283886 _____ C:\Users\*********\Documents\clip0006.avi

2014-01-09 02:49 - 2014-01-09 02:49 - 149440834 _____ C:\Users\*********\Documents\clip0005.avi

2014-01-09 02:46 - 2014-01-09 02:47 - 110648088 _____ C:\Users\*********\Documents\clip0004.avi

2014-01-09 02:43 - 2014-01-09 02:43 - 109383106 _____ C:\Users\*********\Documents\clip0003.avi

2014-01-09 02:36 - 2014-01-09 02:37 - 153556170 _____ C:\Users\*********\Documents\clip0002.avi

2014-01-09 02:28 - 2014-01-09 02:28 - 05401856 _____ C:\Users\*********\Downloads\HC228SetDE.exe

2014-01-09 02:28 - 2014-01-09 02:28 - 00000925 _____ C:\Users\*********\Desktop\HyperCam 2.lnk

2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2

2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Program Files (x86)\HyperCam 2

2014-01-09 02:08 - 2014-01-09 02:08 - 00087414 _____ C:\Users\*********\Desktop\FRA-DOH.kmz

2014-01-09 01:28 - 2013-08-10 06:21 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll

2014-01-09 01:28 - 2013-08-10 06:21 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncInfo.dll

2014-01-09 01:28 - 2013-08-10 04:58 - 00356352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll

2014-01-09 01:28 - 2013-08-02 07:28 - 19758080 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-01-09 01:28 - 2013-08-02 07:28 - 10116608 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll

2014-01-09 01:28 - 2013-08-02 07:28 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2014-01-09 01:28 - 2013-08-02 07:26 - 02304512 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-01-09 01:28 - 2013-08-02 06:08 - 17561088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-01-09 01:28 - 2013-08-02 06:08 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll

2014-01-09 01:28 - 2013-08-02 06:08 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll

2014-01-09 01:28 - 2013-08-02 06:06 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-01-09 01:28 - 2013-08-01 11:41 - 02233688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-01-09 01:28 - 2013-07-25 00:10 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mbsmsapi.dll

2014-01-09 01:28 - 2013-07-25 00:06 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\mbsmsapi.dll

2014-01-09 01:28 - 2013-04-10 00:17 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll

2014-01-09 01:28 - 2013-04-09 23:29 - 00893952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll

2014-01-09 01:27 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-01-09 01:27 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-01-09 01:27 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll

2014-01-09 01:27 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-01-09 01:27 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-01-09 01:27 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-01-09 01:27 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-01-09 01:27 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-01-09 01:27 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-01-09 01:27 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-01-09 01:27 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-01-09 01:27 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-01-09 01:27 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-01-09 01:27 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys

2014-01-09 01:27 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL

2014-01-09 01:27 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL

2014-01-09 01:27 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-01-09 01:27 - 2013-08-03 07:40 - 01374208 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll

2014-01-09 01:27 - 2013-08-03 07:40 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll

2014-01-09 01:27 - 2013-08-03 07:40 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx

2014-01-09 01:27 - 2013-08-03 06:14 - 00399360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx

2014-01-09 01:27 - 2013-08-03 06:13 - 01245696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll

2014-01-09 01:27 - 2013-08-03 06:13 - 00437248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll

2014-01-09 01:27 - 2013-07-05 23:02 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys

2014-01-09 01:27 - 2013-07-05 23:01 - 00210560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys

2014-01-09 01:27 - 2013-06-22 06:45 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys

2014-01-09 01:27 - 2013-06-22 06:45 - 00054488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys

2014-01-09 01:27 - 2013-05-15 23:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll

2014-01-09 01:27 - 2013-05-15 23:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll

2014-01-09 01:27 - 2013-05-14 14:14 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-01-09 01:27 - 2013-05-14 10:23 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-01-09 01:27 - 2013-02-21 11:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-01-09 01:27 - 2013-02-21 11:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-01-09 01:27 - 2013-02-21 11:29 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-01-09 01:27 - 2013-02-21 11:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-01-09 01:27 - 2013-02-21 11:14 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-01-09 01:27 - 2013-02-21 11:14 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-01-09 01:27 - 2013-02-19 10:53 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll

2014-01-09 01:27 - 2012-11-08 05:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-01-09 01:27 - 2012-11-08 05:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-01-09 01:26 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll

2014-01-09 01:26 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll

2014-01-09 01:26 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll

2014-01-09 01:26 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll

2014-01-09 01:26 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys

2014-01-09 01:26 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll

2014-01-09 01:26 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll

2014-01-09 01:26 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys

2014-01-09 01:26 - 2013-08-16 06:21 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-01-09 01:26 - 2013-08-16 06:21 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-01-09 01:26 - 2013-08-15 23:43 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-01-09 01:26 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys

2014-01-09 01:26 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-01-09 01:26 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-01-09 01:26 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll

2014-01-09 01:26 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll

2014-01-09 01:26 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll

2014-01-09 01:26 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll

2014-01-09 01:26 - 2013-07-06 01:15 - 00652288 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2014-01-09 01:26 - 2013-07-04 03:13 - 00541696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll

2014-01-09 01:26 - 2013-07-01 23:14 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbprint.sys

2014-01-09 01:26 - 2013-06-29 04:08 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2014-01-09 01:26 - 2013-06-29 04:07 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2014-01-09 01:25 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-01-09 01:25 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-01-09 01:25 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-01-09 01:25 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-01-09 01:25 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-01-09 01:25 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-01-09 01:25 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-01-09 01:25 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys

2014-01-09 01:25 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml

2014-01-09 01:25 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-01-09 01:25 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS

2014-01-09 01:25 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2014-01-09 01:25 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2014-01-09 01:25 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-01-09 01:25 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2014-01-09 01:25 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2014-01-09 01:25 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2014-01-09 01:25 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll

