Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   svhost.exe Virus? (https://www.trojaner-board.de/135999-svhost-exe-virus.html)

Chico92 03.06.2013 21:25
svhost.exe Virus?
 
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo Leute!

Ich bin neu hier im Forum!

Ich habe das Programm Kaspersky und das zeigt mir ständig eine Bedrohung an.

Ich habe schon zweimal versucht mit Kaspersky die Bedrohung svhost.exe zu löschen bzw desinfizieren. Dann kam aber auch zweimal so eine komische Fehlermeldung beim Herunterfahren, die aber dann wegging und der PC normal herunterfahren konnte. Danach ist mir nichts mehr aufgefallen. Ich habe auch einmal ein Prozess mit svhost beendet, weil ich dachte dass es der virus wäre aber danach habe ich eine Meldung bekommen das der Grafiktreiber wieder hergestellt wurden ist oder so, kann mich nicht mehr ganz erinnern.

Die Bedrohung wird aber immer noch angezeigt bei Kaspersky und scheint nicht weg zu gehen. Daher dachte ich, ich suche mal um Hilfe, weil ich nicht weiß ob es jetzt ein Virus ist oder nicht?

Ich habe die nötigen Datein angehängt.

Vielen Dank im voraus

schrauber 03.06.2013 21:56
hi,
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Chico92 03.06.2013 22:42
Habe ich gemacht.

Vielen Dank für die schnelle Antwort!!!

schrauber 04.06.2013 06:26
Combofix-Skript
WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

  • Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
  • Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
  • Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
  • Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
    Code:
    File::
    c:\users\user\AppData\Roaming\Microsoft\IE10\svhost.exe
  • Speichere dies als CFScript.txt auf deinem Desktop.
  • Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
  • Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  • Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
    Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!



Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32bit oder FRST 64bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Scan.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Chico92 04.06.2013 09:25
Ich lade die Dateien automatisch immer in den Ordner Downloads. Danach drücke ich aber auf Ausschneiden und füge sie auf den Desktop. Ich hoffe so mache ich das richtig.

Bei Combofix kommt während es läuft immer eine Meldung und zwar: Anzeigetreiber wurde nach einem Fehler wieder hergestellt.

Code:
ComboFix 13-06-03.06 - user 04.06.2013  10:12:47.2.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8175.6779 [GMT 2:00]
ausgeführt von:: c:\users\user\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\user\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\user\AppData\Roaming\Microsoft\IE10\svhost.exe"
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\user\AppData\Roaming\Microsoft\IE10\svhost.exe
c:\users\user\AppData\Roaming\Microsoft\svhost.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-05-04 bis 2013-06-04  ))))))))))))))))))))))))))))))
.
.
2013-06-04 08:14 . 2013-06-04 08:14        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2013-06-04 08:14 . 2013-06-04 08:14        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-06-04 08:14 . 2013-06-04 08:14        --------        d-----w-        c:\users\Coskun\AppData\Local\temp
2013-06-01 18:09 . 2012-07-11 15:09        64856        ----a-w-        c:\windows\system32\klfphc.dll
2013-06-01 18:09 . 2013-06-01 18:09        --------        d-----w-        c:\windows\ELAMBKUP
2013-06-01 18:09 . 2013-06-04 08:03        --------        d-----w-        c:\programdata\Kaspersky Lab
2013-06-01 18:09 . 2013-06-01 18:09        --------        d-----w-        c:\program files (x86)\Kaspersky Lab
2013-06-01 18:09 . 2013-06-01 18:17        90208        ----a-w-        c:\windows\system32\drivers\klflt.sys
2013-06-01 18:09 . 2013-06-01 18:17        620128        ----a-w-        c:\windows\system32\drivers\klif.sys
2013-06-01 12:18 . 2013-04-23 15:03        87054        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libpdcurses.dll
2013-06-01 12:18 . 2013-04-23 15:03        45056        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\pthreadGC2.dll
2013-06-01 12:18 . 2013-04-23 15:03        323584        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\ssleay32.dll
2013-06-01 12:18 . 2013-04-23 15:03        309248        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libcurl-4.dll
2013-06-01 12:18 . 2013-04-23 15:03        224256        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libidn-11.dll
2013-06-01 12:18 . 2013-04-23 15:03        1479680        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libeay32.dll
2013-06-01 12:18 . 2013-04-23 15:03        122368        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\zlib1.dll
2013-06-01 12:18 . 2013-04-23 15:03        104960        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libusb-1.0.dll
2013-06-01 12:18 . 2013-06-04 08:03        587776        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\7z.exe
2013-05-31 23:56 . 2013-05-31 23:56        --------        d-----w-        c:\program files (x86)\Origin Games
2013-05-31 23:20 . 2013-05-07 17:26        1751552        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe
2013-05-31 23:20 . 2013-05-31 23:20        --------        d-----w-        c:\users\user\AppData\Roaming\EvolutionClips
2013-05-31 23:11 . 2013-06-01 13:36        291088        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2013-05-31 23:11 . 2013-05-31 23:11        --------        d-----w-        c:\users\user\AppData\Local\PunkBuster
2013-05-31 22:38 . 2013-05-31 22:38        --------        d-----w-        c:\users\user\AppData\Local\ESN
2013-05-31 21:45 . 2013-06-01 13:49        --------        d--h--w-        c:\program files (x86)\Common Files\EAInstaller
2013-05-31 21:45 . 2013-06-01 13:36        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2013-05-31 15:05 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{69F6484B-E352-427F-A1ED-B1F8A1C7D4E2}\mpengine.dll
2013-05-16 16:34 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys
2013-05-10 14:26 . 2013-05-10 14:32        --------        d-----w-        c:\users\Coskun\AppData\Local\Microsoft Games
2013-05-07 08:28 . 2013-05-07 08:28        --------        d-----w-        c:\program files (x86)\Common Files\Java
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-01 18:17 . 2012-08-13 14:49        178448        ----a-w-        c:\windows\system32\drivers\kneps.sys
2013-06-01 18:17 . 2012-07-25 12:53        29528        ----a-w-        c:\windows\system32\drivers\klmouflt.sys
2013-06-01 18:17 . 2012-06-08 09:38        55056        ----a-w-        c:\windows\system32\drivers\kltdi.sys
2013-06-01 18:17 . 2012-05-25 17:38        29016        ----a-w-        c:\windows\system32\drivers\klkbdflt.sys
2013-05-16 19:25 . 2012-06-27 13:36        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-16 19:25 . 2012-06-27 13:36        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-16 17:34 . 2012-11-01 17:13        75016696        ----a-w-        c:\windows\system32\MRT.exe
2013-05-02 00:06 . 2010-11-21 03:27        278800        ------w-        c:\windows\system32\MpSigStub.exe
2013-04-30 12:52 . 2013-04-30 12:52        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2013-04-30 12:52 . 2013-04-30 12:52        226304        ----a-w-        c:\windows\system32\elshyph.dll
2013-04-30 12:52 . 2013-04-30 12:52        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll
2013-04-30 12:52 . 2013-04-30 12:52        158720        ----a-w-        c:\windows\SysWow64\msls31.dll
2013-04-30 12:52 . 2013-04-30 12:52        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2013-04-30 12:52 . 2013-04-30 12:52        138752        ----a-w-        c:\windows\SysWow64\wextract.exe
2013-04-30 12:52 . 2013-04-30 12:52        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-30 12:52 . 2013-04-30 12:52        97280        ----a-w-        c:\windows\system32\mshtmled.dll
2013-04-30 12:52 . 2013-04-30 12:52        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2013-04-30 12:52 . 2013-04-30 12:52        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2013-04-30 12:52 . 2013-04-30 12:52        81408        ----a-w-        c:\windows\system32\icardie.dll
2013-04-30 12:52 . 2013-04-30 12:52        77312        ----a-w-        c:\windows\system32\tdc.ocx
2013-04-30 12:52 . 2013-04-30 12:52        762368        ----a-w-        c:\windows\system32\ieapfltr.dll
2013-04-30 12:52 . 2013-04-30 12:52        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-30 12:52 . 2013-04-30 12:52        62976        ----a-w-        c:\windows\system32\pngfilt.dll
2013-04-30 12:52 . 2013-04-30 12:52        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx
2013-04-30 12:52 . 2013-04-30 12:52        599552        ----a-w-        c:\windows\system32\vbscript.dll
2013-04-30 12:52 . 2013-04-30 12:52        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll
2013-04-30 12:52 . 2013-04-30 12:52        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll
2013-04-30 12:52 . 2013-04-30 12:52        51200        ----a-w-        c:\windows\system32\imgutil.dll
2013-04-30 12:52 . 2013-04-30 12:52        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2013-04-30 12:52 . 2013-04-30 12:52        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2013-04-30 12:52 . 2013-04-30 12:52        452096        ----a-w-        c:\windows\system32\dxtmsft.dll
2013-04-30 12:52 . 2013-04-30 12:52        441856        ----a-w-        c:\windows\system32\html.iec
2013-04-30 12:52 . 2013-04-30 12:52        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll
2013-04-30 12:52 . 2013-04-30 12:52        361984        ----a-w-        c:\windows\SysWow64\html.iec
2013-04-30 12:52 . 2013-04-30 12:52        281600        ----a-w-        c:\windows\system32\dxtrans.dll
2013-04-30 12:52 . 2013-04-30 12:52        27648        ----a-w-        c:\windows\system32\licmgr10.dll
2013-04-30 12:52 . 2013-04-30 12:52        270848        ----a-w-        c:\windows\system32\iedkcs32.dll
2013-04-30 12:52 . 2013-04-30 12:52        247296        ----a-w-        c:\windows\system32\webcheck.dll
2013-04-30 12:52 . 2013-04-30 12:52        235008        ----a-w-        c:\windows\system32\url.dll
2013-04-30 12:52 . 2013-04-30 12:52        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2013-04-30 12:52 . 2013-04-30 12:52        216064        ----a-w-        c:\windows\system32\msls31.dll
2013-04-30 12:52 . 2013-04-30 12:52        197120        ----a-w-        c:\windows\system32\msrating.dll
2013-04-30 12:52 . 2013-04-30 12:52        173568        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-04-30 12:52 . 2013-04-30 12:52        167424        ----a-w-        c:\windows\system32\iexpress.exe
2013-04-30 12:52 . 2013-04-30 12:52        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-04-30 12:52 . 2013-04-30 12:52        149504        ----a-w-        c:\windows\system32\occache.dll
2013-04-30 12:52 . 2013-04-30 12:52        144896        ----a-w-        c:\windows\system32\wextract.exe
2013-04-30 12:52 . 2013-04-30 12:52        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2013-04-30 12:52 . 2013-04-30 12:52        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat
2013-04-30 12:52 . 2013-04-30 12:52        13824        ----a-w-        c:\windows\system32\mshta.exe
2013-04-30 12:52 . 2013-04-30 12:52        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2013-04-30 12:52 . 2013-04-30 12:52        136192        ----a-w-        c:\windows\system32\iepeers.dll
2013-04-30 12:52 . 2013-04-30 12:52        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll
2013-04-30 12:52 . 2013-04-30 12:52        12800        ----a-w-        c:\windows\SysWow64\mshta.exe
2013-04-30 12:52 . 2013-04-30 12:52        12800        ----a-w-        c:\windows\system32\msfeedssync.exe
2013-04-30 12:52 . 2013-04-30 12:52        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2013-04-30 12:52 . 2013-04-30 12:52        102912        ----a-w-        c:\windows\system32\inseng.dll
2013-04-13 05:49 . 2013-05-16 16:34        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 16:34        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 16:34        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 16:34        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 16:34        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 16:34        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 11:55        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2013-04-04 03:35 . 2013-03-16 09:41        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-19 06:04 . 2013-04-10 09:19        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 09:19        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 09:19        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 09:19        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 09:19        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 09:19        112640        ----a-w-        c:\windows\system32\smss.exe
2013-03-16 09:41 . 2012-06-27 13:35        861088        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2013-03-16 09:41 . 2012-06-27 13:35        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VSA"="c:\users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe" [2013-05-07 1751552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"WIRELESS-KB-LED-STATUS"="c:\program files (x86)\Wireless Keyboard Driver\LedStatusApp.exe" [2010-04-30 846336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2013-06-01 356376]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GIGABYTE OC_GURU.lnk - c:\program files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe [2011-6-4 17428480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AsrCDDrv;AsrCDDrv;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-27 19:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CmPCIaudio"="c:\windows\Syswow64\CMICNFG3.dll" [2009-05-11 8126464]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\zym5a3q7.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Google Chrome - c:\program files (x86)\Google\Chrome\Application\22.0.1229.94\Installer\setup.exe
AddRemove-Steam App 240 - c:\steam\steam.exe
AddRemove-Steam App 730 - c:\steam\steam.exe
AddRemove-{95030349-3623-4920-89BF-8BEC5EF311C5}_is1 - f:\neuer ordner\Hitman Absolution\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-04  10:15:31
ComboFix-quarantined-files.txt  2013-06-04 08:15
ComboFix2.txt  2013-06-03 21:38
.
Vor Suchlauf: 18 Verzeichnis(se), 56.884.334.592 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 56.689.041.408 Bytes frei
.
- - End Of File - - 47BEB41DFB8A3F7A5744A1C259AD06EE
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-06-2013 02
Ran by user (administrator) on 04-06-2013 10:19:39
Running from C:\Users\user\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [CmPCIaudio] C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd [8126464 2009-05-11] (C-Media Corporation)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11101800 2010-07-28] (Realtek Semiconductor)
HKCU\...\Run: [VSA] C:\Users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe [1751552 2013-05-07] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [WIRELESS-KB-LED-STATUS] C:\Program Files (x86)\Wireless Keyboard Driver\LedStatusApp.exe [846336 2010-04-30] ()
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2013-06-01] (Kaspersky Lab ZAO)
HKU\Coskun\...\Policies\system: [LogonHoursAction] 2
HKU\Coskun\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\ProgramData\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\zym5a3q7.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\zym5a3q7.default\Extensions\{aff87fa2-a58e-4edd-b852-0a20203c1e17}.xpi
FF Extension: No Name - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\zym5a3q7.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

Chrome:
=======
CHR RestoreOnStartup: "https://news.google.de/nwshp?hl=de&tab=8n"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.138\pepflashplayer.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - F:\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - F:\Google\Chrome\Application\22.0.1229.94\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\plugin/npUrlAdvisor.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0\plugin/online_banking_npapi.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4190_0\plugin/npVKPlugin.dll No File
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0\plugin/npABPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4.1_0
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Safe Money) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Auto-Translate) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\obgoiaeapddkeekbocomnjlckbbfapmk\2.0.3_0
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0

==================== Services (Whitelisted) =================

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-06-01] (Kaspersky Lab ZAO)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [x]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [x]