2014-01-09 01:25 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll

2014-01-09 01:25 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll

2014-01-09 01:25 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll

2014-01-09 01:25 - 2013-08-16 06:41 - 00058200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dam.sys

2014-01-09 01:25 - 2013-08-16 06:39 - 02371728 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll

2014-01-09 01:25 - 2013-08-16 06:32 - 00209200 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe

2014-01-09 01:25 - 2013-08-16 06:22 - 04917760 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe

2014-01-09 01:25 - 2013-08-16 06:21 - 01164288 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\WSSync.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\setupcln.dll

2014-01-09 01:25 - 2013-08-16 06:20 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSSync.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00083968 _____ C:\Windows\SysWOW64\OEMLicense.dll

2014-01-09 01:25 - 2013-08-15 23:42 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll

2014-01-09 01:25 - 2013-08-15 23:42 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll

2014-01-09 01:25 - 2013-07-09 09:04 - 00120144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msgpioclx.sys

2014-01-09 01:25 - 2013-07-09 07:18 - 00439488 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe

2014-01-09 01:25 - 2013-07-09 05:25 - 00385768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe

2014-01-09 01:25 - 2013-07-09 04:57 - 00245760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LocationApi.dll

2014-01-09 01:25 - 2013-07-08 23:46 - 00543744 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll

2014-01-09 01:25 - 2013-07-08 23:46 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll

2014-01-09 01:25 - 2013-07-08 23:46 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Wwanadvui.dll

2014-01-09 01:25 - 2013-07-08 23:45 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\LocationApi.dll

2014-01-09 01:25 - 2013-07-06 01:16 - 01025024 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll

2014-01-09 01:25 - 2013-07-03 01:23 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll

2014-01-09 01:25 - 2013-07-03 01:22 - 02839552 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll

2014-01-09 01:25 - 2013-07-03 01:11 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll

2014-01-09 01:25 - 2013-07-03 01:10 - 02273792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll

2014-01-09 01:25 - 2013-06-30 23:30 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\openfiles.exe

2014-01-09 01:25 - 2013-06-30 23:29 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\openfiles.exe

2014-01-09 01:25 - 2013-06-29 07:15 - 00195416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys

2014-01-09 01:25 - 2013-06-29 07:15 - 00125784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys

2014-01-09 01:25 - 2013-06-29 06:43 - 00327512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys

2014-01-09 01:25 - 2013-06-26 04:01 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys

2014-01-09 01:25 - 2013-06-26 03:59 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys

2014-01-09 01:25 - 2013-06-24 23:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2014-01-09 01:25 - 2013-06-24 23:54 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll

2014-01-09 01:25 - 2013-06-24 23:54 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll

2014-01-09 01:25 - 2013-06-19 06:36 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\winmmbase.dll

2014-01-09 01:25 - 2013-06-19 06:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll

2014-01-09 01:25 - 2013-06-18 23:38 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmmbase.dll

2014-01-09 01:25 - 2013-06-18 23:38 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll

2014-01-09 01:25 - 2013-06-12 00:43 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll

2014-01-09 01:25 - 2013-06-12 00:26 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll

2014-01-09 01:25 - 2013-06-10 20:16 - 00888832 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll

2014-01-09 01:25 - 2013-06-10 20:15 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL

2014-01-09 01:25 - 2013-06-10 20:10 - 00702464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll

2014-01-09 01:25 - 2013-06-10 20:10 - 00245248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL

2014-01-09 01:25 - 2013-06-06 09:03 - 00119040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS

2014-01-09 01:24 - 2013-07-02 02:41 - 00337752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS

2014-01-09 01:24 - 2013-07-02 02:41 - 00213336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS

2014-01-09 01:24 - 2013-07-01 02:42 - 00623448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-09 01:24 - 2013-07-01 02:42 - 00498008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-09 01:24 - 2013-07-01 02:42 - 00079192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-09 01:24 - 2013-07-01 02:42 - 00021848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-09 01:24 - 2013-06-29 04:07 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-09 01:24 - 2013-06-29 04:06 - 00120832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-09 01:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-09 01:23 - 2013-08-07 06:15 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\tssdisai.dll

2014-01-09 01:23 - 2013-07-19 23:13 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2014-01-09 01:23 - 2013-07-19 23:13 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2014-01-09 01:22 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe

2014-01-09 01:22 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll

2014-01-09 01:22 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll

2014-01-09 01:22 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx

2014-01-09 01:22 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe

2014-01-09 01:22 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll

2014-01-09 01:22 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll

2014-01-09 01:22 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys

2014-01-09 01:22 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-01-09 01:22 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-01-09 01:22 - 2013-05-27 00:17 - 00035328 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2014-01-09 01:22 - 2013-05-26 23:59 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2014-01-09 01:22 - 2013-05-25 04:15 - 00362496 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2014-01-09 01:22 - 2013-05-25 03:32 - 00300032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2014-01-09 00:35 - 2014-01-09 00:41 - 00001368 _____ C:\Users\*********\Desktop\avira.txt

2014-01-09 00:30 - 2014-01-09 14:32 - 00001896 _____ C:\Windows\PFRO.log

2014-01-09 00:14 - 2014-01-09 00:46 - 00015328 _____ C:\Users\*********\Desktop\Gmer.txt

2014-01-09 00:05 - 2014-01-09 00:05 - 00377856 _____ C:\Users\*********\Desktop\gmer_2.1.19163.exe

2014-01-09 00:02 - 2014-01-12 15:00 - 00012998 _____ C:\Users\*********\Desktop\FRST.txt

2014-01-09 00:02 - 2014-01-09 00:45 - 00024083 _____ C:\Users\*********\Desktop\Addition.txt

2014-01-09 00:01 - 2014-01-12 15:00 - 00000000 ____D C:\FRST

2014-01-08 23:59 - 2014-01-12 15:00 - 02075136 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe

2014-01-08 23:58 - 2014-01-09 00:45 - 00000482 _____ C:\Users\*********\Desktop\defogger_disable.log

2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable

2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe

2014-01-08 23:41 - 2014-01-09 00:45 - 00001022 _____ C:\Users\*********\Desktop\AdwCleaner[S0].txt

2014-01-08 23:36 - 2014-01-12 14:49 - 00000000 ____D C:\AdwCleaner

2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-01-08 21:46 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Windows Live

2014-01-08 21:46 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll

2014-01-08 21:46 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll

2014-01-08 21:46 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll

2014-01-08 21:45 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll

2014-01-08 21:45 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll

2014-01-08 21:42 - 2014-01-09 01:39 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live

2014-01-08 21:40 - 2014-01-08 21:41 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe

2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt

2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log

2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe

2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg

2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes

2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-08 17:42 - 2014-01-08 23:43 - 00000000 ____D C:\Program Files (x86)\FileHippo.com

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia

2014-01-06 18:43 - 2014-01-09 02:34 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett

2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
 

==================== One Month Modified Files and Folders =======
 

2014-01-12 15:01 - 2014-01-09 00:02 - 00012998 _____ C:\Users\*********\Desktop\FRST.txt

2014-01-12 15:00 - 2014-01-12 15:00 - 00000000 ____D C:\Users\*********\Desktop\FRST-OlderVersion

2014-01-12 15:00 - 2014-01-09 00:01 - 00000000 ____D C:\FRST

2014-01-12 15:00 - 2014-01-08 23:59 - 02075136 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe

2014-01-12 15:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru

2014-01-12 14:56 - 2014-01-12 14:56 - 00000752 _____ C:\Users\*********\Desktop\JRT.txt

2014-01-12 14:52 - 2014-01-12 14:52 - 00000000 ____D C:\Windows\ERUNT

2014-01-12 14:51 - 2014-01-12 14:51 - 01037068 _____ (Thisisu) C:\Users\*********\Desktop\JRT.exe

2014-01-12 14:50 - 2013-06-23 00:21 - 02015459 _____ C:\Windows\WindowsUpdate.log

2014-01-12 14:49 - 2014-01-08 23:36 - 00000000 ____D C:\AdwCleaner

2014-01-12 14:48 - 2014-01-12 14:43 - 00001022 _____ C:\Users\*********\Desktop\AdwCleaner[S1].txt

2014-01-12 14:47 - 2013-08-30 20:49 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-12 14:44 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-12 14:37 - 2014-01-12 14:37 - 01233962 _____ C:\Users\*********\Desktop\adwcleaner.exe

2014-01-11 22:05 - 2013-06-22 19:01 - 00000000 ____D C:\Users\*********\AppData\Roaming\vlc

2014-01-11 22:04 - 2013-08-30 20:49 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-11 21:27 - 2013-09-22 10:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setuperr.log

2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setupact.log

2014-01-11 19:52 - 2014-01-11 19:15 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett - Kopie

2014-01-11 01:19 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache

2014-01-11 00:45 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates

2014-01-10 23:24 - 2012-10-12 02:44 - 00753134 _____ C:\Windows\system32\perfh007.dat

2014-01-10 23:24 - 2012-10-12 02:44 - 00155826 _____ C:\Windows\system32\perfc007.dat

2014-01-10 23:24 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI

2014-01-10 23:12 - 2014-01-10 23:12 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-10 23:12 - 2014-01-10 23:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-10 22:53 - 2014-01-10 22:52 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\*********\Desktop\mbam-setup-1.75.0.1300.exe

2014-01-10 21:55 - 2014-01-10 21:54 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT

2014-01-09 14:41 - 2013-06-23 00:22 - 00000000 ___RD C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-01-09 14:41 - 2013-06-23 00:22 - 00000000 ___RD C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-01-09 14:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore

2014-01-09 14:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\PolicyDefinitions

2014-01-09 14:36 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe

2014-01-09 14:35 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData

2014-01-09 14:32 - 2014-01-09 00:30 - 00001896 _____ C:\Windows\PFRO.log

2014-01-09 14:28 - 2013-08-25 16:30 - 00000000 ____D C:\Windows\system32\MRT

2014-01-09 14:22 - 2013-06-23 00:28 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-627669732-214247668-4251278340-1002

2014-01-09 14:15 - 2014-01-09 13:49 - 00021066 _____ C:\Users\*********\Desktop\ComboFix.txt

2014-01-09 14:10 - 2014-01-09 14:10 - 00000378 _____ C:\Users\*********\Desktop\Avira_2.text

2014-01-09 13:49 - 2014-01-09 13:42 - 00000000 ____D C:\Qoobox

2014-01-09 13:49 - 2012-07-26 06:37 - 00000000 __RHD C:\Users\Default

2014-01-09 13:48 - 2014-01-09 13:42 - 00000000 ____D C:\Windows\erdnt

2014-01-09 13:47 - 2012-07-26 06:26 - 00000215 _____ C:\Windows\system.ini

2014-01-09 13:36 - 2014-01-09 13:36 - 05162489 ____R (Swearware) C:\Users\*********\Desktop\ComboFix.exe

2014-01-09 02:55 - 2014-01-09 02:55 - 212230516 _____ C:\Users\*********\Documents\clip0008.avi

2014-01-09 02:53 - 2014-01-09 02:52 - 224291418 _____ C:\Users\*********\Documents\clip0007.avi

2014-01-09 02:51 - 2014-01-09 02:50 - 156283886 _____ C:\Users\*********\Documents\clip0006.avi

2014-01-09 02:49 - 2014-01-09 02:49 - 149440834 _____ C:\Users\*********\Documents\clip0005.avi

2014-01-09 02:47 - 2014-01-09 02:46 - 110648088 _____ C:\Users\*********\Documents\clip0004.avi

2014-01-09 02:43 - 2014-01-09 02:43 - 109383106 _____ C:\Users\*********\Documents\clip0003.avi

2014-01-09 02:37 - 2014-01-09 02:36 - 153556170 _____ C:\Users\*********\Documents\clip0002.avi