==================== Drivers (Whitelisted) ====================

R3 cmuda3; C:\Windows\System32\drivers\cmudax3.sys [1154560 2009-05-19] (C-Media Inc)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-12-25] (DT Soft Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-06-01] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-06-01] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-06-01] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55056 2013-06-01] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-06-01] (Kaspersky Lab ZAO)
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-04 10:19 - 2013-06-04 10:19 - 00000000 ____D C:\FRST
2013-06-04 10:18 - 2013-06-04 10:18 - 01916714 ____A (Farbar) C:\Users\user\Desktop\FRST64.exe
2013-06-04 10:15 - 2013-06-04 10:15 - 00020575 ____A C:\Users\user\Desktop\ComboFix.txt
2013-06-04 10:15 - 2013-06-04 10:15 - 00020575 ____A C:\ComboFix.txt
2013-06-04 10:05 - 2013-06-04 10:06 - 05077441 ____R (Swearware) C:\Users\user\Desktop\ComboFix.exe
2013-06-03 23:34 - 2013-06-04 10:15 - 00000000 ____D C:\Qoobox
2013-06-03 23:34 - 2013-06-03 23:38 - 00000000 ____D C:\Windows\erdnt
2013-06-03 23:34 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-03 23:34 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-03 23:34 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-03 23:34 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-03 23:34 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-03 23:34 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-03 23:34 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-03 23:34 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-03 22:09 - 2013-06-03 22:10 - 00000520 ____A C:\Users\user\Desktop\gemr.log
2013-06-03 19:57 - 2013-06-03 19:45 - 00377856 ____A C:\Users\user\Desktop\gmer_2.1.19163.exe
2013-06-03 19:51 - 2013-06-03 19:51 - 00054684 ____A C:\Users\user\Desktop\Extras.Txt
2013-06-03 19:50 - 2013-06-03 19:56 - 00083942 ____A C:\Users\user\Desktop\OTL.Txt
2013-06-03 19:46 - 2013-06-03 19:46 - 00000540 ____A C:\Users\user\Downloads\defogger_disable.log
2013-06-03 19:46 - 2013-06-03 19:46 - 00000154 ____A C:\Users\user\defogger_reenable
2013-06-03 19:45 - 2013-06-03 19:45 - 00377856 ____A C:\Users\user\Downloads\gmer_2.1.19163.exe
2013-06-03 19:45 - 2013-06-03 19:44 - 00602112 ____A (OldTimer Tools) C:\Users\user\Desktop\OTL.exe
2013-06-03 19:44 - 2013-06-03 19:44 - 00602112 ____A (OldTimer Tools) C:\Users\user\Downloads\OTL.exe
2013-06-02 21:35 - 2013-06-02 21:35 - 00002344 ____A C:\Users\Coskun\Desktop\Sicherer Zahlungsverkehr.lnk
2013-06-02 14:33 - 2013-06-02 14:33 - 00050477 ____A C:\Users\user\Downloads\Defogger.exe
2013-06-01 20:10 - 2013-06-01 20:10 - 00002344 ____A C:\Users\user\Desktop\Sicherer Zahlungsverkehr.lnk
2013-06-01 20:09 - 2013-06-04 10:16 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-01 20:09 - 2013-06-01 20:17 - 00620128 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klif.sys
2013-06-01 20:09 - 2013-06-01 20:17 - 00090208 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klflt.sys
2013-06-01 20:09 - 2013-06-01 20:09 - 00001146 ____A C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
2013-06-01 20:09 - 2013-06-01 20:09 - 00000000 ____D C:\Windows\ELAMBKUP
2013-06-01 20:09 - 2013-06-01 20:09 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-06-01 20:09 - 2012-07-11 17:09 - 00064856 ____A (Kaspersky Lab) C:\Windows\System32\klfphc.dll
2013-06-01 19:59 - 2013-06-01 20:04 - 165991240 ____A (Kaspersky Lab) C:\Users\user\Downloads\kis13.0.1.4190DE_3575.exe
2013-06-01 03:12 - 2013-06-01 03:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-01 01:56 - 2013-06-01 01:56 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-06-01 01:20 - 2013-06-01 01:20 - 00262144 ____A C:\Windows\System32\config\elam
2013-06-01 01:20 - 2013-06-01 01:20 - 00000000 ____D C:\Users\user\AppData\Roaming\EvolutionClips
2013-06-01 01:11 - 2013-06-01 15:36 - 00291088 ____A C:\Windows\SysWOW64\PnkBstrB.xtr
2013-06-01 01:11 - 2013-06-01 01:11 - 00000000 ____D C:\Users\user\AppData\Local\PunkBuster
2013-06-01 00:38 - 2013-06-01 00:38 - 00000000 ____D C:\Users\user\AppData\Local\ESN
2013-05-31 23:45 - 2013-06-01 15:36 - 00280904 ____A C:\Windows\SysWOW64\PnkBstrB.ex0
2013-05-28 21:13 - 2013-05-28 21:13 - 00600280 ____A C:\Users\Coskun\Desktop\Psychische Bedingungen.pptx
2013-05-22 20:51 - 2013-05-22 21:08 - 00000000 ____D C:\Users\user\Desktop\Vorträge
2013-05-16 19:33 - 2013-04-05 08:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-16 19:33 - 2013-04-05 08:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-16 19:33 - 2013-04-05 08:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-16 19:33 - 2013-04-05 08:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-16 19:33 - 2013-04-05 08:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-16 19:33 - 2013-04-05 07:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-16 19:33 - 2013-04-05 07:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-16 19:33 - 2013-04-05 07:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-16 19:33 - 2013-04-05 06:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-16 19:33 - 2013-04-05 06:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-16 19:33 - 2013-04-05 05:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-16 19:33 - 2013-04-05 05:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-16 18:34 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-16 18:34 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-16 18:34 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-16 18:34 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-16 18:34 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-16 18:34 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-16 18:34 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-16 18:34 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-16 18:34 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-16 18:34 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-16 18:34 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-16 18:34 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-16 18:34 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-16 18:34 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-10 16:26 - 2013-05-10 16:32 - 00000000 ____D C:\Users\Coskun\AppData\Local\Microsoft Games
2013-05-10 12:07 - 2013-05-10 12:07 - 00000000 ____D C:\Users\user\Desktop\left4deadUncut
2013-05-09 18:41 - 2013-05-09 18:41 - 00000000 ____D C:\Windows\pss
2013-05-09 17:49 - 2013-05-09 17:50 - 00000000 ____D C:\Users\user\Desktop\Desktop-xCore0320
2013-05-07 14:20 - 2013-05-07 22:53 - 00011865 ____A C:\Users\Coskun\Desktop\The Structure of Power_Imber.odt
2013-05-07 10:28 - 2013-05-07 10:28 - 00004032 ____A C:\Windows\SysWOW64\jupdate-1.7.0_21-b11.log

==================== One Month Modified Files and Folders =======

2013-06-04 10:19 - 2013-06-04 10:19 - 00000000 ____D C:\FRST
2013-06-04 10:19 - 2012-06-27 15:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-04 10:18 - 2013-06-04 10:18 - 01916714 ____A (Farbar) C:\Users\user\Desktop\FRST64.exe
2013-06-04 10:16 - 2013-06-01 20:09 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-04 10:15 - 2013-06-04 10:15 - 00020575 ____A C:\Users\user\Desktop\ComboFix.txt
2013-06-04 10:15 - 2013-06-04 10:15 - 00020575 ____A C:\ComboFix.txt
2013-06-04 10:15 - 2013-06-03 23:34 - 00000000 ____D C:\Qoobox
2013-06-04 10:14 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-06-04 10:12 - 2012-06-21 18:44 - 01722792 ____A C:\Windows\WindowsUpdate.log
2013-06-04 10:09 - 2009-07-14 06:45 - 00021648 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-04 10:09 - 2009-07-14 06:45 - 00021648 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-04 10:07 - 2010-11-21 08:50 - 00653928 ____A C:\Windows\System32\perfh007.dat
2013-06-04 10:07 - 2010-11-21 08:50 - 00129800 ____A C:\Windows\System32\perfc007.dat
2013-06-04 10:07 - 2009-07-14 07:13 - 01498506 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-04 10:06 - 2013-06-04 10:05 - 05077441 ____R (Swearware) C:\Users\user\Desktop\ComboFix.exe
2013-06-04 10:02 - 2012-06-27 15:42 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-04 10:02 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-04 10:02 - 2009-07-14 06:51 - 04387629 ____A C:\Windows\setupact.log
2013-06-03 23:45 - 2010-11-21 05:47 - 00018418 ____A C:\Windows\PFRO.log
2013-06-03 23:38 - 2013-06-03 23:34 - 00000000 ____D C:\Windows\erdnt
2013-06-03 22:10 - 2013-06-03 22:09 - 00000520 ____A C:\Users\user\Desktop\gemr.log
2013-06-03 19:56 - 2013-06-03 19:50 - 00083942 ____A C:\Users\user\Desktop\OTL.Txt
2013-06-03 19:51 - 2013-06-03 19:51 - 00054684 ____A C:\Users\user\Desktop\Extras.Txt
2013-06-03 19:46 - 2013-06-03 19:46 - 00000540 ____A C:\Users\user\Downloads\defogger_disable.log
2013-06-03 19:46 - 2013-06-03 19:46 - 00000154 ____A C:\Users\user\defogger_reenable
2013-06-03 19:45 - 2013-06-03 19:57 - 00377856 ____A C:\Users\user\Desktop\gmer_2.1.19163.exe
2013-06-03 19:45 - 2013-06-03 19:45 - 00377856 ____A C:\Users\user\Downloads\gmer_2.1.19163.exe
2013-06-03 19:44 - 2013-06-03 19:45 - 00602112 ____A (OldTimer Tools) C:\Users\user\Desktop\OTL.exe
2013-06-03 19:44 - 2013-06-03 19:44 - 00602112 ____A (OldTimer Tools) C:\Users\user\Downloads\OTL.exe
2013-06-02 21:35 - 2013-06-02 21:35 - 00002344 ____A C:\Users\Coskun\Desktop\Sicherer Zahlungsverkehr.lnk
2013-06-02 14:33 - 2013-06-02 14:33 - 00050477 ____A C:\Users\user\Downloads\Defogger.exe
2013-06-01 20:17 - 2013-06-01 20:09 - 00620128 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klif.sys
2013-06-01 20:17 - 2013-06-01 20:09 - 00090208 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\klflt.sys
2013-06-01 20:17 - 2012-08-13 16:49 - 00178448 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\kneps.sys
2013-06-01 20:17 - 2012-07-25 14:53 - 00029528 ____A (Kaspersky Lab) C:\Windows\System32\Drivers\klmouflt.sys
2013-06-01 20:17 - 2012-06-08 11:38 - 00055056 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\kltdi.sys
2013-06-01 20:17 - 2012-05-25 19:38 - 00029016 ____A (Kaspersky Lab) C:\Windows\System32\Drivers\klkbdflt.sys
2013-06-01 20:10 - 2013-06-01 20:10 - 00002344 ____A C:\Users\user\Desktop\Sicherer Zahlungsverkehr.lnk
2013-06-01 20:09 - 2013-06-01 20:09 - 00001146 ____A C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
2013-06-01 20:09 - 2013-06-01 20:09 - 00000000 ____D C:\Windows\ELAMBKUP
2013-06-01 20:09 - 2013-06-01 20:09 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-06-01 20:04 - 2013-06-01 19:59 - 165991240 ____A (Kaspersky Lab) C:\Users\user\Downloads\kis13.0.1.4190DE_3575.exe
2013-06-01 19:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-06-01 19:47 - 2013-02-22 16:25 - 00000000 ____D C:\Users\user\AppData\Roaming\NVIDIA
2013-06-01 19:47 - 2012-06-27 16:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-01 15:51 - 2012-12-12 00:18 - 00000000 ____D C:\Users\user\AppData\Roaming\TS3Client
2013-06-01 15:50 - 2013-02-22 16:18 - 00000000 ____D C:\Program Files\DivX
2013-06-01 15:50 - 2013-02-22 16:17 - 00000000 ____D C:\ProgramData\DivX
2013-06-01 15:50 - 2013-02-22 16:17 - 00000000 ____D C:\Program Files (x86)\DivX
2013-06-01 15:49 - 2012-12-27 01:32 - 00000000 ____D C:\ProgramData\Origin
2013-06-01 15:36 - 2013-06-01 01:11 - 00291088 ____A C:\Windows\SysWOW64\PnkBstrB.xtr
2013-06-01 15:36 - 2013-05-31 23:45 - 00280904 ____A C:\Windows\SysWOW64\PnkBstrB.ex0
2013-06-01 03:12 - 2013-06-01 03:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-01 02:22 - 2013-04-29 22:55 - 00050966 ____A C:\Windows\DirectX.log
2013-06-01 01:56 - 2013-06-01 01:56 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-06-01 01:35 - 2012-12-27 01:32 - 00000000 ____D C:\Users\user\AppData\Roaming\Origin
2013-06-01 01:20 - 2013-06-01 01:20 - 00262144 ____A C:\Windows\System32\config\elam
2013-06-01 01:20 - 2013-06-01 01:20 - 00000000 ____D C:\Users\user\AppData\Roaming\EvolutionClips
2013-06-01 01:11 - 2013-06-01 01:11 - 00000000 ____D C:\Users\user\AppData\Local\PunkBuster
2013-06-01 00:38 - 2013-06-01 00:38 - 00000000 ____D C:\Users\user\AppData\Local\ESN
2013-05-31 23:47 - 2012-12-27 01:31 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-05-31 23:28 - 2013-04-15 18:07 - 00000000 ____D C:\Users\user\Desktop\Spiele
2013-05-28 22:02 - 2013-04-15 20:56 - 00000000 ____D C:\Users\Coskun\Desktop\Gizem-Uni
2013-05-28 21:13 - 2013-05-28 21:13 - 00600280 ____A C:\Users\Coskun\Desktop\Psychische Bedingungen.pptx
2013-05-22 21:08 - 2013-05-22 20:51 - 00000000 ____D C:\Users\user\Desktop\Vorträge
2013-05-17 12:55 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-05-16 21:25 - 2012-06-27 15:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-16 21:25 - 2012-06-27 15:36 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-16 20:51 - 2009-07-14 06:45 - 00311104 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-16 19:34 - 2012-11-01 19:13 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-10 16:32 - 2013-05-10 16:26 - 00000000 ____D C:\Users\Coskun\AppData\Local\Microsoft Games
2013-05-10 12:07 - 2013-05-10 12:07 - 00000000 ____D C:\Users\user\Desktop\left4deadUncut
2013-05-09 18:41 - 2013-05-09 18:41 - 00000000 ____D C:\Windows\pss
2013-05-09 17:50 - 2013-05-09 17:49 - 00000000 ____D C:\Users\user\Desktop\Desktop-xCore0320
2013-05-07 22:53 - 2013-05-07 14:20 - 00011865 ____A C:\Users\Coskun\Desktop\The Structure of Power_Imber.odt
2013-05-07 10:28 - 2013-05-07 10:28 - 00004032 ____A C:\Windows\SysWOW64\jupdate-1.7.0_21-b11.log
2013-05-07 10:28 - 2013-03-16 11:41 - 00000000 ____D C:\Program Files (x86)\Java

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


Last Boot: 2013-05-26 18:24

==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-06-2013 02
Ran by user at 2013-06-04 10:19:51 Run:
Running from C:\Users\user\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe Flash Player 11 ActiveX (Version: 11.7.700.202)
Adobe Flash Player 11 Plugin (Version: 11.7.700.202)
Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03)
Apple Application Support (Version: 2.3.3)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Bonjour (Version: 3.0.0.10)
C-Media PCI Audio Device
Counter-Strike: Global Offensive
Counter-Strike: Source
DAEMON Tools Lite (Version: 4.46.1.0327)
GIGABYTE OC_GURU II (Version: 1.10.0000)
Google Chrome (Version: 22.0.1229.94)
Google Update Helper (Version: 1.3.21.123)
Hitman Absolution (Version: 1.0433.1)
Intel(R) Management Engine Components (Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (Version: 10.1.0.1008)
iTunes (Version: 11.0.2.26)
Java 7 Update 21 (Version: 7.0.210)
Java Auto Updater (Version: 2.1.9.5)
JavaFX 2.1.1 (Version: 2.1.1)
Kaspersky Internet Security 2013 (Version: 13.0.1.4190)
Left 4 Dead
Left 4 Dead 2
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 15.0.1 (x86 de) (Version: 15.0.1)
Mozilla Firefox 20.0.1 (x86 de) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
NVIDIA 3D Vision Controller-Treiber 310.70 (Version: 310.70)
NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)
NVIDIA Grafiktreiber 311.06 (Version: 311.06)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA PhysX (Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1106)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
Realtek Ethernet Controller Driver For Windows 7 (Version: 7.23.623.2010)
Realtek High Definition Audio Driver (Version: 6.0.1.6167)
Steam (Version: 1.0.0.0)
TeamSpeak 3 Client (Version: 3.0.6)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
WinRAR 4.20 (32-Bit) (Version: 4.20.0)
Wireless Keyboard Driver (Version: 1.00.0000)
YTD Video Downloader 3.9.6 (Version: 3.9.6)

==================== Restore Points  =========================

31-05-2013 21:44:32 DirectX wurde installiert
01-06-2013 00:22:01 DirectX wurde installiert
01-06-2013 13:51:51 Windows Update
03-06-2013 21:34:11 ComboFix created restore point

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/04/2013 10:04:49 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/03/2013 10:00:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/03/2013 08:17:12 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/03/2013 07:43:28 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2496

Error: (06/03/2013 07:43:28 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2496

Error: (06/03/2013 07:43:28 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/03/2013 07:43:27 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1248

Error: (06/03/2013 07:43:27 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1248

Error: (06/03/2013 07:43:27 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/03/2013 07:33:00 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (06/04/2013 10:14:43 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/04/2013 10:14:31 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (06/04/2013 10:14:31 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (06/04/2013 10:13:43 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/04/2013 10:04:56 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/04/2013 10:04:56 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/04/2013 10:04:56 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (06/03/2013 11:37:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/03/2013 11:37:05 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (06/03/2013 11:36:05 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-06-04 10:14:31.189
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-04 10:14:31.163
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-04 10:14:31.137
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-04 10:14:31.112
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-03 23:37:05.613
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-03 23:37:05.588
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume4\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-02 22:09:09.598
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-02 22:09:09.597
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-02 22:09:09.596
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-06-02 22:09:09.593
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume4\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 21%
Total physical RAM: 8174.68 MB
Available physical RAM: 6408.48 MB
Total Pagefile: 16347.54 MB
Available Pagefile: 14583.09 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.14 GB) (Free:52.81 GB) NTFS (Disk=1 Partition=2)
Drive f: (CH_GG) (Fixed) (Total:931.39 GB) (Free:871.28 GB) NTFS (Disk=0 Partition=2)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 1C5F82AF)

Partition: GPT Partition Type
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119 GB) (Disk ID: 69C25DF9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Vielen Dank!

schrauber 04.06.2013 09:37
Downloade dir bitte Rogue Killer von hier.
  • Speichere das Tool auf deinem Desktop !
  • Schließe alle laufenden Programme.
  • Starte die RogueKiller.exe
  • Warte bis Prescan abgeschlossen erscheint und klicke dann auf Scannen.
  • Wenn der Scan beendet wurde, klicke auf Bericht und poste diesen hier.
  • Du findest die Logdatei RKreport[1].txt auch auf deinem Desktop.
http://i121.photobucket.com/albums/o...iller/TRK2.png


RogueKiller ebenso auf löschen drücken, Log posten.

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches OTL log.