2014-01-09 02:34 - 2014-01-06 18:43 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett

2014-01-09 02:28 - 2014-01-09 02:28 - 05401856 _____ C:\Users\*********\Downloads\HC228SetDE.exe

2014-01-09 02:28 - 2014-01-09 02:28 - 00000925 _____ C:\Users\*********\Desktop\HyperCam 2.lnk

2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2

2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Program Files (x86)\HyperCam 2

2014-01-09 02:08 - 2014-01-09 02:08 - 00087414 _____ C:\Users\*********\Desktop\FRA-DOH.kmz

2014-01-09 01:39 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live

2014-01-09 01:29 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent

2014-01-09 00:46 - 2014-01-09 00:14 - 00015328 _____ C:\Users\*********\Desktop\Gmer.txt

2014-01-09 00:45 - 2014-01-09 00:02 - 00024083 _____ C:\Users\*********\Desktop\Addition.txt

2014-01-09 00:45 - 2014-01-08 23:58 - 00000482 _____ C:\Users\*********\Desktop\defogger_disable.log

2014-01-09 00:45 - 2014-01-08 23:41 - 00001022 _____ C:\Users\*********\Desktop\AdwCleaner[S0].txt

2014-01-09 00:41 - 2014-01-09 00:35 - 00001368 _____ C:\Users\*********\Desktop\avira.txt

2014-01-09 00:05 - 2014-01-09 00:05 - 00377856 _____ C:\Users\*********\Desktop\gmer_2.1.19163.exe

2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable

2014-01-08 23:58 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********

2014-01-08 23:56 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files\Microsoft Office 15

2014-01-08 23:53 - 2014-01-08 23:53 - 00050477 _____ C:\Users\*********\Desktop\Defogger.exe

2014-01-08 23:43 - 2014-01-08 17:42 - 00000000 ____D C:\Program Files (x86)\FileHippo.com

2014-01-08 23:39 - 2013-06-28 18:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-08 23:38 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI

2014-01-08 23:31 - 2013-11-30 17:12 - 00000000 ____D C:\ProgramData\Skype

2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-01-08 21:47 - 2014-01-08 21:46 - 00000000 ____D C:\Program Files (x86)\Windows Live

2014-01-08 21:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared

2014-01-08 21:41 - 2014-01-08 21:40 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe

2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt

2014-01-08 21:33 - 2012-10-11 17:28 - 00000000 ____D C:\ProgramData\NTI Launcher

2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log

2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe

2014-01-08 20:24 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********\AppData\Local\VirtualStore

2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg

2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes

2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-08 17:47 - 2013-12-01 11:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-08 17:36 - 2013-10-31 16:01 - 00000000 ____D C:\Users\*********\AppData\Local\CrashDumps

2014-01-08 17:36 - 2012-09-03 12:56 - 00000000 ____D C:\Windows\Panther

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia

2014-01-06 17:27 - 2013-09-22 10:48 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk

2014-01-06 16:58 - 2013-08-30 20:49 - 00000000 ____D C:\Program Files (x86)\Google

2014-01-06 16:58 - 2013-06-23 20:19 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-01-06 16:58 - 2013-06-23 20:14 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-01-06 16:58 - 2013-06-23 20:14 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-01-06 16:55 - 2013-08-05 18:13 - 00000000 ___RD C:\Users\*********\Dropbox

2014-01-06 16:55 - 2013-08-05 18:10 - 00000000 ____D C:\Users\*********\AppData\Roaming\Dropbox
 

Some content of TEMP:

====================

C:\Users\*********\AppData\Local\temp\avgnt.exe

C:\Users\*********\AppData\Local\temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-10 22:58
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Danke schön
und viele Grüße
anwo

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hallo Schrauber,

vielen Dank :daumenhoc.

Hier sind die drei Logs.

eset.txt:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=a41a32bed181664087b4266a2d17e3b0

# engine=16652

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-01-14 10:38:05

# local_time=2014-01-14 11:38:05 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.2.9200 NT 

# compatibility_mode=1799 16775165 100 96 16462 255162375 9247 0

# compatibility_mode=5893 16776574 100 94 207164 17022560 0 0

# scanned=248027

# found=0

# cleaned=0

# scan_time=4871

checkup.txt:

Code:

 Results of screen317's Security Check version 0.99.78  

   x64 (UAC is enabled)  

 Internet Explorer 10 Out of date! 
 ``````````````Antivirus/Firewall Check:`````````````` 

Windows Defender   

Avira Desktop      

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Adobe Flash Player         11.9.900.170  

 Mozilla Firefox (26.0) 

 Mozilla Thunderbird (24.1.1) 
 ````````Process Check: objlist.exe by Laurent````````  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 
 ````````````````````End of Log``````````````````````

Und ein frisches FRST.txt:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2014

Ran by ********* (administrator) on **** on 15-01-2014 22:46:01

Running from C:\Users\*********\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

(Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe

(Dritek System INC.) C:\Windows\RfBtnSvc64.exe

(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe

(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe

() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe

(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe

(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe

(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)

HKLM\...\Run: [BtPreLoad] - C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] ()

HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-06] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)

HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-21] (Acer Incorporated)

AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)

Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKLM-x32 - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS

SearchScopes: HKCU - {E47707ED-8001-41BE-95A3-ECF1C7E956E6} URL = 

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Ghostery - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\firefox@ghostery.com.xpi [2013-08-20]

FF Extension: NoScript - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-08]

FF Extension: Adblock Plus - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-08]

FF Extension: BetterPrivacy - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\yahdabz0.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-06-23]

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
 

==================== Services (Whitelisted) =================
 

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2014-01-06] (Avira Operations GmbH & Co. KG)

U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-27] (Avira Operations GmbH & Co. KG)

U2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)

U2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-20] (Broadcom Corp.)

U2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)

U3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated)

U3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)

U2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.)

U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)

U2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation)

U2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)

U2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-10-11] (Dritek System INC.)

U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

U2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-07-31] (Atheros)
 

==================== Drivers (Whitelisted) ====================
 

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-01-06] (Avira Operations GmbH & Co. KG)

U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-01-06] (Avira Operations GmbH & Co. KG)

U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)

U3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)

U3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)

U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

U3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-10-11] (Dritek System Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)

U3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-15 22:46 - 2014-01-15 22:46 - 00013121 _____ C:\Users\*********\Desktop\FRST.txt

2014-01-15 22:45 - 2014-01-15 22:45 - 00000806 _____ C:\Users\*********\Desktop\checkup.txt

2014-01-15 22:34 - 2014-01-15 22:34 - 00000698 _____ C:\Users\*********\Desktop\eset.txt

2014-01-14 22:12 - 2014-01-14 22:12 - 00987410 _____ C:\Users\*********\Downloads\SecurityCheck.exe

2014-01-14 21:33 - 2014-01-14 21:33 - 01110476 _____ C:\Users\*********\Downloads\7z920.exe

2014-01-14 21:33 - 2014-01-14 21:33 - 00000000 ____D C:\Program Files (x86)\7-Zip

2014-01-12 14:52 - 2014-01-12 14:52 - 00000000 ____D C:\Windows\ERUNT

2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setuperr.log

2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setupact.log

2014-01-11 19:15 - 2014-01-11 19:52 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett - Kopie

2014-01-10 23:12 - 2014-01-10 23:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-10 23:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-01-10 21:54 - 2014-01-10 21:55 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT

2014-01-09 13:42 - 2014-01-09 13:49 - 00000000 ____D C:\Qoobox

2014-01-09 13:42 - 2014-01-09 13:48 - 00000000 ____D C:\Windows\erdnt

2014-01-09 13:42 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2014-01-09 13:42 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2014-01-09 13:42 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2014-01-09 13:42 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2014-01-09 13:38 - 2013-11-19 11:21 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-01-09 02:55 - 2014-01-09 02:55 - 212230516 _____ C:\Users\*********\Documents\clip0008.avi

2014-01-09 02:52 - 2014-01-09 02:53 - 224291418 _____ C:\Users\*********\Documents\clip0007.avi

2014-01-09 02:50 - 2014-01-09 02:51 - 156283886 _____ C:\Users\*********\Documents\clip0006.avi

2014-01-09 02:49 - 2014-01-09 02:49 - 149440834 _____ C:\Users\*********\Documents\clip0005.avi

2014-01-09 02:46 - 2014-01-09 02:47 - 110648088 _____ C:\Users\*********\Documents\clip0004.avi

2014-01-09 02:43 - 2014-01-09 02:43 - 109383106 _____ C:\Users\*********\Documents\clip0003.avi

2014-01-09 02:36 - 2014-01-09 02:37 - 153556170 _____ C:\Users\*********\Documents\clip0002.avi

2014-01-09 02:28 - 2014-01-09 02:28 - 05401856 _____ C:\Users\*********\Downloads\HC228SetDE.exe

2014-01-09 02:28 - 2014-01-09 02:28 - 00000925 _____ C:\Users\*********\Desktop\HyperCam 2.lnk

2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2

2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Program Files (x86)\HyperCam 2

2014-01-09 02:08 - 2014-01-09 02:08 - 00087414 _____ C:\Users\*********\Desktop\FRA-DOH.kmz

2014-01-09 01:28 - 2013-08-10 06:21 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll

2014-01-09 01:28 - 2013-08-10 06:21 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncInfo.dll

2014-01-09 01:28 - 2013-08-10 04:58 - 00356352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll

2014-01-09 01:28 - 2013-08-02 07:28 - 19758080 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-01-09 01:28 - 2013-08-02 07:28 - 10116608 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll

2014-01-09 01:28 - 2013-08-02 07:28 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2014-01-09 01:28 - 2013-08-02 07:26 - 02304512 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-01-09 01:28 - 2013-08-02 06:08 - 17561088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-01-09 01:28 - 2013-08-02 06:08 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll

2014-01-09 01:28 - 2013-08-02 06:08 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll

2014-01-09 01:28 - 2013-08-02 06:06 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-01-09 01:28 - 2013-08-01 11:41 - 02233688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-01-09 01:28 - 2013-07-25 00:10 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mbsmsapi.dll

2014-01-09 01:28 - 2013-07-25 00:06 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\mbsmsapi.dll