Chico92 04.06.2013 10:17
Ich habe beim ersten Mal Roguekiller nicht auf löschen am Ende gedrückt. Daher habe ich nochmal scannen lassen Report und dann löschen und nochmal Report

Code:
RogueKiller V8.5.4 [Mar 18 2013] durch Tigzy
mail: tigzyRK<at>gmail<dot>com

mail : tigzyRK<at>gmail<dot>com
Kommentare : hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Webseite : hxxp://tigzy.geekstogo.com/roguekiller.php
Blog : hxxp://tigzyrk.blogspot.com/

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Gestartet in : Normaler Modus
Benutzer : user [Admin Rechte]
Funktion : Scannen -- Datum : 06/04/2013 10:58:46
| ARK || FAK || MBR |

¤¤¤ Böswillige Prozesse : 1 ¤¤¤
[SUSP PATH] VSA.exe -- C:\Users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe [-] -> GELÖSCHT [TermProc]

¤¤¤ Registry-Einträge : 7 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : VSA (C:\Users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe) [-] -> GEFUNDEN
[RUN][BLACKLISTDLL] HKLM\[...]\Run : CmPCIaudio (C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd) -> GEFUNDEN
[RUN][SUSP PATH] HKUS\S-1-5-21-3283021801-1049289051-2429385278-1000[...]\Run : VSA (C:\Users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe) [-] -> GEFUNDEN
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> GEFUNDEN
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> GEFUNDEN
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> GEFUNDEN
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> GEFUNDEN

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤

¤¤¤ Treiber : [NICHT GELADEN] ¤¤¤

¤¤¤ Hosts-Datei: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1      localhost


¤¤¤ MBR überprüfen: ¤¤¤

+++++ PhysicalDrive0: Hitachi HDS721010DLE630 +++++
--- User ---
[MBR] 48c17ca3addb27db90e48a72c9e2df35
[BSP] 7b0570e4e56e21d7ecc6f98a0007fe54 : Empty MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0xee) [VISIBLE] Offset (sectors): 1 | Size: 2097151 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: SAMSUNG SSD 830 Series +++++
--- User ---
[MBR] b027cab9ec4b64146d4f6f336d721c05
[BSP] 81af7cfc88027d5546f85e5ddc1d4e39 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 122002 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Abgeschlossen : << RKreport[1]_S_06042013_02d1058.txt >>
RKreport[1]_S_06042013_02d1058.txt
Code:
RogueKiller V8.5.4 [Mar 18 2013] durch Tigzy
mail: tigzyRK<at>gmail<dot>com

mail : tigzyRK<at>gmail<dot>com
Kommentare : hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Webseite : hxxp://tigzy.geekstogo.com/roguekiller.php
Blog : hxxp://tigzyrk.blogspot.com/

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Gestartet in : Normaler Modus
Benutzer : user [Admin Rechte]
Funktion : Scannen -- Datum : 06/04/2013 11:01:59
| ARK || FAK || MBR |

¤¤¤ Böswillige Prozesse : 0 ¤¤¤

¤¤¤ Registry-Einträge : 7 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : VSA (C:\Users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe) [-] -> GEFUNDEN
[RUN][PREVRUN] HKLM\[...]\Run : CmPCIaudio (C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd) [7] -> GEFUNDEN
[RUN][SUSP PATH] HKUS\S-1-5-21-3283021801-1049289051-2429385278-1000[...]\Run : VSA (C:\Users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe) [-] -> GEFUNDEN
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> GEFUNDEN
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> GEFUNDEN
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> GEFUNDEN
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> GEFUNDEN

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤

¤¤¤ Treiber : [NICHT GELADEN] ¤¤¤

¤¤¤ Hosts-Datei: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1      localhost


¤¤¤ MBR überprüfen: ¤¤¤

+++++ PhysicalDrive0: Hitachi HDS721010DLE630 +++++
--- User ---
[MBR] 48c17ca3addb27db90e48a72c9e2df35
[BSP] 7b0570e4e56e21d7ecc6f98a0007fe54 : Empty MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0xee) [VISIBLE] Offset (sectors): 1 | Size: 2097151 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: SAMSUNG SSD 830 Series +++++
--- User ---
[MBR] b027cab9ec4b64146d4f6f336d721c05
[BSP] 81af7cfc88027d5546f85e5ddc1d4e39 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 122002 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Abgeschlossen : << RKreport[2]_S_06042013_02d1101.txt >>
RKreport[1]_S_06042013_02d1058.txt ; RKreport[2]_S_06042013_02d1101.txt
Code:
RogueKiller V8.5.4 [Mar 18 2013] durch Tigzy
mail: tigzyRK<at>gmail<dot>com

mail : tigzyRK<at>gmail<dot>com
Kommentare : hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Webseite : hxxp://tigzy.geekstogo.com/roguekiller.php
Blog : hxxp://tigzyrk.blogspot.com/

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Gestartet in : Normaler Modus
Benutzer : user [Admin Rechte]
Funktion : Entfernen -- Datum : 06/04/2013 11:02:40
| ARK || FAK || MBR |

¤¤¤ Böswillige Prozesse : 0 ¤¤¤

¤¤¤ Registry-Einträge : 5 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : VSA (C:\Users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe) [-] -> GELÖSCHT
[RUN][PREVRUN] HKLM\[...]\Run : CmPCIaudio (C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd) [7] -> GELÖSCHT
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> GELÖSCHT
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> ERSETZT (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> ERSETZT (0)

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤

¤¤¤ Treiber : [NICHT GELADEN] ¤¤¤

¤¤¤ Hosts-Datei: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1      localhost


¤¤¤ MBR überprüfen: ¤¤¤

+++++ PhysicalDrive0: Hitachi HDS721010DLE630 +++++
--- User ---
[MBR] 48c17ca3addb27db90e48a72c9e2df35
[BSP] 7b0570e4e56e21d7ecc6f98a0007fe54 : Empty MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0xee) [VISIBLE] Offset (sectors): 1 | Size: 2097151 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: SAMSUNG SSD 830 Series +++++
--- User ---
[MBR] b027cab9ec4b64146d4f6f336d721c05
[BSP] 81af7cfc88027d5546f85e5ddc1d4e39 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 122002 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Abgeschlossen : << RKreport[3]_D_06042013_02d1102.txt >>
RKreport[1]_S_06042013_02d1058.txt ; RKreport[2]_S_06042013_02d1101.txt ; RKreport[3]_D_06042013_02d1102.txt
Code:
# AdwCleaner v2.301 - Datei am 04/06/2013 um 11:04:38 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : user - USER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\user\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\Tarma Installer

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\AppDataLow\FoxyDeal
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\FoxyDeal
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\foxydeal_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\foxydeal_RASMANCS
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\aiennapmieppnpfhhogglccgepbdajan

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v15.0.1 (de)

-\\ Google Chrome v22.0.1229.94

*************************

AdwCleaner[S1].txt - [1560 octets] - [04/06/2013 11:04:38]

########## EOF - C:\AdwCleaner[S1].txt - [1620 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by user on 04.06.2013 at 11:07:17,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"
Successfully deleted: [Folder] "C:\Users\user\appdata\locallow\conduit"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"



~~~ FireFox

Successfully deleted: [File] C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\zym5a3q7.default\user.js
Emptied folder: C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\zym5a3q7.default\minidumps [3 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.06.2013 at 11:09:21,17
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
OTL logfile created on: 04.06.2013 11:10:21 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\user\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,49 Gb Available Physical Memory | 81,31% Memory free
15,96 Gb Paging File | 14,38 Gb Available in Paging File | 90,08% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 52,65 Gb Free Space | 44,19% Space Free | Partition Type: NTFS
Drive F: | 931,39 Gb Total Space | 871,28 Gb Free Space | 93,55% Space Free | Partition Type: NTFS
 
Computer Name: USER-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.03 19:44:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010.11.05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.11.05 23:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.04.30 17:33:22 | 000,846,336 | ---- | M] () -- C:\Program Files (x86)\Wireless Keyboard Driver\LedStatusApp.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.16 20:51:44 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll
MOD - [2013.05.16 20:51:34 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll
MOD - [2013.05.16 20:51:32 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.01.28 14:08:56 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2013.01.28 14:08:28 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2013.01.10 12:56:54 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ab54c04b3df40416205883b4049fe273\IAStorUtil.ni.dll
MOD - [2013.01.10 12:56:54 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\4d6518ef6ae8d6f005c49ab1c86de7fe\IAStorCommon.ni.dll
MOD - [2013.01.10 12:43:37 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 12:43:20 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.10 12:43:10 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.10 12:43:08 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.10 12:43:05 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2010.11.21 08:49:22 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.04.30 17:33:22 | 000,846,336 | ---- | M] () -- C:\Program Files (x86)\Wireless Keyboard Driver\LedStatusApp.exe
MOD - [2010.01.14 22:31:22 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Wireless Keyboard Driver\KHKEY.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.06.01 20:12:18 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Stopped] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP)
SRV - [2013.06.01 03:12:12 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.31 03:14:08 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.05.16 21:25:09 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.12.03 17:47:14 | 001,259,880 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2010.11.05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.06.01 20:17:34 | 000,620,128 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)
DRV:64bit: - [2013.06.01 20:17:34 | 000,178,448 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kneps.sys -- (kneps)
DRV:64bit: - [2013.06.01 20:17:34 | 000,055,056 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kltdi.sys -- (kltdi)
DRV:64bit: - [2013.06.01 20:17:34 | 000,029,528 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2013.06.01 20:17:34 | 000,029,016 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klkbdflt.sys -- (klkbdflt)
DRV:64bit: - [2012.12.25 22:45:28 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.08.02 15:09:34 | 000,028,504 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)
DRV:64bit: - [2012.07.03 17:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.06.19 17:28:12 | 000,458,584 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (kl1)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.05 23:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.10.19 16:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.06.23 11:10:56 | 000,344,680 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.19 17:26:34 | 001,154,560 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cmudax3.sys -- (cmuda3)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C3 2C E2 41 E5 95 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: %7Baff87fa2-a58e-4edd-b852-0a20203c1e17%7D:0.9
FF - prefs.js..extensions.enabledAddons: url_advisor%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: virtual_keyboard%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: content_blocker%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: anti_banner%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: online_banking%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.01 03:12:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.01 03:12:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.01 03:12:13 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.01 03:12:09 | 000,000,000 | ---D | M]
 
[2012.12.12 02:11:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Extensions
[2013.06.01 01:25:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\zym5a3q7.default\extensions
[2012.12.31 22:06:09 | 000,042,737 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\zym5a3q7.default\extensions\{aff87fa2-a58e-4edd-b852-0a20203c1e17}.xpi
[2013.02.22 16:29:43 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\zym5a3q7.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.06.01 03:12:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ANTI_BANNER@KASPERSKY.COM
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Content Blocker) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\CONTENT_BLOCKER@KASPERSKY.COM
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Safe Money) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ONLINE_BANKING@KASPERSKY.COM
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\URL_ADVISOR@KASPERSKY.COM
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Virtual Keyboard) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\VIRTUAL_KEYBOARD@KASPERSKY.COM
[2013.06.01 03:12:13 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.06.01 03:12:11 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.06.01 03:12:11 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.06.01 03:12:11 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.06.01 03:12:11 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.06.01 03:12:11 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.06.01 03:12:11 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.138\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = F:\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = F:\Google\Chrome\Application\22.0.1229.94\pdf.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\plugin/npUrlAdvisor.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0\plugin/online_banking_npapi.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4190_0\plugin/npVKPlugin.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0\plugin/npABPlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - Extension: YouTube = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4.1_0\
CHR - Extension: Google-Suche = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Modul zur Link-Untersuchung = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\
CHR - Extension: Sicherer Zahlungsverkehr = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0\
CHR - Extension: Virtuelle Tastatur = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0\
CHR - Extension: Auto-Translate = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\obgoiaeapddkeekbocomnjlckbbfapmk\2.0.3_0\
CHR - Extension: Google Mail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Anti-Banner = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0\
 
O1 HOSTS File: ([2013.06.04 10:14:41 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [WIRELESS-KB-LED-STATUS] C:\Program Files (x86)\Wireless Keyboard Driver\LedStatusApp.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4C23480-88A7-4EC6-98D2-1963C42D7085}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.04 11:07:16 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.06.04 11:06:58 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.04 11:05:52 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.04 10:57:59 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\RK_Quarantine
[2013.06.04 10:55:47 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\user\Desktop\JRT.exe
[2013.06.04 10:19:32 | 000,000,000 | ---D | C] -- C:\FRST
[2013.06.04 10:18:14 | 001,916,714 | ---- | C] (Farbar) -- C:\Users\user\Desktop\FRST64.exe
[2013.06.04 10:15:32 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.06.04 10:05:44 | 005,077,441 | R--- | C] (Swearware) -- C:\Users\user\Desktop\ComboFix.exe
[2013.06.03 23:34:10 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.06.03 23:34:10 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.06.03 23:34:10 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.06.03 23:34:08 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.06.03 23:34:03 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.06.03 19:44:40 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2013.06.01 20:09:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2013
[2013.06.01 20:09:10 | 000,064,856 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\klfphc.dll
[2013.06.01 20:09:05 | 000,000,000 | ---D | C] -- C:\Windows\ELAMBKUP
[2013.06.01 20:09:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2013.06.01 20:09:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kaspersky Lab
[2013.06.01 20:09:02 | 000,620,128 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klif.sys
[2013.06.01 20:09:02 | 000,090,208 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klflt.sys
[2013.06.01 03:12:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.06.01 01:56:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games
[2013.06.01 01:20:07 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\EvolutionClips
[2013.06.01 01:11:30 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\PunkBuster
[2013.06.01 00:38:50 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\ESN
[2013.05.31 23:45:25 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller
[2013.05.22 20:51:41 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Vorträge
[2013.05.16 19:33:10 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.05.16 19:33:10 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.05.16 19:33:10 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.05.16 19:33:09 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.05.16 19:33:09 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.05.16 19:33:09 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.05.16 19:33:09 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.05.16 19:33:09 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.05.16 19:33:09 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.05.16 19:33:09 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.05.16 19:33:09 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.05.16 19:33:09 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.05.16 19:33:08 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.05.16 19:33:08 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.05.16 19:33:08 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.05.16 18:34:06 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013.05.16 18:34:06 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013.05.16 18:34:04 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013.05.16 18:34:04 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013.05.16 18:34:04 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013.05.16 18:34:04 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013.05.16 18:34:02 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013.05.10 12:07:25 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\left4deadUncut
[2013.05.09 18:41:40 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2013.05.09 17:49:09 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Desktop-xCore0320
[2013.05.07 10:28:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.04 11:09:58 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.04 11:09:58 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.04 11:09:58 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.04 11:09:58 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.04 11:09:58 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.04 11:05:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.04 11:05:43 | 2133,856,255 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.04 10:55:56 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\user\Desktop\JRT.exe
[2013.06.04 10:52:14 | 000,632,031 | ---- | M] () -- C:\Users\user\Desktop\adwcleaner.exe
[2013.06.04 10:49:19 | 000,816,128 | ---- | M] () -- C:\Users\user\Desktop\RogueKiller_8.5.4.exe
[2013.06.04 10:19:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.04 10:18:25 | 001,916,714 | ---- | M] (Farbar) -- C:\Users\user\Desktop\FRST64.exe
[2013.06.04 10:14:41 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.04 10:09:58 | 000,021,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.04 10:09:58 | 000,021,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.04 10:06:12 | 005,077,441 | R--- | M] (Swearware) -- C:\Users\user\Desktop\ComboFix.exe
[2013.06.03 22:42:05 | 000,026,311 | ---- | M] () -- C:\Users\user\Desktop\virus.JPG
[2013.06.03 19:46:51 | 000,000,154 | ---- | M] () -- C:\Users\user\defogger_reenable
[2013.06.03 19:45:54 | 000,377,856 | ---- | M] () -- C:\Users\user\Desktop\gmer_2.1.19163.exe
[2013.06.03 19:44:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2013.06.01 20:17:34 | 000,620,128 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klif.sys
[2013.06.01 20:17:34 | 000,178,448 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kneps.sys
[2013.06.01 20:17:34 | 000,090,208 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klflt.sys
[2013.06.01 20:17:34 | 000,055,056 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kltdi.sys
[2013.06.01 20:17:34 | 000,029,528 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klmouflt.sys
[2013.06.01 20:17:34 | 000,029,016 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klkbdflt.sys
[2013.06.01 20:10:05 | 000,002,344 | ---- | M] () -- C:\Users\user\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.06.01 20:09:10 | 000,001,146 | ---- | M] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013.06.01 15:36:34 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.06.01 15:36:10 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.05.16 21:25:09 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.05.16 21:25:09 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.16 20:51:21 | 000,311,104 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2013.06.04 10:52:11 | 000,632,031 | ---- | C] () -- C:\Users\user\Desktop\adwcleaner.exe
[2013.06.04 10:49:12 | 000,816,128 | ---- | C] () -- C:\Users\user\Desktop\RogueKiller_8.5.4.exe
[2013.06.03 23:34:10 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.06.03 23:34:10 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.06.03 23:34:10 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.06.03 23:34:10 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.06.03 23:34:10 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.06.03 22:42:05 | 000,026,311 | ---- | C] () -- C:\Users\user\Desktop\virus.JPG
[2013.06.03 19:57:15 | 000,377,856 | ---- | C] () -- C:\Users\user\Desktop\gmer_2.1.19163.exe
[2013.06.03 19:46:51 | 000,000,154 | ---- | C] () -- C:\Users\user\defogger_reenable
[2013.06.01 20:10:05 | 000,002,344 | ---- | C] () -- C:\Users\user\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.06.01 20:09:14 | 000,001,146 | ---- | C] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013.06.01 01:11:34 | 000,291,088 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.05.31 23:45:06 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.01.16 01:09:18 | 000,003,584 | ---- | C] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.01.06 12:44:15 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2013.01.06 12:44:15 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD2030.DAT
[2012.10.31 22:46:17 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\VmixP6.dll
[2012.10.31 22:46:17 | 000,000,339 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.cfl
[2012.10.31 22:46:09 | 000,002,641 | ---- | C] () -- C:\Windows\cmudax3.ini
[2012.10.31 22:46:09 | 000,002,123 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.cfg
[2012.10.31 22:46:09 | 000,000,146 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.imi
[2012.06.27 16:00:54 | 000,000,680 | RHS- | C] () -- C:\Users\user\ntuser.pol
[2012.06.27 15:31:52 | 000,017,408 | ---- | C] () -- C:\Users\user\AppData\Local\WebpageIcons.db
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
Vielen Dank!

schrauber 04.06.2013 10:38

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches OTL log. Noch Probleme?

Chico92 04.06.2013 12:22
Liste der Anhänge anzeigen (Anzahl: 1)
Als ich nachdem ESET Scanner den Security Check laufen lassen wollte hat der immer ein Fehler gehabt und konnte nicht starten. Dann habe ich neustart gemacht und dann ging es.

Bei Kaspersky zeigt der aber immer noch die Bedrohung an 3mal

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4cbd319cf2823742bf092c514f3a7e09
# engine=13987
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-04 10:24:16
# local_time=2013-06-04 12:24:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1286 16777214 100 98 4275 25111378 0 0
# compatibility_mode=5893 16776573 100 94 4109 121971306 0 0
# scanned=227020
# found=0
# cleaned=0
# scan_time=2109
Code:
Results of screen317's Security Check version 0.99.64 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 10 
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
Kaspersky Internet Security 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 JavaFX 2.1.1   
 Java 7 Update 21 
 Adobe Flash Player 11.7.700.202 
 Adobe Reader XI 
 Mozilla Firefox 15.0.1 Firefox out of Date! 
````````Process Check: objlist.exe by Laurent```````` 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
Code:
OTL logfile created on: 04.06.2013 13:14:34 - Run 5
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\user\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,62 Gb Available Physical Memory | 82,97% Memory free
15,96 Gb Paging File | 14,52 Gb Available in Paging File | 90,96% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 51,98 Gb Free Space | 43,63% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 430,35 Gb Free Space | 92,40% Space Free | Partition Type: NTFS
Drive F: | 931,39 Gb Total Space | 871,28 Gb Free Space | 93,55% Space Free | Partition Type: NTFS
 