2014-01-09 01:28 - 2013-04-10 00:17 - 01125888 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll

2014-01-09 01:28 - 2013-04-09 23:29 - 00893952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll

2014-01-09 01:27 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-01-09 01:27 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-01-09 01:27 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll

2014-01-09 01:27 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-01-09 01:27 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-01-09 01:27 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-01-09 01:27 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-01-09 01:27 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-01-09 01:27 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-01-09 01:27 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-01-09 01:27 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-01-09 01:27 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-01-09 01:27 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-01-09 01:27 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-01-09 01:27 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys

2014-01-09 01:27 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL

2014-01-09 01:27 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL

2014-01-09 01:27 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-01-09 01:27 - 2013-08-03 07:40 - 01374208 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll

2014-01-09 01:27 - 2013-08-03 07:40 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll

2014-01-09 01:27 - 2013-08-03 07:40 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx

2014-01-09 01:27 - 2013-08-03 06:14 - 00399360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx

2014-01-09 01:27 - 2013-08-03 06:13 - 01245696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll

2014-01-09 01:27 - 2013-08-03 06:13 - 00437248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll

2014-01-09 01:27 - 2013-07-05 23:02 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys

2014-01-09 01:27 - 2013-07-05 23:01 - 00210560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys

2014-01-09 01:27 - 2013-06-22 06:45 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys

2014-01-09 01:27 - 2013-06-22 06:45 - 00054488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys

2014-01-09 01:27 - 2013-05-15 23:37 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll

2014-01-09 01:27 - 2013-05-15 23:35 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll

2014-01-09 01:27 - 2013-05-14 14:14 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-01-09 01:27 - 2013-05-14 10:23 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-01-09 01:27 - 2013-02-21 11:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-01-09 01:27 - 2013-02-21 11:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-01-09 01:27 - 2013-02-21 11:29 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-01-09 01:27 - 2013-02-21 11:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-01-09 01:27 - 2013-02-21 11:14 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-01-09 01:27 - 2013-02-21 11:14 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-01-09 01:27 - 2013-02-19 10:53 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll

2014-01-09 01:27 - 2012-11-08 05:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-01-09 01:27 - 2012-11-08 05:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-01-09 01:26 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll

2014-01-09 01:26 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll

2014-01-09 01:26 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll

2014-01-09 01:26 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll

2014-01-09 01:26 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys

2014-01-09 01:26 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll

2014-01-09 01:26 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll

2014-01-09 01:26 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys

2014-01-09 01:26 - 2013-08-16 06:21 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-01-09 01:26 - 2013-08-16 06:21 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-01-09 01:26 - 2013-08-15 23:43 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-01-09 01:26 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys

2014-01-09 01:26 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-01-09 01:26 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-01-09 01:26 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll

2014-01-09 01:26 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll

2014-01-09 01:26 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll

2014-01-09 01:26 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll

2014-01-09 01:26 - 2013-07-06 01:15 - 00652288 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2014-01-09 01:26 - 2013-07-04 03:13 - 00541696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll

2014-01-09 01:26 - 2013-07-01 23:14 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbprint.sys

2014-01-09 01:26 - 2013-06-29 04:08 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2014-01-09 01:26 - 2013-06-29 04:07 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2014-01-09 01:25 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-01-09 01:25 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-01-09 01:25 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-01-09 01:25 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-01-09 01:25 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-01-09 01:25 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-01-09 01:25 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-01-09 01:25 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-01-09 01:25 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys

2014-01-09 01:25 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml

2014-01-09 01:25 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-01-09 01:25 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS

2014-01-09 01:25 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2014-01-09 01:25 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2014-01-09 01:25 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-01-09 01:25 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2014-01-09 01:25 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2014-01-09 01:25 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2014-01-09 01:25 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll

2014-01-09 01:25 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll

2014-01-09 01:25 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll

2014-01-09 01:25 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll

2014-01-09 01:25 - 2013-08-16 06:41 - 00058200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dam.sys

2014-01-09 01:25 - 2013-08-16 06:39 - 02371728 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll

2014-01-09 01:25 - 2013-08-16 06:32 - 00209200 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe

2014-01-09 01:25 - 2013-08-16 06:22 - 04917760 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe

2014-01-09 01:25 - 2013-08-16 06:21 - 01164288 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\WSSync.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll

2014-01-09 01:25 - 2013-08-16 06:21 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\setupcln.dll

2014-01-09 01:25 - 2013-08-16 06:20 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSSync.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-09 01:25 - 2013-08-15 23:43 - 00083968 _____ C:\Windows\SysWOW64\OEMLicense.dll

2014-01-09 01:25 - 2013-08-15 23:42 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll

2014-01-09 01:25 - 2013-08-15 23:42 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll

2014-01-09 01:25 - 2013-07-09 09:04 - 00120144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msgpioclx.sys