Computer Name: USER-PC | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.03 19:44:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
PRC - [2013.06.01 20:12:18 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010.11.05 23:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.04.30 17:33:22 | 000,846,336 | ---- | M] () -- C:\Program Files (x86)\Wireless Keyboard Driver\LedStatusApp.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.16 20:51:44 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll
MOD - [2013.05.16 20:51:32 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll
MOD - [2013.01.28 14:08:56 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2013.01.28 14:08:28 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2013.01.10 12:56:54 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ab54c04b3df40416205883b4049fe273\IAStorUtil.ni.dll
MOD - [2013.01.10 12:43:37 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 12:43:20 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.10 12:43:10 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.10 12:43:08 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.10 12:43:05 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.08.17 21:38:56 | 000,479,160 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
MOD - [2010.11.21 08:49:22 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.04.30 17:33:22 | 000,846,336 | ---- | M] () -- C:\Program Files (x86)\Wireless Keyboard Driver\LedStatusApp.exe
MOD - [2010.01.14 22:31:22 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Wireless Keyboard Driver\KHKEY.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.06.01 20:12:18 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP)
SRV - [2013.06.01 03:12:12 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.05.31 03:14:08 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.05.16 21:25:09 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.12.03 17:47:14 | 001,259,880 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2010.11.05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.06.01 20:17:34 | 000,620,128 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)
DRV:64bit: - [2013.06.01 20:17:34 | 000,178,448 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kneps.sys -- (kneps)
DRV:64bit: - [2013.06.01 20:17:34 | 000,055,056 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kltdi.sys -- (kltdi)
DRV:64bit: - [2013.06.01 20:17:34 | 000,029,528 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2013.06.01 20:17:34 | 000,029,016 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klkbdflt.sys -- (klkbdflt)
DRV:64bit: - [2012.12.25 22:45:28 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.08.02 15:09:34 | 000,028,504 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)
DRV:64bit: - [2012.07.03 17:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.06.19 17:28:12 | 000,458,584 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (kl1)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.05 23:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.10.19 16:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.06.23 11:10:56 | 000,344,680 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.19 17:26:34 | 001,154,560 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cmudax3.sys -- (cmuda3)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C3 2C E2 41 E5 95 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: %7Baff87fa2-a58e-4edd-b852-0a20203c1e17%7D:0.9
FF - prefs.js..extensions.enabledAddons: url_advisor%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: virtual_keyboard%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: content_blocker%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: anti_banner%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: online_banking%40kaspersky.com:13.0.1.4307
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013.06.01 20:17:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.01 03:12:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.01 03:12:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.01 03:12:13 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.01 03:12:09 | 000,000,000 | ---D | M]
 
[2012.12.12 02:11:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Extensions
[2013.06.01 01:25:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\zym5a3q7.default\extensions
[2012.12.31 22:06:09 | 000,042,737 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\zym5a3q7.default\extensions\{aff87fa2-a58e-4edd-b852-0a20203c1e17}.xpi
[2013.02.22 16:29:43 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\zym5a3q7.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.06.01 03:12:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ANTI_BANNER@KASPERSKY.COM
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Content Blocker) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\CONTENT_BLOCKER@KASPERSKY.COM
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Safe Money) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ONLINE_BANKING@KASPERSKY.COM
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\URL_ADVISOR@KASPERSKY.COM
[2013.06.01 20:17:35 | 000,000,000 | ---D | M] (Virtual Keyboard) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\VIRTUAL_KEYBOARD@KASPERSKY.COM
[2013.06.01 03:12:13 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.06.01 03:12:11 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.06.01 03:12:11 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.06.01 03:12:11 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.06.01 03:12:11 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.06.01 03:12:11 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.06.01 03:12:11 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\11.5.31.138\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = F:\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = F:\Google\Chrome\Application\22.0.1229.94\pdf.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\plugin/npUrlAdvisor.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0\plugin/online_banking_npapi.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4190_0\plugin/npVKPlugin.dll
CHR - plugin: Kaspersky Anti-Virus (Enabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0\plugin/npABPlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - Extension: YouTube = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4.1_0\
CHR - Extension: Google-Suche = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Modul zur Link-Untersuchung = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\
CHR - Extension: Sicherer Zahlungsverkehr = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0\
CHR - Extension: Virtuelle Tastatur = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0\
CHR - Extension: Auto-Translate = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\obgoiaeapddkeekbocomnjlckbbfapmk\2.0.3_0\
CHR - Extension: Google Mail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Anti-Banner = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0\
 
O1 HOSTS File: ([2013.06.04 10:14:41 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [WIRELESS-KB-LED-STATUS] C:\Program Files (x86)\Wireless Keyboard Driver\LedStatusApp.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4C23480-88A7-4EC6-98D2-1963C42D7085}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.06.06 17:25:34 | 000,000,031 | RH-- | M] () - E:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.04 11:07:16 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.06.04 11:06:58 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.04 11:05:52 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.04 10:57:59 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\RK_Quarantine
[2013.06.04 10:55:47 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\user\Desktop\JRT.exe
[2013.06.04 10:19:32 | 000,000,000 | ---D | C] -- C:\FRST
[2013.06.04 10:18:14 | 001,916,714 | ---- | C] (Farbar) -- C:\Users\user\Desktop\FRST64.exe
[2013.06.04 10:15:32 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.06.04 10:05:44 | 005,077,441 | R--- | C] (Swearware) -- C:\Users\user\Desktop\ComboFix.exe
[2013.06.03 23:34:10 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.06.03 23:34:10 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.06.03 23:34:10 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.06.03 23:34:08 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.06.03 23:34:03 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.06.03 19:44:40 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2013.06.01 20:09:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2013
[2013.06.01 20:09:10 | 000,064,856 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\klfphc.dll
[2013.06.01 20:09:05 | 000,000,000 | ---D | C] -- C:\Windows\ELAMBKUP
[2013.06.01 20:09:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2013.06.01 20:09:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kaspersky Lab
[2013.06.01 20:09:02 | 000,620,128 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klif.sys
[2013.06.01 20:09:02 | 000,090,208 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klflt.sys
[2013.06.01 03:12:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.06.01 01:56:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games
[2013.06.01 01:20:07 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\EvolutionClips
[2013.06.01 01:11:30 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\PunkBuster
[2013.06.01 00:38:50 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\ESN
[2013.05.31 23:45:25 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller
[2013.05.22 20:51:41 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Vorträge
[2013.05.10 12:07:25 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\left4deadUncut
[2013.05.09 18:41:40 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2013.05.09 17:49:09 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Desktop-xCore0320
[2013.05.07 10:28:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.04 13:12:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.04 13:12:51 | 2133,856,255 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.04 13:12:30 | 000,021,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.04 13:12:30 | 000,021,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.04 13:07:18 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.04 13:07:18 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.04 13:07:18 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.04 13:07:18 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.04 13:07:18 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.04 12:19:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.04 11:45:55 | 000,890,839 | ---- | M] () -- C:\Users\user\Desktop\SecurityCheck.exe
[2013.06.04 10:55:56 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\user\Desktop\JRT.exe
[2013.06.04 10:52:14 | 000,632,031 | ---- | M] () -- C:\Users\user\Desktop\adwcleaner.exe
[2013.06.04 10:49:19 | 000,816,128 | ---- | M] () -- C:\Users\user\Desktop\RogueKiller_8.5.4.exe
[2013.06.04 10:18:25 | 001,916,714 | ---- | M] (Farbar) -- C:\Users\user\Desktop\FRST64.exe
[2013.06.04 10:14:41 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.04 10:06:12 | 005,077,441 | R--- | M] (Swearware) -- C:\Users\user\Desktop\ComboFix.exe
[2013.06.03 22:42:05 | 000,026,311 | ---- | M] () -- C:\Users\user\Desktop\virus.JPG
[2013.06.03 19:46:51 | 000,000,154 | ---- | M] () -- C:\Users\user\defogger_reenable
[2013.06.03 19:45:54 | 000,377,856 | ---- | M] () -- C:\Users\user\Desktop\gmer_2.1.19163.exe
[2013.06.03 19:44:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2013.06.01 20:17:34 | 000,620,128 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klif.sys
[2013.06.01 20:17:34 | 000,178,448 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kneps.sys
[2013.06.01 20:17:34 | 000,090,208 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klflt.sys
[2013.06.01 20:17:34 | 000,055,056 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kltdi.sys
[2013.06.01 20:17:34 | 000,029,528 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klmouflt.sys
[2013.06.01 20:17:34 | 000,029,016 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klkbdflt.sys
[2013.06.01 20:10:05 | 000,002,344 | ---- | M] () -- C:\Users\user\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.06.01 20:09:10 | 000,001,146 | ---- | M] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013.06.01 15:36:34 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.06.01 15:36:10 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.05.16 20:51:21 | 000,311,104 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2013.06.04 11:45:50 | 000,890,839 | ---- | C] () -- C:\Users\user\Desktop\SecurityCheck.exe
[2013.06.04 10:52:11 | 000,632,031 | ---- | C] () -- C:\Users\user\Desktop\adwcleaner.exe
[2013.06.04 10:49:12 | 000,816,128 | ---- | C] () -- C:\Users\user\Desktop\RogueKiller_8.5.4.exe
[2013.06.03 23:34:10 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.06.03 23:34:10 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.06.03 23:34:10 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.06.03 23:34:10 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.06.03 23:34:10 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.06.03 22:42:05 | 000,026,311 | ---- | C] () -- C:\Users\user\Desktop\virus.JPG
[2013.06.03 19:57:15 | 000,377,856 | ---- | C] () -- C:\Users\user\Desktop\gmer_2.1.19163.exe
[2013.06.03 19:46:51 | 000,000,154 | ---- | C] () -- C:\Users\user\defogger_reenable
[2013.06.01 20:10:05 | 000,002,344 | ---- | C] () -- C:\Users\user\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.06.01 20:09:14 | 000,001,146 | ---- | C] () -- C:\Users\Public\Desktop\Kaspersky Internet Security 2013.lnk
[2013.06.01 01:11:34 | 000,291,088 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.05.31 23:45:06 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.01.16 01:09:18 | 000,003,584 | ---- | C] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.01.06 12:44:15 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2013.01.06 12:44:15 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD2030.DAT
[2012.10.31 22:46:17 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\VmixP6.dll
[2012.10.31 22:46:17 | 000,000,339 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.cfl
[2012.10.31 22:46:09 | 000,002,641 | ---- | C] () -- C:\Windows\cmudax3.ini
[2012.10.31 22:46:09 | 000,002,123 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.cfg
[2012.10.31 22:46:09 | 000,000,146 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.imi
[2012.06.27 16:00:54 | 000,000,680 | RHS- | C] () -- C:\Users\user\ntuser.pol
[2012.06.27 15:31:52 | 000,017,408 | ---- | C] () -- C:\Users\user\AppData\Local\WebpageIcons.db
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.12.25 22:46:29 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\DAEMON Tools Lite
[2013.06.01 01:20:07 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\EvolutionClips
[2012.11.01 01:30:36 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\LolClient
[2013.06.01 01:35:32 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Origin
[2013.06.04 10:46:34 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TS3Client
[2013.03.05 23:47:38 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ts3overlay
[2012.12.12 00:24:17 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ts3overlay_hook_win64
 
========== Purity Check ==========
 
 

< End of report >
Ich nehme mal an es ist ein Virus richtig?

Nun wie gesagt bei Kaspersky zeigt er das immernoch so an wie vor den ganzen Scanns usw. Das heißt ich weiß nicht ob alles ok ist.

Vielen Dank für die ganzen Bemühungen!

schrauber 04.06.2013 12:55
Downloade dir bitte Farbar's Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.
Poste bitte den Inhalt hier.


Klick in Kaspersky mal neben korrigieren auf den Pfeil. Kannste irgendwie an den genauen Dateipfad kommen oder das Logfile posten?

Chico92 04.06.2013 13:04
Liste der Anhänge anzeigen (Anzahl: 3)
Den Scann mache ich sofort, wollte nur schnell Screenshots zeigen. Also da sind ja drei Bedrouhungen alles die selben und da bei dem Pfeil konnte ich auf Ursprungsordner klicken und folgendes hat sich dann geöffnet...

Chico92 04.06.2013 13:11
Code:
Farbar Service Scanner Version: 31-05-2013 01
Ran by user (administrator) on 04-06-2013 at 14:10:31
Running from "C:\Users\user\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

schrauber 04.06.2013 14:30
Combofix löschen, neu laden und laufen lassen.