2014-01-09 01:25 - 2013-07-09 07:18 - 00439488 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe

2014-01-09 01:25 - 2013-07-09 05:25 - 00385768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe

2014-01-09 01:25 - 2013-07-09 04:57 - 00245760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LocationApi.dll

2014-01-09 01:25 - 2013-07-08 23:46 - 00543744 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll

2014-01-09 01:25 - 2013-07-08 23:46 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll

2014-01-09 01:25 - 2013-07-08 23:46 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Wwanadvui.dll

2014-01-09 01:25 - 2013-07-08 23:45 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\LocationApi.dll

2014-01-09 01:25 - 2013-07-06 01:16 - 01025024 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll

2014-01-09 01:25 - 2013-07-03 01:23 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll

2014-01-09 01:25 - 2013-07-03 01:22 - 02839552 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll

2014-01-09 01:25 - 2013-07-03 01:11 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll

2014-01-09 01:25 - 2013-07-03 01:10 - 02273792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll

2014-01-09 01:25 - 2013-06-30 23:30 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\openfiles.exe

2014-01-09 01:25 - 2013-06-30 23:29 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\openfiles.exe

2014-01-09 01:25 - 2013-06-29 07:15 - 00195416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys

2014-01-09 01:25 - 2013-06-29 07:15 - 00125784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys

2014-01-09 01:25 - 2013-06-29 06:43 - 00327512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys

2014-01-09 01:25 - 2013-06-26 04:01 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys

2014-01-09 01:25 - 2013-06-26 03:59 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys

2014-01-09 01:25 - 2013-06-24 23:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2014-01-09 01:25 - 2013-06-24 23:54 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll

2014-01-09 01:25 - 2013-06-24 23:54 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll

2014-01-09 01:25 - 2013-06-19 06:36 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\winmmbase.dll

2014-01-09 01:25 - 2013-06-19 06:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll

2014-01-09 01:25 - 2013-06-18 23:38 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmmbase.dll

2014-01-09 01:25 - 2013-06-18 23:38 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll

2014-01-09 01:25 - 2013-06-12 00:43 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll

2014-01-09 01:25 - 2013-06-12 00:26 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll

2014-01-09 01:25 - 2013-06-10 20:16 - 00888832 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll

2014-01-09 01:25 - 2013-06-10 20:15 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL

2014-01-09 01:25 - 2013-06-10 20:10 - 00702464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll

2014-01-09 01:25 - 2013-06-10 20:10 - 00245248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL

2014-01-09 01:25 - 2013-06-06 09:03 - 00119040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS

2014-01-09 01:24 - 2013-07-02 02:41 - 00337752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS

2014-01-09 01:24 - 2013-07-02 02:41 - 00213336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS

2014-01-09 01:24 - 2013-07-01 02:42 - 00623448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-09 01:24 - 2013-07-01 02:42 - 00498008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-09 01:24 - 2013-07-01 02:42 - 00079192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-09 01:24 - 2013-07-01 02:42 - 00021848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-09 01:24 - 2013-06-29 04:07 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-09 01:24 - 2013-06-29 04:06 - 00120832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-09 01:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-09 01:23 - 2013-08-07 06:15 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\tssdisai.dll

2014-01-09 01:23 - 2013-07-19 23:13 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2014-01-09 01:23 - 2013-07-19 23:13 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2014-01-09 01:22 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe

2014-01-09 01:22 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll

2014-01-09 01:22 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll

2014-01-09 01:22 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx

2014-01-09 01:22 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe

2014-01-09 01:22 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll

2014-01-09 01:22 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll

2014-01-09 01:22 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys

2014-01-09 01:22 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-01-09 01:22 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-01-09 01:22 - 2013-05-27 00:17 - 00035328 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2014-01-09 01:22 - 2013-05-26 23:59 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2014-01-09 01:22 - 2013-05-25 04:15 - 00362496 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2014-01-09 01:22 - 2013-05-25 03:32 - 00300032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2014-01-09 00:30 - 2014-01-09 14:32 - 00001896 _____ C:\Windows\PFRO.log

2014-01-09 00:01 - 2014-01-12 15:00 - 00000000 ____D C:\FRST

2014-01-08 23:59 - 2014-01-12 15:00 - 02075136 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe

2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable

2014-01-08 23:36 - 2014-01-12 14:49 - 00000000 ____D C:\AdwCleaner

2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-01-08 21:46 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Windows Live

2014-01-08 21:46 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll

2014-01-08 21:46 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll

2014-01-08 21:46 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll

2014-01-08 21:46 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll

2014-01-08 21:46 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll

2014-01-08 21:45 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll

2014-01-08 21:45 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll

2014-01-08 21:42 - 2014-01-14 20:31 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live

2014-01-08 21:40 - 2014-01-08 21:41 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe

2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt

2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log

2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe

2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg

2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes

2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-08 17:42 - 2014-01-08 23:43 - 00000000 ____D C:\Program Files (x86)\FileHippo.com

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia

2014-01-06 18:43 - 2014-01-09 02:34 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett

2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk
 

==================== One Month Modified Files and Folders =======
 

2014-01-15 22:46 - 2014-01-15 22:46 - 00013121 _____ C:\Users\*********\Desktop\FRST.txt

2014-01-15 22:45 - 2014-01-15 22:45 - 00000806 _____ C:\Users\*********\Desktop\checkup.txt

2014-01-15 22:43 - 2013-06-23 00:21 - 01163501 _____ C:\Windows\WindowsUpdate.log

2014-01-15 22:34 - 2014-01-15 22:34 - 00000698 _____ C:\Users\*********\Desktop\eset.txt

2014-01-15 22:30 - 2013-08-25 16:30 - 00000000 ____D C:\Windows\system32\MRT