Chico92 04.06.2013 15:12
Code:
ComboFix 13-06-03.06 - user 04.06.2013  16:07:16.3.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8175.6887 [GMT 2:00]
ausgeführt von:: c:\users\user\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
E:\Autorun.inf
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-05-04 bis 2013-06-04  ))))))))))))))))))))))))))))))
.
.
2013-06-04 14:09 . 2013-06-04 14:09        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2013-06-04 14:09 . 2013-06-04 14:09        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-06-04 14:09 . 2013-06-04 14:09        --------        d-----w-        c:\users\Coskun\AppData\Local\temp
2013-06-04 09:07 . 2013-06-04 09:07        --------        d-----w-        c:\windows\ERUNT
2013-06-04 09:06 . 2013-06-04 09:06        --------        d-----w-        C:\JRT
2013-06-04 08:19 . 2013-06-04 08:19        --------        d-----w-        C:\FRST
2013-06-01 18:09 . 2012-07-11 15:09        64856        ----a-w-        c:\windows\system32\klfphc.dll
2013-06-01 18:09 . 2013-06-01 18:09        --------        d-----w-        c:\windows\ELAMBKUP
2013-06-01 18:09 . 2013-06-04 13:34        --------        d-----w-        c:\programdata\Kaspersky Lab
2013-06-01 18:09 . 2013-06-01 18:09        --------        d-----w-        c:\program files (x86)\Kaspersky Lab
2013-06-01 18:09 . 2013-06-01 18:17        90208        ----a-w-        c:\windows\system32\drivers\klflt.sys
2013-06-01 18:09 . 2013-06-01 18:17        620128        ----a-w-        c:\windows\system32\drivers\klif.sys
2013-06-01 12:18 . 2013-04-23 15:03        87054        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libpdcurses.dll
2013-06-01 12:18 . 2013-04-23 15:03        45056        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\pthreadGC2.dll
2013-06-01 12:18 . 2013-04-23 15:03        323584        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\ssleay32.dll
2013-06-01 12:18 . 2013-04-23 15:03        309248        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libcurl-4.dll
2013-06-01 12:18 . 2013-04-23 15:03        224256        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libidn-11.dll
2013-06-01 12:18 . 2013-04-23 15:03        1479680        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libeay32.dll
2013-06-01 12:18 . 2013-04-23 15:03        122368        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\zlib1.dll
2013-06-01 12:18 . 2013-04-23 15:03        104960        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\libusb-1.0.dll
2013-06-01 12:18 . 2013-06-04 08:03        587776        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\IE10\7z.exe
2013-05-31 23:56 . 2013-05-31 23:56        --------        d-----w-        c:\program files (x86)\Origin Games
2013-05-31 23:20 . 2013-05-07 17:26        1751552        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe
2013-05-31 23:20 . 2013-05-31 23:20        --------        d-----w-        c:\users\user\AppData\Roaming\EvolutionClips
2013-05-31 23:11 . 2013-06-01 13:36        291088        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2013-05-31 23:11 . 2013-05-31 23:11        --------        d-----w-        c:\users\user\AppData\Local\PunkBuster
2013-05-31 22:38 . 2013-05-31 22:38        --------        d-----w-        c:\users\user\AppData\Local\ESN
2013-05-31 21:45 . 2013-06-01 13:49        --------        d--h--w-        c:\program files (x86)\Common Files\EAInstaller
2013-05-31 21:45 . 2013-06-01 13:36        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2013-05-31 15:05 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{69F6484B-E352-427F-A1ED-B1F8A1C7D4E2}\mpengine.dll
2013-05-16 16:34 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys
2013-05-10 14:26 . 2013-05-10 14:32        --------        d-----w-        c:\users\Coskun\AppData\Local\Microsoft Games
2013-05-07 08:28 . 2013-05-07 08:28        --------        d-----w-        c:\program files (x86)\Common Files\Java
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-01 18:17 . 2012-08-13 14:49        178448        ----a-w-        c:\windows\system32\drivers\kneps.sys
2013-06-01 18:17 . 2012-07-25 12:53        29528        ----a-w-        c:\windows\system32\drivers\klmouflt.sys
2013-06-01 18:17 . 2012-06-08 09:38        55056        ----a-w-        c:\windows\system32\drivers\kltdi.sys
2013-06-01 18:17 . 2012-05-25 17:38        29016        ----a-w-        c:\windows\system32\drivers\klkbdflt.sys
2013-05-16 19:25 . 2012-06-27 13:36        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-16 19:25 . 2012-06-27 13:36        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-16 17:34 . 2012-11-01 17:13        75016696        ----a-w-        c:\windows\system32\MRT.exe
2013-05-02 00:06 . 2010-11-21 03:27        278800        ------w-        c:\windows\system32\MpSigStub.exe
2013-04-30 12:52 . 2013-04-30 12:52        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2013-04-30 12:52 . 2013-04-30 12:52        226304        ----a-w-        c:\windows\system32\elshyph.dll
2013-04-30 12:52 . 2013-04-30 12:52        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll
2013-04-30 12:52 . 2013-04-30 12:52        158720        ----a-w-        c:\windows\SysWow64\msls31.dll
2013-04-30 12:52 . 2013-04-30 12:52        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2013-04-30 12:52 . 2013-04-30 12:52        138752        ----a-w-        c:\windows\SysWow64\wextract.exe
2013-04-30 12:52 . 2013-04-30 12:52        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-30 12:52 . 2013-04-30 12:52        97280        ----a-w-        c:\windows\system32\mshtmled.dll
2013-04-30 12:52 . 2013-04-30 12:52        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2013-04-30 12:52 . 2013-04-30 12:52        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2013-04-30 12:52 . 2013-04-30 12:52        81408        ----a-w-        c:\windows\system32\icardie.dll
2013-04-30 12:52 . 2013-04-30 12:52        77312        ----a-w-        c:\windows\system32\tdc.ocx
2013-04-30 12:52 . 2013-04-30 12:52        762368        ----a-w-        c:\windows\system32\ieapfltr.dll
2013-04-30 12:52 . 2013-04-30 12:52        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-30 12:52 . 2013-04-30 12:52        62976        ----a-w-        c:\windows\system32\pngfilt.dll
2013-04-30 12:52 . 2013-04-30 12:52        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx
2013-04-30 12:52 . 2013-04-30 12:52        599552        ----a-w-        c:\windows\system32\vbscript.dll
2013-04-30 12:52 . 2013-04-30 12:52        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll
2013-04-30 12:52 . 2013-04-30 12:52        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll
2013-04-30 12:52 . 2013-04-30 12:52        51200        ----a-w-        c:\windows\system32\imgutil.dll
2013-04-30 12:52 . 2013-04-30 12:52        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2013-04-30 12:52 . 2013-04-30 12:52        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2013-04-30 12:52 . 2013-04-30 12:52        452096        ----a-w-        c:\windows\system32\dxtmsft.dll
2013-04-30 12:52 . 2013-04-30 12:52        441856        ----a-w-        c:\windows\system32\html.iec
2013-04-30 12:52 . 2013-04-30 12:52        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll
2013-04-30 12:52 . 2013-04-30 12:52        361984        ----a-w-        c:\windows\SysWow64\html.iec
2013-04-30 12:52 . 2013-04-30 12:52        281600        ----a-w-        c:\windows\system32\dxtrans.dll
2013-04-30 12:52 . 2013-04-30 12:52        27648        ----a-w-        c:\windows\system32\licmgr10.dll
2013-04-30 12:52 . 2013-04-30 12:52        270848        ----a-w-        c:\windows\system32\iedkcs32.dll
2013-04-30 12:52 . 2013-04-30 12:52        247296        ----a-w-        c:\windows\system32\webcheck.dll
2013-04-30 12:52 . 2013-04-30 12:52        235008        ----a-w-        c:\windows\system32\url.dll
2013-04-30 12:52 . 2013-04-30 12:52        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2013-04-30 12:52 . 2013-04-30 12:52        216064        ----a-w-        c:\windows\system32\msls31.dll
2013-04-30 12:52 . 2013-04-30 12:52        197120        ----a-w-        c:\windows\system32\msrating.dll
2013-04-30 12:52 . 2013-04-30 12:52        173568        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-04-30 12:52 . 2013-04-30 12:52        167424        ----a-w-        c:\windows\system32\iexpress.exe
2013-04-30 12:52 . 2013-04-30 12:52        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-04-30 12:52 . 2013-04-30 12:52        149504        ----a-w-        c:\windows\system32\occache.dll
2013-04-30 12:52 . 2013-04-30 12:52        144896        ----a-w-        c:\windows\system32\wextract.exe
2013-04-30 12:52 . 2013-04-30 12:52        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2013-04-30 12:52 . 2013-04-30 12:52        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat
2013-04-30 12:52 . 2013-04-30 12:52        13824        ----a-w-        c:\windows\system32\mshta.exe
2013-04-30 12:52 . 2013-04-30 12:52        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2013-04-30 12:52 . 2013-04-30 12:52        136192        ----a-w-        c:\windows\system32\iepeers.dll
2013-04-30 12:52 . 2013-04-30 12:52        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll
2013-04-30 12:52 . 2013-04-30 12:52        12800        ----a-w-        c:\windows\SysWow64\mshta.exe
2013-04-30 12:52 . 2013-04-30 12:52        12800        ----a-w-        c:\windows\system32\msfeedssync.exe
2013-04-30 12:52 . 2013-04-30 12:52        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2013-04-30 12:52 . 2013-04-30 12:52        102912        ----a-w-        c:\windows\system32\inseng.dll
2013-04-13 05:49 . 2013-05-16 16:34        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 16:34        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 16:34        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 16:34        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 16:34        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 16:34        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 11:55        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2013-04-04 03:35 . 2013-03-16 09:41        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-19 06:04 . 2013-04-10 09:19        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 09:19        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 09:19        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 09:19        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 09:19        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 09:19        112640        ----a-w-        c:\windows\system32\smss.exe
2013-03-16 09:41 . 2012-06-27 13:35        861088        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2013-03-16 09:41 . 2012-06-27 13:35        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"WIRELESS-KB-LED-STATUS"="c:\program files (x86)\Wireless Keyboard Driver\LedStatusApp.exe" [2010-04-30 846336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2013-06-01 356376]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GIGABYTE OC_GURU.lnk - c:\program files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe [2011-6-4 17428480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AsrCDDrv;AsrCDDrv;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-27 19:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\zym5a3q7.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Google Chrome - c:\program files (x86)\Google\Chrome\Application\22.0.1229.94\Installer\setup.exe
AddRemove-Steam App 240 - c:\steam\steam.exe
AddRemove-Steam App 730 - c:\steam\steam.exe
AddRemove-{95030349-3623-4920-89BF-8BEC5EF311C5}_is1 - f:\neuer ordner\Hitman Absolution\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-04  16:09:57
ComboFix-quarantined-files.txt  2013-06-04 14:09
ComboFix2.txt  2013-06-04 08:15
ComboFix3.txt  2013-06-03 21:38
.
Vor Suchlauf: 20 Verzeichnis(se), 55.797.669.888 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 55.504.584.704 Bytes frei
.
- - End Of File - - 0AA889D2BBCB3BDC4DEC2A852834ACD6

schrauber 04.06.2013 17:11
Combofix-Skript
WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

  • Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
  • Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
  • Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
  • Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
    Code:
    Folder::
    c:\users\user\AppData\Roaming\Microsoft\IE10
  • Speichere dies als CFScript.txt auf deinem Desktop.
  • Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
  • Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  • Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
    Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!




Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.
SystemLook (64 bit)
  • Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
    Code:
    :filefind
    svhost.*
    :regfind
    svhost
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Der Suchlauf kann einige Zeit dauern.
  • Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
  • Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Chico92 04.06.2013 21:40
Code:
ComboFix 13-06-03.06 - user 04.06.2013  22:34:00.4.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8175.6658 [GMT 2:00]
ausgeführt von:: c:\users\user\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\user\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\user\AppData\Roaming\Microsoft\IE10
c:\users\user\AppData\Roaming\Microsoft\IE10\7z.exe
c:\users\user\AppData\Roaming\Microsoft\IE10\archiv.2ev
c:\users\user\AppData\Roaming\Microsoft\IE10\diakgcn121016.cl
c:\users\user\AppData\Roaming\Microsoft\IE10\err.txt
c:\users\user\AppData\Roaming\Microsoft\IE10\libcurl-4.dll
c:\users\user\AppData\Roaming\Microsoft\IE10\libeay32.dll
c:\users\user\AppData\Roaming\Microsoft\IE10\libidn-11.dll
c:\users\user\AppData\Roaming\Microsoft\IE10\libpdcurses.dll
c:\users\user\AppData\Roaming\Microsoft\IE10\libusb-1.0.dll
c:\users\user\AppData\Roaming\Microsoft\IE10\phatk121016.cl
c:\users\user\AppData\Roaming\Microsoft\IE10\poclbm121016.cl
c:\users\user\AppData\Roaming\Microsoft\IE10\poclbm121016GeForce GTX 670gv1w256l4.bin
c:\users\user\AppData\Roaming\Microsoft\IE10\pthreadGC2.dll
c:\users\user\AppData\Roaming\Microsoft\IE10\ssleay32.dll
c:\users\user\AppData\Roaming\Microsoft\IE10\zlib1.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-05-04 bis 2013-06-04  ))))))))))))))))))))))))))))))
.
.
2013-06-04 20:35 . 2013-06-04 20:35        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2013-06-04 20:35 . 2013-06-04 20:35        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-06-04 20:35 . 2013-06-04 20:35        --------        d-----w-        c:\users\Coskun\AppData\Local\temp
2013-06-04 20:32 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{8F1D4090-0762-40C5-8C07-4A13B8E217AE}\mpengine.dll
2013-06-04 09:07 . 2013-06-04 09:07        --------        d-----w-        c:\windows\ERUNT
2013-06-04 09:06 . 2013-06-04 09:06        --------        d-----w-        C:\JRT
2013-06-04 08:19 . 2013-06-04 08:19        --------        d-----w-        C:\FRST
2013-06-01 18:09 . 2012-07-11 15:09        64856        ----a-w-        c:\windows\system32\klfphc.dll
2013-06-01 18:09 . 2013-06-01 18:09        --------        d-----w-        c:\windows\ELAMBKUP
2013-06-01 18:09 . 2013-06-04 20:29        --------        d-----w-        c:\programdata\Kaspersky Lab
2013-06-01 18:09 . 2013-06-01 18:09        --------        d-----w-        c:\program files (x86)\Kaspersky Lab
2013-06-01 18:09 . 2013-06-01 18:17        90208        ----a-w-        c:\windows\system32\drivers\klflt.sys
2013-06-01 18:09 . 2013-06-01 18:17        620128        ----a-w-        c:\windows\system32\drivers\klif.sys
2013-05-31 23:56 . 2013-05-31 23:56        --------        d-----w-        c:\program files (x86)\Origin Games
2013-05-31 23:20 . 2013-05-07 17:26        1751552        ----a-w-        c:\users\user\AppData\Roaming\Microsoft\VSA\9.0\VSA.exe
2013-05-31 23:20 . 2013-05-31 23:20        --------        d-----w-        c:\users\user\AppData\Roaming\EvolutionClips
2013-05-31 23:11 . 2013-06-01 13:36        291088        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2013-05-31 23:11 . 2013-05-31 23:11        --------        d-----w-        c:\users\user\AppData\Local\PunkBuster
2013-05-31 22:38 . 2013-05-31 22:38        --------        d-----w-        c:\users\user\AppData\Local\ESN
2013-05-31 21:45 . 2013-06-01 13:49        --------        d--h--w-        c:\program files (x86)\Common Files\EAInstaller
2013-05-31 21:45 . 2013-06-01 13:36        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2013-05-16 16:34 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys
2013-05-10 14:26 . 2013-05-10 14:32        --------        d-----w-        c:\users\Coskun\AppData\Local\Microsoft Games
2013-05-07 08:28 . 2013-05-07 08:28        --------        d-----w-        c:\program files (x86)\Common Files\Java
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-01 18:17 . 2012-08-13 14:49        178448        ----a-w-        c:\windows\system32\drivers\kneps.sys
2013-06-01 18:17 . 2012-07-25 12:53        29528        ----a-w-        c:\windows\system32\drivers\klmouflt.sys
2013-06-01 18:17 . 2012-06-08 09:38        55056        ----a-w-        c:\windows\system32\drivers\kltdi.sys
2013-06-01 18:17 . 2012-05-25 17:38        29016        ----a-w-        c:\windows\system32\drivers\klkbdflt.sys
2013-05-16 19:25 . 2012-06-27 13:36        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-16 19:25 . 2012-06-27 13:36        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-16 17:34 . 2012-11-01 17:13        75016696        ----a-w-        c:\windows\system32\MRT.exe
2013-05-02 00:06 . 2010-11-21 03:27        278800        ------w-        c:\windows\system32\MpSigStub.exe
2013-04-30 12:52 . 2013-04-30 12:52        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2013-04-30 12:52 . 2013-04-30 12:52        226304        ----a-w-        c:\windows\system32\elshyph.dll
2013-04-30 12:52 . 2013-04-30 12:52        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll
2013-04-30 12:52 . 2013-04-30 12:52        158720        ----a-w-        c:\windows\SysWow64\msls31.dll
2013-04-30 12:52 . 2013-04-30 12:52        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2013-04-30 12:52 . 2013-04-30 12:52        138752        ----a-w-        c:\windows\SysWow64\wextract.exe
2013-04-30 12:52 . 2013-04-30 12:52        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-30 12:52 . 2013-04-30 12:52        97280        ----a-w-        c:\windows\system32\mshtmled.dll
2013-04-30 12:52 . 2013-04-30 12:52        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2013-04-30 12:52 . 2013-04-30 12:52        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2013-04-30 12:52 . 2013-04-30 12:52        81408        ----a-w-        c:\windows\system32\icardie.dll
2013-04-30 12:52 . 2013-04-30 12:52        77312        ----a-w-        c:\windows\system32\tdc.ocx
2013-04-30 12:52 . 2013-04-30 12:52        762368        ----a-w-        c:\windows\system32\ieapfltr.dll
2013-04-30 12:52 . 2013-04-30 12:52        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-30 12:52 . 2013-04-30 12:52        62976        ----a-w-        c:\windows\system32\pngfilt.dll
2013-04-30 12:52 . 2013-04-30 12:52        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx
2013-04-30 12:52 . 2013-04-30 12:52        599552        ----a-w-        c:\windows\system32\vbscript.dll
2013-04-30 12:52 . 2013-04-30 12:52        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll
2013-04-30 12:52 . 2013-04-30 12:52        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll
2013-04-30 12:52 . 2013-04-30 12:52        51200        ----a-w-        c:\windows\system32\imgutil.dll
2013-04-30 12:52 . 2013-04-30 12:52        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2013-04-30 12:52 . 2013-04-30 12:52        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2013-04-30 12:52 . 2013-04-30 12:52        452096        ----a-w-        c:\windows\system32\dxtmsft.dll
2013-04-30 12:52 . 2013-04-30 12:52        441856        ----a-w-        c:\windows\system32\html.iec
2013-04-30 12:52 . 2013-04-30 12:52        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll
2013-04-30 12:52 . 2013-04-30 12:52        361984        ----a-w-        c:\windows\SysWow64\html.iec
2013-04-30 12:52 . 2013-04-30 12:52        281600        ----a-w-        c:\windows\system32\dxtrans.dll
2013-04-30 12:52 . 2013-04-30 12:52        27648        ----a-w-        c:\windows\system32\licmgr10.dll
2013-04-30 12:52 . 2013-04-30 12:52        270848        ----a-w-        c:\windows\system32\iedkcs32.dll
2013-04-30 12:52 . 2013-04-30 12:52        247296        ----a-w-        c:\windows\system32\webcheck.dll
2013-04-30 12:52 . 2013-04-30 12:52        235008        ----a-w-        c:\windows\system32\url.dll
2013-04-30 12:52 . 2013-04-30 12:52        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2013-04-30 12:52 . 2013-04-30 12:52        216064        ----a-w-        c:\windows\system32\msls31.dll
2013-04-30 12:52 . 2013-04-30 12:52        197120        ----a-w-        c:\windows\system32\msrating.dll
2013-04-30 12:52 . 2013-04-30 12:52        173568        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-04-30 12:52 . 2013-04-30 12:52        167424        ----a-w-        c:\windows\system32\iexpress.exe
2013-04-30 12:52 . 2013-04-30 12:52        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-04-30 12:52 . 2013-04-30 12:52        149504        ----a-w-        c:\windows\system32\occache.dll
2013-04-30 12:52 . 2013-04-30 12:52        144896        ----a-w-        c:\windows\system32\wextract.exe
2013-04-30 12:52 . 2013-04-30 12:52        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2013-04-30 12:52 . 2013-04-30 12:52        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat
2013-04-30 12:52 . 2013-04-30 12:52        13824        ----a-w-        c:\windows\system32\mshta.exe
2013-04-30 12:52 . 2013-04-30 12:52        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2013-04-30 12:52 . 2013-04-30 12:52        136192        ----a-w-        c:\windows\system32\iepeers.dll
2013-04-30 12:52 . 2013-04-30 12:52        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll
2013-04-30 12:52 . 2013-04-30 12:52        12800        ----a-w-        c:\windows\SysWow64\mshta.exe
2013-04-30 12:52 . 2013-04-30 12:52        12800        ----a-w-        c:\windows\system32\msfeedssync.exe
2013-04-30 12:52 . 2013-04-30 12:52        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2013-04-30 12:52 . 2013-04-30 12:52        102912        ----a-w-        c:\windows\system32\inseng.dll
2013-04-13 05:49 . 2013-05-16 16:34        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 16:34        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 16:34        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 16:34        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 16:34        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 16:34        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 11:55        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2013-04-04 03:35 . 2013-03-16 09:41        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-19 06:04 . 2013-04-10 09:19        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 09:19        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 09:19        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 09:19        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 09:19        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 09:19        112640        ----a-w-        c:\windows\system32\smss.exe
2013-03-16 09:41 . 2012-06-27 13:35        861088        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2013-03-16 09:41 . 2012-06-27 13:35        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"WIRELESS-KB-LED-STATUS"="c:\program files (x86)\Wireless Keyboard Driver\LedStatusApp.exe" [2010-04-30 846336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2013-06-01 356376]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GIGABYTE OC_GURU.lnk - c:\program files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe [2011-6-4 17428480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AsrCDDrv;AsrCDDrv;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-27 19:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\zym5a3q7.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Google Chrome - c:\program files (x86)\Google\Chrome\Application\22.0.1229.94\Installer\setup.exe
AddRemove-Steam App 240 - c:\steam\steam.exe
AddRemove-Steam App 730 - c:\steam\steam.exe
AddRemove-{95030349-3623-4920-89BF-8BEC5EF311C5}_is1 - f:\neuer ordner\Hitman Absolution\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-04  22:36:46
ComboFix-quarantined-files.txt  2013-06-04 20:36
ComboFix2.txt  2013-06-04 14:09
ComboFix3.txt  2013-06-04 08:15
ComboFix4.txt  2013-06-03 21:38
.
Vor Suchlauf: 20 Verzeichnis(se), 55.545.696.256 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 55.481.335.808 Bytes frei
.
- - End Of File - - D3CE21617B0BEF0E9F901F68B267B3E7
Code:
SystemLook 30.07.11 by jpshortstuff
Log created at 22:38 on 04/06/2013 by user
Administrator - Elevation successful

========== filefind ==========

Searching for "svhost.*"
C:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\svhost.exe.vir        --a---- 435712 bytes        [21:45 03/06/2013]        [15:03 23/04/2013] CDBB2D86AC108D86DC9EE673BA18D424
C:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\IE10\svhost.exe.vir        --a---- 435712 bytes        [12:12 02/06/2013]        [15:03 23/04/2013] CDBB2D86AC108D86DC9EE673BA18D424

========== regfind ==========

Searching for "svhost"
No data found.

-= EOF =-
Kaspersky hat jetzt sogar noch 2mal mehr die Bedrohung gefunden.

Und bei einem Ursprungsordner öffnet sich ein ordner und da ist eine Datei zu sehen die heißt:

svhost.exe.vir

vielleicht hilft das ja weiter

Chico92 06.06.2013 10:27
Keine Lösung??

schrauber 06.06.2013 11:40
Hi,

sorry, hab keine Benachrichtigung erhalten. Wenn sowas ist und ich nicht antworte einfach kurz ne PM schicken.

das .vir heisst die Datei ist schon in Quarantäne.

Mach bitte mal nen Vollscan mit Kaspersky und poste das Logfile.

Chico92 06.06.2013 13:40
Liste der Anhänge anzeigen (Anzahl: 1)
Hab ein Screenshot gemacht von der oberen Hälfte, da nur dort die Bedrohungen aufgelistet sind.

schrauber 06.06.2013 13:45
Jo, das is nix, die sind schon in Quarantäne von Combofix :)

Sonst keine Funde?

Chico92 06.06.2013 13:58
Liste der Anhänge anzeigen (Anzahl: 1)
Ich weiß nicht ob das jetzt übersichtlich ist...

Also überall steht ansonsten Gepackt:.... nur das was ich eben hochgeladen habe und jetzt hochlade steht was anderes.