2014-01-15 22:30 - 2013-08-04 07:44 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-01-15 22:27 - 2013-09-22 10:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-01-15 22:17 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru

2014-01-15 01:04 - 2013-08-30 20:49 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-14 22:14 - 2012-10-12 02:44 - 00753134 _____ C:\Windows\system32\perfh007.dat

2014-01-14 22:14 - 2012-10-12 02:44 - 00155826 _____ C:\Windows\system32\perfc007.dat

2014-01-14 22:14 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI

2014-01-14 22:12 - 2014-01-14 22:12 - 00987410 _____ C:\Users\*********\Downloads\SecurityCheck.exe

2014-01-14 21:33 - 2014-01-14 21:33 - 01110476 _____ C:\Users\*********\Downloads\7z920.exe

2014-01-14 21:33 - 2014-01-14 21:33 - 00000000 ____D C:\Program Files (x86)\7-Zip

2014-01-14 21:09 - 2013-06-22 19:01 - 00000000 ____D C:\Users\*********\AppData\Roaming\vlc

2014-01-14 21:06 - 2013-10-31 16:01 - 00000000 ____D C:\Users\*********\AppData\Local\CrashDumps

2014-01-14 20:31 - 2014-01-08 21:42 - 00000000 ____D C:\Users\*********\AppData\Local\Windows Live

2014-01-14 20:01 - 2013-08-30 20:49 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-14 20:00 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-12 15:00 - 2014-01-09 00:01 - 00000000 ____D C:\FRST

2014-01-12 15:00 - 2014-01-08 23:59 - 02075136 _____ (Farbar) C:\Users\*********\Desktop\FRST64.exe

2014-01-12 14:52 - 2014-01-12 14:52 - 00000000 ____D C:\Windows\ERUNT

2014-01-12 14:49 - 2014-01-08 23:36 - 00000000 ____D C:\AdwCleaner

2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setuperr.log

2014-01-11 21:11 - 2014-01-11 21:11 - 00000000 _____ C:\Windows\setupact.log

2014-01-11 19:52 - 2014-01-11 19:15 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett - Kopie

2014-01-11 01:19 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache

2014-01-11 00:45 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates

2014-01-10 23:12 - 2014-01-10 23:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-10 21:55 - 2014-01-10 21:54 - 00449112 _____ C:\Windows\system32\FNTCACHE.DAT

2014-01-09 14:41 - 2013-06-23 00:22 - 00000000 ___RD C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-01-09 14:41 - 2013-06-23 00:22 - 00000000 ___RD C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-01-09 14:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore

2014-01-09 14:37 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\PolicyDefinitions

2014-01-09 14:36 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe

2014-01-09 14:35 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData

2014-01-09 14:32 - 2014-01-09 00:30 - 00001896 _____ C:\Windows\PFRO.log

2014-01-09 14:22 - 2013-06-23 00:28 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-627669732-214247668-4251278340-1002

2014-01-09 13:49 - 2014-01-09 13:42 - 00000000 ____D C:\Qoobox

2014-01-09 13:49 - 2012-07-26 06:37 - 00000000 __RHD C:\Users\Default

2014-01-09 13:48 - 2014-01-09 13:42 - 00000000 ____D C:\Windows\erdnt

2014-01-09 13:47 - 2012-07-26 06:26 - 00000215 _____ C:\Windows\system.ini

2014-01-09 09:02 - 2013-08-05 17:54 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-01-09 09:02 - 2013-08-05 17:54 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-09 02:55 - 2014-01-09 02:55 - 212230516 _____ C:\Users\*********\Documents\clip0008.avi

2014-01-09 02:53 - 2014-01-09 02:52 - 224291418 _____ C:\Users\*********\Documents\clip0007.avi

2014-01-09 02:51 - 2014-01-09 02:50 - 156283886 _____ C:\Users\*********\Documents\clip0006.avi

2014-01-09 02:49 - 2014-01-09 02:49 - 149440834 _____ C:\Users\*********\Documents\clip0005.avi

2014-01-09 02:47 - 2014-01-09 02:46 - 110648088 _____ C:\Users\*********\Documents\clip0004.avi

2014-01-09 02:43 - 2014-01-09 02:43 - 109383106 _____ C:\Users\*********\Documents\clip0003.avi

2014-01-09 02:37 - 2014-01-09 02:36 - 153556170 _____ C:\Users\*********\Documents\clip0002.avi

2014-01-09 02:34 - 2014-01-06 18:43 - 00000000 ____D C:\Users\*********\Desktop\Best_of_Wt_komplett

2014-01-09 02:28 - 2014-01-09 02:28 - 05401856 _____ C:\Users\*********\Downloads\HC228SetDE.exe

2014-01-09 02:28 - 2014-01-09 02:28 - 00000925 _____ C:\Users\*********\Desktop\HyperCam 2.lnk

2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HyperCam 2

2014-01-09 02:28 - 2014-01-09 02:28 - 00000000 ____D C:\Program Files (x86)\HyperCam 2

2014-01-09 02:08 - 2014-01-09 02:08 - 00087414 _____ C:\Users\*********\Desktop\FRA-DOH.kmz

2014-01-09 01:29 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent

2014-01-08 23:58 - 2014-01-08 23:58 - 00000000 _____ C:\Users\*********\defogger_reenable

2014-01-08 23:58 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********

2014-01-08 23:56 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files\Microsoft Office 15

2014-01-08 23:43 - 2014-01-08 17:42 - 00000000 ____D C:\Program Files (x86)\FileHippo.com

2014-01-08 23:39 - 2013-06-28 18:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-08 23:38 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI

2014-01-08 23:31 - 2013-11-30 17:12 - 00000000 ____D C:\ProgramData\Skype

2014-01-08 21:48 - 2014-01-08 21:48 - 00000000 ____D C:\Windows\de

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Windows\PCHEALTH

2014-01-08 21:47 - 2014-01-08 21:47 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-01-08 21:47 - 2014-01-08 21:46 - 00000000 ____D C:\Program Files (x86)\Windows Live

2014-01-08 21:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared

2014-01-08 21:41 - 2014-01-08 21:40 - 142602520 _____ (Microsoft Corporation) C:\Users\*********\Downloads\wlsetup-all_16.4.3508.0205.exe

2014-01-08 21:34 - 2014-01-08 21:34 - 00000000 ____D C:\ProgramData\NTIRegEt

2014-01-08 21:33 - 2012-10-11 17:28 - 00000000 ____D C:\ProgramData\NTI Launcher

2014-01-08 20:25 - 2014-01-08 20:25 - 00010639 _____ C:\Users\*********\Downloads\hijackthis.log

2014-01-08 20:24 - 2014-01-08 20:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\*********\Downloads\HiJackThis204.exe

2014-01-08 20:24 - 2013-06-23 00:21 - 00000000 ____D C:\Users\*********\AppData\Local\VirtualStore

2014-01-08 20:15 - 2014-01-08 20:15 - 00052634 _____ C:\Users\*********\Documents\cc_20140108_201532.reg

2014-01-08 18:00 - 2014-01-08 18:00 - 00000000 ____D C:\Users\*********\AppData\Roaming\Malwarebytes

2014-01-08 17:59 - 2014-01-08 17:59 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-08 17:47 - 2014-01-08 17:47 - 00001039 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-08 17:47 - 2013-12-01 11:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-08 17:36 - 2012-09-03 12:56 - 00000000 ____D C:\Windows\Panther

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Users\*********\AppData\Local\Secunia PSI

2014-01-08 17:30 - 2014-01-08 17:30 - 00000000 ____D C:\Program Files (x86)\Secunia

2014-01-06 17:27 - 2013-09-22 10:48 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-01-06 16:58 - 2014-01-06 16:58 - 00002176 _____ C:\Users\Public\Desktop\Google Earth.lnk

2014-01-06 16:58 - 2013-08-30 20:49 - 00000000 ____D C:\Program Files (x86)\Google

2014-01-06 16:58 - 2013-06-23 20:19 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-01-06 16:58 - 2013-06-23 20:14 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-01-06 16:58 - 2013-06-23 20:14 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-01-06 16:55 - 2013-08-05 18:13 - 00000000 ___RD C:\Users\*********\Dropbox

2014-01-06 16:55 - 2013-08-05 18:10 - 00000000 ____D C:\Users\*********\AppData\Roaming\Dropbox
 

Some content of TEMP:

====================

C:\Users\*********\AppData\Local\temp\avgnt.exe

C:\Users\*********\AppData\Local\temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-10 22:58
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Vielen lieben Dank für Deine Hilfe.:dankeschoen:

Eine Frage habe ich noch. Gibt es eine Möglichkeit sich besser gegen die Viren zu schützen?

Danke schön und viele Grüße
anwo

Fertig :)

Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.