Code:
Rootkit-Suche: wurde abgeschlossen vor 2 Stunden  (Ereignisse: 13, Objekte: 1632, Zeit: 00:04:10)       
        Aufgabe wurde abgeschlossen        06.06.2013 12:00:38                        Untersuchung des Computers       
RogueKiller_8.5.4.exe        Gepackt: UPX        06.06.2013 11:58:35        c:\Users\user\Desktop\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 11:58:34        c:\Users\user\Desktop\OTL.exe/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 11:58:34        c:\Users\user\Desktop\OTL.exe/                Untersuchung des Computers       
OTL.exe        Gepackt: PE_Patch.PECompact        06.06.2013 11:58:33        c:\Users\user\Desktop\                Untersuchung des Computers       
JRT.exe        Gepackt: UPX        06.06.2013 11:58:32        c:\Users\user\Desktop\                Untersuchung des Computers       
gmer_2.1.19163.exe        Gepackt: UPX        06.06.2013 11:58:32        c:\Users\user\Desktop\                Untersuchung des Computers       
FSS.exe        Gepackt: UPX        06.06.2013 11:58:31        c:\Users\user\Desktop\                Untersuchung des Computers       
ERDNT.E_E        Gepackt: UPX        06.06.2013 11:58:31        c:\Users\user\Desktop\FRST64.exe/C:\eruntFRST\                Untersuchung des Computers       
ERUNT.exe        Gepackt: UPX        06.06.2013 11:58:30        c:\Users\user\Desktop\FRST64.exe/C:\eruntFRST\                Untersuchung des Computers       
adwcleaner.exe        Gepackt: UPX        06.06.2013 11:58:29        c:\Users\user\Desktop\                Untersuchung des Computers       
ComboFix.exe        Gepackt: UPX        06.06.2013 11:57:50        c:\Users\user\Desktop\                Untersuchung des Computers       
        Aufgabe wurde gestartet        06.06.2013 11:56:28                        Untersuchung des Computers       
Vollständige Untersuchung: wurde abgeschlossen vor 20 Minuten  (Ereignisse: 565, Objekte: 382447, Zeit: 00:12:07)       
        Aufgabe wurde abgeschlossen        06.06.2013 14:36:23                        Untersuchung des Computers       
svhost.exe.vir        Nicht desinfizierte Objekte: not-a-virus:RiskTool.Win32.BitCoinMiner.cel        06.06.2013 14:36:23        c:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\        Vom Benutzer übersprungen        Untersuchung des Computers       
svhost.exe.vir        Gefunden: not-a-virus:RiskTool.Win32.BitCoinMiner.cel        06.06.2013 14:36:23        c:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\                Untersuchung des Computers       
svhost.exe.vir        Nicht desinfizierte Objekte: not-a-virus:RiskTool.Win32.BitCoinMiner.cel        06.06.2013 14:36:23        c:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\IE10\        Vom Benutzer übersprungen        Untersuchung des Computers       
svhost.exe.vir        Gefunden: not-a-virus:RiskTool.Win32.BitCoinMiner.cel        06.06.2013 14:36:23        c:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\IE10\                Untersuchung des Computers       
RtkHDAud.sys        Gepackt: PE_Patch        06.06.2013 14:36:22        f:\Treiber\Audio Treiber\WDM\                Untersuchung des Computers       
hdaudio.sys        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\kb888111xpsp2.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
hdaudio.sys        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\kb888111xpsp1.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
hdaudbus.sys        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\kb888111xpsp2.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
hdaudbus.sys        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\kb888111xpsp1.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
kb888111xpsp2.exe        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\                Untersuchung des Computers       
kb888111xpsp1.exe        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\                Untersuchung des Computers       
hdaudio.sys        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\kb888111w2ksp4.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
hdaudio.sys        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K3\us\kb888111srvrtm.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
hdaudbus.sys        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\kb888111w2ksp4.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
hdaudbus.sys        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K3\us\kb888111srvrtm.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
kb888111w2ksp4.exe        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\                Untersuchung des Computers       
kb888111srvrtm.exe        Gepackt: PE_Patch        06.06.2013 14:36:20        f:\Treiber\Audio Treiber\MSHDQFE\Win2K3\us\                Untersuchung des Computers       
f_000030        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00000e        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00000f        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00000c        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00000a        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_000009        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_000007        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_000006        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_000005        Gepackt: Swf2Swc        06.06.2013 14:34:50        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00002d        Gepackt: Swf2Swc        06.06.2013 14:34:46        f:\Steam\SteamApps\common\Counter-Strike Source\config\html\                Untersuchung des Computers       
sharedlib.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-training1.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
steamlogin.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
startscreen.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
splitscreensignon.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
spectator.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
single-player.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
settings.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
scoreboard.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
radiopanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
playerdetails.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
playerprofilepanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
pausemenu.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
pausebackground.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
overwatchresolution.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
optionsmenu.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
motioncalibration.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
money.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
message-box.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
message-box-tour-1.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
message-box-operation-payback.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
message-box-operation-payback-activate.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
medals.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
medalstatsscreen.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mapoverview.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
maplib.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainuirootmovie.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenuwarningspanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenuselectpanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenuoverwatchpanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenuoperationpayback.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenunewspanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
lobbybrowser.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenu.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
lobby.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loadingiconslib.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_zombie_run_night_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_unpanic_csgo_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_tmu_winter.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_stab_town_final.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_stab_forest_final.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_redstripe_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_panic_offensive_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_officesspace_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_miniature_room_go_b1_tio.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_lila_p@pys_simpsons_v5.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_lila_off!ce_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_safehouse.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_fun_park_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_fear_office_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_desert_fortress_csgo.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_base_day_zn7.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_atix_helicopter_mini_go_v1.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-fy_rambohulk_csgo_v1_1.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_train_se.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_vertigo.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_sultan.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_train.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_stmarc.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_sugarcane.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_shorttrain.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_slums.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_nuke_se.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_bank.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_nuke.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_lake.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_inferno_se.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_inferno.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_dust_se.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_dust2_se.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_dust2.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_dust.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_estate.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_cambodia.swf        Gepackt: Swf2Swc        06.06.2013 14:34:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_aztec_se.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_aztec.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_aurelia.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_office_se.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_office.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_kismayo.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_militia.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_italy_se.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_italy.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
legals.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_assault.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-blank.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-ar_shoots.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-ar_monastery.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-ar_baggage.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
iconlib.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
leaderboards.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudwinpanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudweaponselected.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudweaponmodule.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudvotepanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudvoicestatus.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudtrialtimer.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudscreenshotpanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudreticle.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudradarmodule.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudplayercounttime.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudhelpachievementmodule.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudhealtharmormodule.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_tchinese.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudfreezepanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
huddeathnotification.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
huddamageindicator.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudalertspanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
howtoplay.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
grime.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
gameuirootmovie.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
gamebackground.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
friendslisterpanel.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_schinese.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_japanese.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_russian.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_latin.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_korean.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
credits.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
cursor.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
colorlib.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
chooseteam.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
chat.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
background.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
callvote.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
buy-menu.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
autodisconnect.swf        Gepackt: Swf2Swc        06.06.2013 14:34:41        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
f_000257        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000247        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000246        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000240        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_00023f        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_00023b        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000217        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_0001f8        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_0001c9        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_0000be        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000085        Gepackt: Swf2Swc        06.06.2013 14:34:38        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
PE_Patch.Juba        Gepackt: PE_Patch.Juba        06.06.2013 14:34:01        f:\Daemon Tools\DAEMON Tools Lite\imgengine.dll/                Untersuchung des Computers       
imgengine.dll        Gepackt: PE_Patch.Juba        06.06.2013 14:34:01        f:\Daemon Tools\DAEMON Tools Lite\                Untersuchung des Computers       
PE_Patch.Juba        Gepackt: PE_Patch.Juba        06.06.2013 14:34:01        f:\Daemon Tools\DAEMON Tools Lite\imgengine.dll/                Untersuchung des Computers       
imgengine.dll        Gepackt: PE_Patch.Juba        06.06.2013 14:34:01        f:\Daemon Tools\DAEMON Tools Lite\                Untersuchung des Computers       
_984_848a9d097ed913e94dc21596e861ba69        Gepackt: Swf2Swc        06.06.2013 14:33:38        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core_x64/Assets1_1.zip/                Untersuchung des Computers       
_468_ae50bdf99fa1c8fcb2441e2ccc960fdb        Gepackt: Swf2Swc        06.06.2013 14:33:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core_x64/Assets1_1.zip/                Untersuchung des Computers       
_466_d2fb88df706761bab5da9b7825e15fd3        Gepackt: Swf2Swc        06.06.2013 14:33:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core_x64/Assets1_1.zip/                Untersuchung des Computers       
_1060_4678eb3095717a8ebd039396f880388f        Gepackt: Swf2Swc        06.06.2013 14:33:34        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core_x64/Assets1_1.zip/                Untersuchung des Computers       
_990_848a9d097ed913e94dc21596e861ba69        Gepackt: Swf2Swc        06.06.2013 14:33:27        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core/Assets1_1.zip/                Untersuchung des Computers       
_472_ae50bdf99fa1c8fcb2441e2ccc960fdb        Gepackt: Swf2Swc        06.06.2013 14:33:24        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core/Assets1_1.zip/                Untersuchung des Computers       
_470_d2fb88df706761bab5da9b7825e15fd3        Gepackt: Swf2Swc        06.06.2013 14:33:24        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core/Assets1_1.zip/                Untersuchung des Computers       
_1065_4678eb3095717a8ebd039396f880388f        Gepackt: Swf2Swc        06.06.2013 14:33:22        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core/Assets1_1.zip/                Untersuchung des Computers       
_80_be332eb9be4b3dcfdcd757bbc6e495e5        Gepackt: Swf2Swc        06.06.2013 14:33:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_78_fed581e8e3789157fbc7e2b5d1a4e9cc        Gepackt: Swf2Swc        06.06.2013 14:33:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_75_6eae92679e303e167027be7733b8f6d4        Gepackt: Swf2Swc        06.06.2013 14:33:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_71_ca5898f38b5440b4ccc5c8029e30dfe3        Gepackt: Swf2Swc        06.06.2013 14:33:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_67_7de141aa4750facaa9c8fdc904d65455        Gepackt: Swf2Swc        06.06.2013 14:33:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_63_0235de021a8119d0db394a48facdd0f8        Gepackt: Swf2Swc        06.06.2013 14:33:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_3_106a7d7f3761abba652da6e2be214e3b        Gepackt: Swf2Swc        06.06.2013 14:33:10        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeMiniBridge1-mul/Assets1_1.zip/                Untersuchung des Computers       
LightChrome_m.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/LightChrome/                Untersuchung des Computers       
LightChrome_jp.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/LightChrome/                Untersuchung des Computers       
LightChrome_cn.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/LightChrome/                Untersuchung des Computers       
LightChrome.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/LightChrome/                Untersuchung des Computers       
DarkChrome_m.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/DarkChrome/                Untersuchung des Computers       
DarkChrome_jp.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/DarkChrome/                Untersuchung des Computers       
DarkChrome_cn.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/DarkChrome/                Untersuchung des Computers       
DarkChrome.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/DarkChrome/                Untersuchung des Computers       
AdobeHelp.swf        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:32:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:32:35        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeAIRInstaller.exe/                Untersuchung des Computers       
_8_13784d98d6ae5ed0b52e28e4358d55c2        Gepackt: Swf2Swc        06.06.2013 14:32:18        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtensionManager5.0All/Assets1_1.zip/                Untersuchung des Computers       
_12_72b7f936c68b8b9a1944753702e1f1ff        Gepackt: PE_Patch.Juba        06.06.2013 14:32:17        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtensionManager5.0All/Assets1_1.zip/                Untersuchung des Computers       
_75_519980ab0a9e3419967f5aad47b53927        Gepackt: Swf2Swc        06.06.2013 14:32:16        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtendScriptToolkit3.5.0-mul/Assets2_1.zip/                Untersuchung des Computers       
_329_1d4ea71ea4bf4ce6aa8a8997f317a99f        Gepackt: Swf2Swc        06.06.2013 14:32:15        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtendScriptToolkit3.5.0-mul/Assets2_1.zip/                Untersuchung des Computers       
_322_b10b95a24f29d32ed07587565d5ac92a        Gepackt: Swf2Swc        06.06.2013 14:32:15        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtendScriptToolkit3.5.0-mul/Assets2_1.zip/                Untersuchung des Computers       
_465_faecd355dc8725a13354eacec3036bd5        Gepackt: Swf2Swc        06.06.2013 14:32:14        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_328_dd4bbbb16636b8dbc0bbe8845fe0bd52        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_327_517f25891c3a5eb054ce07845ddfa830        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_325_638d16b0115cdf349c06c7049ee09a4b        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_324_e158abe23ec28d462b9ade877db0efe4        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_323_c7feb13b4dd9292f64b9dce4089f6583        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_322_7316d66c8f8deb2c6f389638fc40c4ff        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_321_16fd859249ea88288fe4f3c457c52985        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_311_81ef711c3c5fa5b11ef624db39efd28e        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_286_855869571cfb78785e8d6b236e655ea5        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_273_93c43351710ccd8111a9c0ad9eaedf12        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_263_2f70ed8d1edea667a06669e248b3dd8f        Gepackt: Swf2Swc        06.06.2013 14:32:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_78_a31b1c964e59ca5d917955c0e28ac524        Gepackt: Swf2Swc        06.06.2013 14:32:05        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSInfrastructure2-mul/Assets2_1.zip/                Untersuchung des Computers       
StageManager-2.0.swf        Gepackt: Swf2Swc        06.06.2013 14:32:05        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSInfrastructure2-mul/Assets2_1.zip/_76_079b61b763f4ec8d086f503cae0c38ca/                Untersuchung des Computers       
_69_f0f9e01fe08b752aa3cc49d61c24ed90        Gepackt: Swf2Swc        06.06.2013 14:32:05        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSInfrastructure2-mul/Assets2_1.zip/                Untersuchung des Computers       
StageManager-2.0.swf        Gepackt: Swf2Swc        06.06.2013 14:32:05        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSInfrastructure2-mul/Assets2_1.zip/_67_2cdbe922e4bb1bf63fce51b5b031927e/                Untersuchung des Computers       
_69_1e8e0ef078bfabca6339379e16581b77        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_5_678e24457e18b778af0b672bb4cb13ab        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_4_5108810e6bb0b1d171912f652ce7578a        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_40_faccd1ce1677c09b04d18de696b29184        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_3_48ad89004dfc2fe3130e51824775a046        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_39_d8518b8a28f98e266a8ccf8f2b8c2e04        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_38_577e3098b1b600647640e58cc0a8d898        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_37_b75297e686ba7bc107f31acfb952caba        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_36_f885530c039ac5b696d45a86d8b45986        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_2_07106a68865cbbfac03b6b3c6a13e1e6        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_1_02586f2da9ea6ced63ade116038e88f9        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_130_6bc31a39cc046b3348f0e8cc94dec27f        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_125_e070d62e50b57350533ac655e9c476f8        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_119_a4df75124583143c1eab6134612d9572        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_118_def6cf3f158bafc60d4417c1abe55063        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_110_e9de56a77c2badec2c1d0a0ef0826f2f        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_104_03adcb9b316e83b964b0745331d89b61        Gepackt: Swf2Swc        06.06.2013 14:32:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
Photoshop.com_Upload.swf        Gepackt: Swf2Swc        06.06.2013 14:31:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/_521_1dd5b19845901963fe4b8a748de57e75/                Untersuchung des Computers       
Flickr_Upload.swf        Gepackt: Swf2Swc        06.06.2013 14:31:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/_520_9ee52d5961f920a33aca8b55f12c5637/                Untersuchung des Computers       
Facebook_Upload.swf        Gepackt: Swf2Swc        06.06.2013 14:31:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/_519_0367c9878c079653ef91a03774c2ceea/                Untersuchung des Computers       
Computer_Upload.swf        Gepackt: Swf2Swc        06.06.2013 14:31:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/_518_a16a86c6a6cd3c4b6b61119a31c618fd/                Untersuchung des Computers       
_515_8de28d64845152aee3b88d71d6e1901b        Gepackt: Swf2Swc        06.06.2013 14:31:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/                Untersuchung des Computers       
_438_0a4d8e83fabb5f83f8c759cc44e32788        Gepackt: Swf2Swc        06.06.2013 14:31:56        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/                Untersuchung des Computers       
_404_31968506068829c2e98475d413ac137b        Gepackt: Swf2Swc        06.06.2013 14:31:56        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/                Untersuchung des Computers       
_353_5305047b79b270938afd4b72e444e174        Gepackt: Swf2Swc        06.06.2013 14:31:56        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/                Untersuchung des Computers       
AMP.swf        Gepackt: Swf2Swc        06.06.2013 14:31:51        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAMP1.8-mul/AdobeAMP1.8-mul.zip/payloads/AdobeAMP1.8-mul/adobe_media_player.air/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:31:48        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAMP1.8-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:31:48        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAMP1.8-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:31:48        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAMP1.8-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:31:46        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:31:45        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 14:31:45        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
setup.swf        Gepackt: Swf2Swc        06.06.2013 14:31:43        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
setup.swf        Gepackt: Swf2Swc        06.06.2013 14:31:43        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/Adobe AIR/Versions/1.0/Resources/                Untersuchung des Computers       
Adobe AIR Application Installer.swf        Gepackt: Swf2Swc        06.06.2013 14:31:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/Adobe AIR/Versions/1.0/                Untersuchung des Computers       
UWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/UWA/UWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 14:31:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/UWA/UWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 14:31:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/UWA/UWA.pima/assets/                Untersuchung des Computers       
PWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/LWA/LWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 14:31:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/LWA/LWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 14:31:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/LWA/LWA.pima/assets/                Untersuchung des Computers       
AdobeIDFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/LWA/LWA.pima/                Untersuchung des Computers       
DWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/DWA/DWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 14:31:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/DWA/DWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 14:31:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/DWA/DWA.pima/assets/                Untersuchung des Computers       
AdobeIDFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/DWA/DWA.pima/                Untersuchung des Computers       
PDAppFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/core/PDApp.pima/                Untersuchung des Computers       
PDAppFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:39        E:\Photoshop CS5\Photoshop_CS5.iso/packages/core/PDApp.pima/                Untersuchung des Computers       
UWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:38        E:\Photoshop CS5\Photoshop_CS5.iso/packages/UWA/UWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 14:31:38        E:\Photoshop CS5\Photoshop_CS5.iso/packages/UWA/UWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 14:31:38        E:\Photoshop CS5\Photoshop_CS5.iso/packages/UWA/UWA.pima/assets/                Untersuchung des Computers       
PWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:36        E:\Photoshop CS5\Photoshop_CS5.iso/packages/LWA/LWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 14:31:36        E:\Photoshop CS5\Photoshop_CS5.iso/packages/LWA/LWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 14:31:36        E:\Photoshop CS5\Photoshop_CS5.iso/packages/LWA/LWA.pima/assets/                Untersuchung des Computers       
AdobeIDFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:36        E:\Photoshop CS5\Photoshop_CS5.iso/packages/LWA/LWA.pima/                Untersuchung des Computers       
DWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/DWA/DWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 14:31:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/DWA/DWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 14:31:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/DWA/DWA.pima/assets/                Untersuchung des Computers       
AdobeIDFlex.swf        Gepackt: Swf2Swc        06.06.2013 14:31:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/DWA/DWA.pima/                Untersuchung des Computers       
CTRL.s3        Gepackt: MIME.Broken        06.06.2013 14:30:03        c:\Windows\System32\DriverStore\FileRepository\atiriol6.inf_amd64_neutral_bde34ad5722cca75\                Untersuchung des Computers       
470640aa4bb7db8e69196b5edb0010933569e98d        Gepackt: PE_Patch        06.06.2013 14:29:48        c:\Windows\SoftwareDistribution\Download\                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 14:29:38        c:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744BA0000000010\11.0.0\services.cfg/SWFs/                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 14:29:37        c:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744BA0000000010\11.0.0\dexshare.spi/SWFs/                Untersuchung des Computers       
EchoSign.swf        Gepackt: Swf2Swc        06.06.2013 14:29:37        c:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744BA0000000010\11.0.0\dexechosign.spi/SWFs/                Untersuchung des Computers       
_E7DB7DAC0E17348AA003F6B166591A6F        Gepackt: PE_Patch        06.06.2013 14:29:34        c:\Windows\Installer\4f639.msi/Data1.cab/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:29:22        c:\Windows\PEV.exe/PE_Patch.PECompact/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:29:22        c:\Windows\MBR.exe/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:29:22        c:\Windows\PEV.exe/                Untersuchung des Computers       
PEV.exe        Gepackt: PE_Patch.PECompact        06.06.2013 14:29:22        c:\Windows\                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:29:22        c:\Windows\MBR.exe/                Untersuchung des Computers       
svhost.exe.vir        Nicht desinfizierte Objekte: not-a-virus:RiskTool.Win32.BitCoinMiner.cel        06.06.2013 14:29:22        c:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\IE10\        Zurückgestellt        Untersuchung des Computers       
svhost.exe.vir        Gefunden: not-a-virus:RiskTool.Win32.BitCoinMiner.cel        06.06.2013 14:29:22        c:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\IE10\                Untersuchung des Computers       
svhost.exe.vir        Nicht desinfizierte Objekte: not-a-virus:RiskTool.Win32.BitCoinMiner.cel        06.06.2013 14:29:22        c:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\        Zurückgestellt        Untersuchung des Computers       
svhost.exe.vir        Gefunden: not-a-virus:RiskTool.Win32.BitCoinMiner.cel        06.06.2013 14:29:22        c:\Qoobox\Quarantine\C\Users\user\AppData\Roaming\Microsoft\                Untersuchung des Computers       
pbsvc.exe        Gepackt: UPX        06.06.2013 14:29:20        c:\Program Files (x86)\Origin Games\Battlefield 3\__Installer\punkbuster\redist\                Untersuchung des Computers       
vcredist_x86.exe        Gepackt: PE_Patch        06.06.2013 14:29:20        c:\Program Files (x86)\Origin Games\Battlefield 3\__Installer\vc\vc2008sp1\redist\                Untersuchung des Computers       
vcredist_x64.exe        Gepackt: PE_Patch        06.06.2013 14:29:20        c:\Program Files (x86)\Origin Games\Battlefield 3\__Installer\vc\vc2008sp1\redist\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.hdr/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.hdr/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.hdr/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\                Untersuchung des Computers       
_IsRes.dll        Gepackt: UPX        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\data1.hdr/                Untersuchung des Computers       
ISSetup.dll        Gepackt: UPX        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\                Untersuchung des Computers       
isrt.dll        Gepackt: UPX        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\data1.hdr/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.hdr/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.hdr/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.hdr/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\                Untersuchung des Computers       
mediaplayer.swf        Gepackt: Swf2Swc        06.06.2013 14:28:48        c:\Program Files (x86)\GreenTree Applications\YTD Video Downloader\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.cab/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.cab/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.cab/                Untersuchung des Computers       
nvflsh32.sys        Gepackt: PE_Patch        06.06.2013 14:28:48        c:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\NvTool\                Untersuchung des Computers       
_IsRes.dll        Gepackt: UPX        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\data1.cab/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.cab/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
isrt.dll        Gepackt: UPX        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\data1.cab/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.cab/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:48        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.cab/                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 14:28:44        c:\Program Files (x86)\Adobe\Reader 11.0\Reader\Services\DEXShare.spi/SWFs/                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 14:28:44        c:\Program Files (x86)\Adobe\Reader 11.0\Reader\Services\Services.cfg/SWFs/                Untersuchung des Computers       
EchoSign.swf        Gepackt: Swf2Swc        06.06.2013 14:28:44        c:\Program Files (x86)\Adobe\Reader 11.0\Reader\Services\DEXEchoSign.spi/SWFs/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:26        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:26        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.2\3DVision_301.25.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:26        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:26        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe/#/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:26        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.2\3DVision_301.25.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:26        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.2\3DVision_301.25.exe/#/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:25        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:25        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe\ISSetup.dll/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:25        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.2\3DVision_301.25.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:25        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe\                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:25        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.2\3DVision_301.25.exe\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:25        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.2\3DVision_301.25.exe\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:22        c:\NVIDIA\DisplayDriver\314.22\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_314.22.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:22        c:\NVIDIA\DisplayDriver\314.22\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_314.22.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:22        c:\NVIDIA\DisplayDriver\314.22\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_314.22.exe/#/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:21        c:\NVIDIA\DisplayDriver\314.22\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_314.22.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:21        c:\NVIDIA\DisplayDriver\314.22\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_314.22.exe\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:21        c:\NVIDIA\DisplayDriver\314.22\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_314.22.exe\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:17        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:17        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:17        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe/#/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:17        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:17        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:17        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:10        c:\NVIDIA\DisplayDriver\306.23\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_306.23.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:10        c:\NVIDIA\DisplayDriver\306.23\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_306.23.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:10        c:\NVIDIA\DisplayDriver\306.23\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_306.23.exe/#/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:10        c:\NVIDIA\DisplayDriver\306.23\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_306.23.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:10        c:\NVIDIA\DisplayDriver\306.23\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_306.23.exe\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:10        c:\NVIDIA\DisplayDriver\306.23\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_306.23.exe\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:06        c:\NVIDIA\DisplayDriver\301.42\WinVista_Win7_64\International\NV3DVision\3DVision_301.42.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:06        c:\NVIDIA\DisplayDriver\301.42\WinVista_Win7_64\International\NV3DVision\3DVision_301.42.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:06        c:\NVIDIA\DisplayDriver\301.42\WinVista_Win7_64\International\NV3DVision\3DVision_301.42.exe/#/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:28:05        c:\NVIDIA\DisplayDriver\301.42\WinVista_Win7_64\International\NV3DVision\3DVision_301.42.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:28:05        c:\NVIDIA\DisplayDriver\301.42\WinVista_Win7_64\International\NV3DVision\3DVision_301.42.exe\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:28:05        c:\NVIDIA\DisplayDriver\301.42\WinVista_Win7_64\International\NV3DVision\3DVision_301.42.exe\                Untersuchung des Computers       
ERUNT.EXE        Gepackt: UPX        06.06.2013 14:28:03        c:\JRT\erunt\                Untersuchung des Computers       
ERDNT.E_E        Gepackt: UPX        06.06.2013 14:28:03        c:\JRT\erunt\                Untersuchung des Computers       
NIRCMD.DAT        Gepackt: UPX        06.06.2013 14:28:03        c:\JRT\                Untersuchung des Computers       
ERDNT.EXE        Gepackt: UPX        06.06.2013 14:28:03        c:\FRST\Hives\                Untersuchung des Computers       
left4uncut.exe        Gepackt: UPX        06.06.2013 14:27:20        c:\Documents and Settings\user\Desktop\left4deadUncut\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:19        c:\Documents and Settings\user\Desktop\OTL.exe/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:19        c:\Documents and Settings\user\Desktop\OTL.exe/                Untersuchung des Computers       
OTL.exe        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:19        c:\Documents and Settings\user\Desktop\                Untersuchung des Computers       
ERUNT.EXE        Gepackt: UPX        06.06.2013 14:27:18        c:\Documents and Settings\user\Desktop\JRT.exe/UPX/erunt/                Untersuchung des Computers       
ERDNT.E_E        Gepackt: UPX        06.06.2013 14:27:18        c:\Documents and Settings\user\Desktop\JRT.exe/UPX/erunt/                Untersuchung des Computers       
NIRCMD.DAT        Gepackt: UPX        06.06.2013 14:27:18        c:\Documents and Settings\user\Desktop\JRT.exe/UPX/                Untersuchung des Computers       
JRT.exe        Gepackt: UPX        06.06.2013 14:27:17        c:\Documents and Settings\user\Desktop\                Untersuchung des Computers       
gmer_2.1.19163.exe        Gepackt: UPX        06.06.2013 14:27:17        c:\Documents and Settings\user\Desktop\                Untersuchung des Computers       
FSS.exe        Gepackt: UPX        06.06.2013 14:27:17        c:\Documents and Settings\user\Desktop\                Untersuchung des Computers       
ERDNT.E_E        Gepackt: UPX        06.06.2013 14:27:17        c:\Documents and Settings\user\Desktop\FRST64.exe/C:\eruntFRST\                Untersuchung des Computers       
ERUNT.exe        Gepackt: UPX        06.06.2013 14:27:17        c:\Documents and Settings\user\Desktop\FRST64.exe/C:\eruntFRST\                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/rmbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/rmbr.3XE/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/pevb.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/pevb.3XE/                Untersuchung des Computers       
pevb.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/pev.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/pev.3XE/                Untersuchung des Computers       
pev.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/mbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/mbr.3XE/                Untersuchung des Computers       
catchme.3XE        Gepackt: UPX        06.06.2013 14:27:16        c:\Documents and Settings\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
FileKill.3XE        Gepackt: UPX        06.06.2013 14:27:15        c:\Documents and Settings\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
ERDNT.e_e        Gepackt: UPX        06.06.2013 14:27:15        c:\Documents and Settings\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/rmbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/rmbr.3XE/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/pevb.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/pevb.3XE/                Untersuchung des Computers       
pevb.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/pev.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/pev.3XE/                Untersuchung des Computers       
pev.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/mbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/mbr.3XE/                Untersuchung des Computers       
catchme.3XE        Gepackt: UPX        06.06.2013 14:27:14        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
FileKill.3XE        Gepackt: UPX        06.06.2013 14:27:13        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
ERDNT.e_e        Gepackt: UPX        06.06.2013 14:27:13        c:\Documents and Settings\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
ComboFix.exe        Gepackt: UPX        06.06.2013 14:27:12        c:\Documents and Settings\user\Desktop\                Untersuchung des Computers       
adwcleaner.exe        Gepackt: UPX        06.06.2013 14:27:12        c:\Documents and Settings\user\Desktop\                Untersuchung des Computers       
83CFCd01        Gepackt: Swf2Swc        06.06.2013 14:27:10        c:\Documents and Settings\user\AppData\Local\Mozilla\Firefox\Profiles\zym5a3q7.default\Cache\E\64\                Untersuchung des Computers       
E2E7Bd01        Gepackt: Swf2Swc        06.06.2013 14:27:07        c:\Documents and Settings\user\AppData\Local\Mozilla\Firefox\Profiles\zym5a3q7.default\Cache\1\E2\                Untersuchung des Computers       
BFB18d01        Gepackt: Swf2Swc        06.06.2013 14:27:06        c:\Documents and Settings\user\AppData\Local\Mozilla\Firefox\Profiles\zym5a3q7.default\Cache\0\7B\                Untersuchung des Computers       
OpenSans-Regular-webfont[1].eot        Gepackt: EOT        06.06.2013 14:27:05        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:04        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/#/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:04        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/#/                Untersuchung des Computers       
#        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:04        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:04        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:04        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:04        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/                Untersuchung des Computers       
Firefox%20Setup%2013.0.1[1].exe        Gepackt: UPX        06.06.2013 14:27:04        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\                Untersuchung des Computers       
16[1].swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\                Untersuchung des Computers       
OpenSans-Light-webfont[1].eot        Gepackt: EOT        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INOB6UCQ\                Untersuchung des Computers       
logo[2].swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INOB6UCQ\                Untersuchung des Computers       
drivers_notification_DE_march2009[1].swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INOB6UCQ\                Untersuchung des Computers       
29d241ab-ffa9-4ce1-bc19-5fcdcfecf657[1].swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INOB6UCQ\                Untersuchung des Computers       
16[1].swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BW87YDVC\                Untersuchung des Computers       
OpenSans-Semibold-webfont[1].eot        Gepackt: EOT        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BNU7X8LK\                Untersuchung des Computers       
krb[1].swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BNU7X8LK\                Untersuchung des Computers       
aseru.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\zQr3eksSpnwq4ibRgfjcS2RIP3w=.dt2/                Untersuchung des Computers       
yatta.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\rxhHRWZFifWPJsblHwOPI4du0PY=.dt2/                Untersuchung des Computers       
knock.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\rXcZb6ekO9S3jB29KleJkBOXYmY=.dt2/                Untersuchung des Computers       
sad_blocks.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\RASG82FHEcFvd4GNG+agI+ySKy1M=.dt2/                Untersuchung des Computers       
punch.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\PSxahz1f6qTgCU4UU0cALUXBjw4=.dt2/                Untersuchung des Computers       
star.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\OxlFvKTDqxjyjj7+6Obz0DdN678=.dt2/                Untersuchung des Computers       
bow.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\Nt2FqWL50Iag4EvPJjVS0IoDBFQ4=.dt2/                Untersuchung des Computers       
firefly.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\MRZ8IxHqteehfHqu9JeZn0pUmQE=.dt2/                Untersuchung des Computers       
daisuki.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\jkmFW1chv5xvX1dIBhXZ0H5irPU=.dt2/                Untersuchung des Computers       
eyeball.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\enMqwlYLN4AvpmaOrIfYLWsVAdA=.dt2/                Untersuchung des Computers       
lightbulb.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\CFMGHHhzvqtshATFxrIj05VlzLY=.dt2/                Untersuchung des Computers       
cry.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\BjZmlzbZBo42FjxSxambo4D541Hg=.dt2/                Untersuchung des Computers       
heartkey.swf        Gepackt: Swf2Swc        06.06.2013 14:27:03        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\B1yxoWDJQ9FmoHcMiEHg3gkjbUQ=.dt2/                Untersuchung des Computers       
taxi.swf        Gepackt: Swf2Swc        06.06.2013 14:27:02        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\AQeQVsEXfntgB2EAzgelqTsHnR8=.dt2/                Untersuchung des Computers       
kiss.swf        Gepackt: Swf2Swc        06.06.2013 14:27:02        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\alxGH2FFbmTzeLEdtRHmv6GBUzdw=.dt2/                Untersuchung des Computers       
snowboarder_girl.swf        Gepackt: Swf2Swc        06.06.2013 14:27:02        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\5SYAzoFL2Gum2FEN2uLskOiDM0aE=.dt2/                Untersuchung des Computers       
laugh.swf        Gepackt: Swf2Swc        06.06.2013 14:27:02        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\4m4V6Go0+6LudOMv2FjsacIcmVVU=.dt2/                Untersuchung des Computers       
arigatou.swf        Gepackt: Swf2Swc        06.06.2013 14:27:02        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\3vCybcrVq+QHLV1YUc1sjyM9v8s=.dt2/                Untersuchung des Computers       
sleepy.swf        Gepackt: Swf2Swc        06.06.2013 14:27:02        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\1NKy92FbzJ6+mP82KkhxtOmU72Fs=.dt2/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:27:01        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/rmbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:27:01        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/rmbr.3XE/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:01        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/pevb.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:01        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/pevb.3XE/                Untersuchung des Computers       
pevb.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:01        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:27:01        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/pev.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:27:01        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/pev.3XE/                Untersuchung des Computers       
pev.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:27:00        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:27:00        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/mbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:27:00        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/mbr.3XE/                Untersuchung des Computers       
catchme.3XE        Gepackt: UPX        06.06.2013 14:27:00        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
FileKill.3XE        Gepackt: UPX        06.06.2013 14:26:59        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
ERDNT.e_e        Gepackt: UPX        06.06.2013 14:26:58        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:26:57        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/rmbr.3XE/                Untersuchung des Computers       
f_014a0d        Gepackt: Swf2Swc        06.06.2013 14:26:57        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:26:57        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/rmbr.3XE/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:26:57        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/pevb.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:26:57        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/pevb.3XE/                Untersuchung des Computers       
pevb.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:26:57        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:26:57        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/pev.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:26:57        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/pev.3XE/                Untersuchung des Computers       
pev.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:26:56        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:26:56        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/mbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:26:56        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/mbr.3XE/                Untersuchung des Computers       
f_01491c        Gepackt: Swf2Swc        06.06.2013 14:26:56        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
catchme.3XE        Gepackt: UPX        06.06.2013 14:26:56        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
f_0148cf        Gepackt: Swf2Swc        06.06.2013 14:26:56        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_014753        Gepackt: JSPack        06.06.2013 14:26:55        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
FileKill.3XE        Gepackt: UPX        06.06.2013 14:26:55        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
ERDNT.e_e        Gepackt: UPX        06.06.2013 14:26:54        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
f_01435d        Gepackt: Swf2Swc        06.06.2013 14:26:54        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_01435c        Gepackt: Swf2Swc        06.06.2013 14:26:54        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_014306        Gepackt: UPX        06.06.2013 14:26:54        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0142b1        Gepackt: JSPack        06.06.2013 14:26:54        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_014214        Gepackt: Swf2Swc        06.06.2013 14:26:54        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_014213        Gepackt: Swf2Swc        06.06.2013 14:26:54        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_013e3b        Gepackt: Swf2Swc        06.06.2013 14:26:53        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_013c31        Gepackt: Swf2Swc        06.06.2013 14:26:53        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_013c30        Gepackt: Swf2Swc        06.06.2013 14:26:53        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_013c2f        Gepackt: Swf2Swc        06.06.2013 14:26:53        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_01363e        Gepackt: Swf2Swc        06.06.2013 14:26:53        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0134e6        Gepackt: Swf2Swc        06.06.2013 14:26:52        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0134d8        Gepackt: Swf2Swc        06.06.2013 14:26:52        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_01347a        Gepackt: Swf2Swc        06.06.2013 14:26:52        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_012e9f        Gepackt: Swf2Swc        06.06.2013 14:26:52        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_012de4        Gepackt: Swf2Swc        06.06.2013 14:26:52        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_012de3        Gepackt: Swf2Swc        06.06.2013 14:26:52        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_012002        Gepackt: Swf2Swc        06.06.2013 14:26:52        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011e6c        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011e6b        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011e69        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011821        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0116c4        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0114cf        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011498        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011450        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0113b5        Gepackt: Swf2Swc        06.06.2013 14:26:51        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
yrzXiAvgeQQdopyG8QSg8Q.eot        Gepackt: EOT        06.06.2013 14:26:45        c:\Documents and Settings\user\Anwendungsdaten\DAEMON Tools Lite\MediaInfo\fonts\                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 14:26:44        c:\Documents and Settings\user\Anwendungsdaten\Adobe\Acrobat\11.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_DEXShare_5F_11_2E_0_2E_1_2E_2.spi/SWFs/                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 14:26:44        c:\Documents and Settings\user\Anwendungsdaten\Adobe\Acrobat\11.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_cfg_5F_11_2E_0_2E_1_2E_2.cfg/SWFs/                Untersuchung des Computers       
3F8FBd01        Gepackt: Swf2Swc        06.06.2013 14:26:42        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\C\57\                Untersuchung des Computers       
E85D9d01        Gepackt: Swf2Swc        06.06.2013 14:26:42        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\C\3F\                Untersuchung des Computers       
0B602d01        Gepackt: Swf2Swc        06.06.2013 14:26:42        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\B\A7\                Untersuchung des Computers       
AFDC8d01        Gepackt: Swf2Swc        06.06.2013 14:26:40        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\7\CF\                Untersuchung des Computers       
53DC6d01        Gepackt: Swf2Swc        06.06.2013 14:26:38        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\0\33\                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 14:26:37        c:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1031-7B44-AB0000000001}\Data1.cab/dexshare.spi/SWFs/                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 14:26:37        c:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1031-7B44-AB0000000001}\Data1.cab/services.cfg/SWFs/                Untersuchung des Computers       
EchoSign.swf        Gepackt: Swf2Swc        06.06.2013 14:26:37        c:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1031-7B44-AB0000000001}\Data1.cab/dexechosign.spi/SWFs/                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 14:26:37        c:\Documents and Settings\Coskun\Anwendungsdaten\Adobe\Acrobat\11.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_DEXShare_5F_11_2E_0_2E_1_2E_2.spi/SWFs/                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 14:26:37        c:\Documents and Settings\Coskun\Anwendungsdaten\Adobe\Acrobat\11.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_cfg_5F_11_2E_0_2E_1_2E_2.cfg/SWFs/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:26:28        c:\Program Files\NVIDIA Corporation\Installer2\Display.Driver.{3E357D61-91D1-442F-B9D4-18D7D41261C8}\3DVision_311.06.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:26:28        c:\Program Files\NVIDIA Corporation\Installer2\Display.Driver.{3E357D61-91D1-442F-B9D4-18D7D41261C8}\3DVision_311.06.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:26:28        c:\Program Files\NVIDIA Corporation\Installer2\Display.Driver.{3E357D61-91D1-442F-B9D4-18D7D41261C8}\3DVision_311.06.exe/#/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:26:27        c:\Program Files\NVIDIA Corporation\Installer2\Display.Driver.{3E357D61-91D1-442F-B9D4-18D7D41261C8}\3DVision_311.06.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:26:27        c:\Program Files\NVIDIA Corporation\Installer2\Display.Driver.{3E357D61-91D1-442F-B9D4-18D7D41261C8}\3DVision_311.06.exe\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 14:26:27        c:\Program Files\NVIDIA Corporation\Installer2\Display.Driver.{3E357D61-91D1-442F-B9D4-18D7D41261C8}\3DVision_311.06.exe\                Untersuchung des Computers       
PE_Patch.Juba        Gepackt: PE_Patch.Juba        06.06.2013 14:25:15        f:\Daemon Tools\DAEMON Tools Lite\imgengine.dll/                Untersuchung des Computers       
imgengine.dll        Gepackt: PE_Patch.Juba        06.06.2013 14:25:15        f:\Daemon Tools\DAEMON Tools Lite\                Untersuchung des Computers       
PE_Patch.Juba        Gepackt: PE_Patch.Juba        06.06.2013 14:25:15        f:\Daemon Tools\DAEMON Tools Lite\imgengine.dll/                Untersuchung des Computers       
imgengine.dll        Gepackt: PE_Patch.Juba        06.06.2013 14:25:14        f:\Daemon Tools\DAEMON Tools Lite\                Untersuchung des Computers       
nvflsh32.sys        Gepackt: PE_Patch        06.06.2013 14:25:03        c:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\NvTool\                Untersuchung des Computers       
RogueKiller_8.5.4.exe        Gepackt: UPX        06.06.2013 14:24:48        c:\Users\user\Desktop\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:24:47        c:\Users\user\Desktop\OTL.exe/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:24:47        c:\Users\user\Desktop\OTL.exe/                Untersuchung des Computers       
OTL.exe        Gepackt: PE_Patch.PECompact        06.06.2013 14:24:47        c:\Users\user\Desktop\                Untersuchung des Computers       
ERUNT.EXE        Gepackt: UPX        06.06.2013 14:24:46        c:\Users\user\Desktop\JRT.exe/UPX/erunt/                Untersuchung des Computers       
ERDNT.E_E        Gepackt: UPX        06.06.2013 14:24:46        c:\Users\user\Desktop\JRT.exe/UPX/erunt/                Untersuchung des Computers       
NIRCMD.DAT        Gepackt: UPX        06.06.2013 14:24:45        c:\Users\user\Desktop\JRT.exe/UPX/                Untersuchung des Computers       
JRT.exe        Gepackt: UPX        06.06.2013 14:24:45        c:\Users\user\Desktop\                Untersuchung des Computers       
gmer_2.1.19163.exe        Gepackt: UPX        06.06.2013 14:24:45        c:\Users\user\Desktop\                Untersuchung des Computers       
FSS.exe        Gepackt: UPX        06.06.2013 14:24:44        c:\Users\user\Desktop\                Untersuchung des Computers       
ERDNT.E_E        Gepackt: UPX        06.06.2013 14:24:44        c:\Users\user\Desktop\FRST64.exe/C:\eruntFRST\                Untersuchung des Computers       
ERUNT.exe        Gepackt: UPX        06.06.2013 14:24:44        c:\Users\user\Desktop\FRST64.exe/C:\eruntFRST\                Untersuchung des Computers       
adwcleaner.exe        Gepackt: UPX        06.06.2013 14:24:44        c:\Users\user\Desktop\                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:24:39        c:\Users\user\Desktop\ComboFix.exe/rmbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:24:39        c:\Users\user\Desktop\ComboFix.exe/rmbr.3XE/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:24:39        c:\Users\user\Desktop\ComboFix.exe/pevb.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:24:39        c:\Users\user\Desktop\ComboFix.exe/pevb.3XE/                Untersuchung des Computers       
pevb.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:24:39        c:\Users\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:24:38        c:\Users\user\Desktop\ComboFix.exe/pev.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:24:38        c:\Users\user\Desktop\ComboFix.exe/pev.3XE/                Untersuchung des Computers       
pev.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:24:38        c:\Users\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:24:38        c:\Users\user\Desktop\ComboFix.exe/mbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:24:38        c:\Users\user\Desktop\ComboFix.exe/mbr.3XE/                Untersuchung des Computers       
catchme.3XE        Gepackt: UPX        06.06.2013 14:24:38        c:\Users\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
FileKill.3XE        Gepackt: UPX        06.06.2013 14:24:38        c:\Users\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
ERDNT.e_e        Gepackt: UPX        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/UPX/rmbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/UPX/rmbr.3XE/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/UPX/pevb.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/UPX/pevb.3XE/                Untersuchung des Computers       
pevb.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/UPX/pev.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/UPX/pev.3XE/                Untersuchung des Computers       
pev.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 14:24:37        c:\Users\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 14:24:36        c:\Users\user\Desktop\ComboFix.exe/UPX/mbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 14:24:36        c:\Users\user\Desktop\ComboFix.exe/UPX/mbr.3XE/                Untersuchung des Computers       
catchme.3XE        Gepackt: UPX        06.06.2013 14:24:36        c:\Users\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
FileKill.3XE        Gepackt: UPX        06.06.2013 14:24:36        c:\Users\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
ERDNT.e_e        Gepackt: UPX        06.06.2013 14:24:35        c:\Users\user\Desktop\ComboFix.exe/UPX/                Untersuchung des Computers       
ComboFix.exe        Gepackt: UPX        06.06.2013 14:24:35        c:\Users\user\Desktop\                Untersuchung des Computers       
        Aufgabe wurde gestartet        06.06.2013 14:24:16                        Untersuchung des Computers

schrauber 06.06.2013 14:30
Nee das passt alles. Fertig und aufräumen, danach wird Kaspersky auch nichts mehr anmeckern :)


Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Chico92 06.06.2013 15:30
ich habe defogger vorher im ordner downloads gehabt und von dort aus damals gestartet. Hatte es jetzt aber auf den desktop gepackt und dort auf reenable gedrückt.

Combofix habe ich auf dem desktop und habe es einfach in uninstall.exe umbenannt. Ich habe es zweimal gestartet und es hat sich nicht gelöscht sondern ganz normal gescannt. Die Datei ist immer noch da und es wurden Logs erstellt.

schrauber 06.06.2013 15:32
Windows-Taste+R > "%userprofile%\desktop\combofix.exe" /Uninstall > Enter.

Chico92 06.06.2013 15:45
Nach delfix waren fast alle Programme außer gmer weg, habe es gelöscht, nur Kaspersky zeigt immer noch die Bedrohungen an :S

schrauber 06.06.2013 15:47
wo?

Chico92 06.06.2013 15:51
Also insgesamt 5mal zeigt er die Bedrohung an.

Die ersten zwei oben zeigen bei urpsrungsordner öffnen einfach die Festplatte C.

Der dritte und vierte zeigt: Chico-> Appdata -> Roaming -> Microsoft

der Fünfte: user -> Anwendungssaten -> Microsoft

Lade grade nen neuen patch für kaspersky. Windows meinte es arbeitet nicht ordnungsgemäß und ein neuer patch wäre hilfreich.

Hm hat auch nicht geholfen. Vielleicht spackt der auch nur rum...

schrauber 06.06.2013 16:27
Das wird so nix. Bitte Kaspersky scannen lassen, Logfile posten. Ich brauch schon genau Infos :)

Chico92 06.06.2013 19:18
Code:
Rootkit-Suche: wurde abgeschlossen vor 8 Stunden  (Ereignisse: 13, Objekte: 1632, Zeit: 00:04:10)       
Vollständige Untersuchung: wurde abgeschlossen vor 4 Tagen  (Ereignisse: 565, Objekte: 382447, Zeit: 00:12:07)       
Vollständige Untersuchung: wurde abgeschlossen vor 2 Stunden  (Ereignisse: 420, Objekte: 355786, Zeit: 00:23:49)       
        Aufgabe wurde abgeschlossen        06.06.2013 17:53:09                        Untersuchung des Computers       
RtkHDAud.sys        Gepackt: PE_Patch        06.06.2013 17:38:38        f:\Treiber\Audio Treiber\WDM\                Untersuchung des Computers       
hdaudio.sys        Gepackt: PE_Patch        06.06.2013 17:38:36        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\kb888111xpsp2.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
hdaudbus.sys        Gepackt: PE_Patch        06.06.2013 17:38:36        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\kb888111xpsp2.exe/PE_Patch/commonfiles\                Untersuchung des Computers       
kb888111xpsp2.exe        Gepackt: PE_Patch        06.06.2013 17:38:36        f:\Treiber\Audio Treiber\MSHDQFE\Win2K_XP\us\                Untersuchung des Computers       
f_000030        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00000f        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00000e        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00000c        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00000a        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_000009        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_000007        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_000006        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_000005        Gepackt: Swf2Swc        06.06.2013 17:36:52        f:\Steam\SteamApps\common\left 4 dead\config\html\                Untersuchung des Computers       
f_00002d        Gepackt: Swf2Swc        06.06.2013 17:36:47        f:\Steam\SteamApps\common\Counter-Strike Source\config\html\                Untersuchung des Computers       
sharedlib.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
steamlogin.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
startscreen.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
single-player.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
splitscreensignon.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
spectator.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
settings.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
scoreboard.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
radiopanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
playerdetails.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
playerprofilepanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
pausemenu.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
pausebackground.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
overwatchresolution.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
optionsmenu.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
motioncalibration.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
money.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
message-box-operation-payback.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
message-box.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
message-box-tour-1.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
message-box-operation-payback-activate.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
medals.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
medalstatsscreen.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mapoverview.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
maplib.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainuirootmovie.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenuwarningspanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenuselectpanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenuoperationpayback.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenuoverwatchpanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenunewspanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
mainmenu.swf        Gepackt: Swf2Swc        06.06.2013 17:36:43        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
lobby.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
lobbybrowser.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loadingiconslib.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_zombie_run_night_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-training1.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_tmu_winter.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_unpanic_csgo_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_stab_forest_final.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_stab_town_final.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_panic_offensive_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_redstripe_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_miniature_room_go_b1_tio.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_officesspace_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_lila_p@pys_simpsons_v5.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_lila_off!ce_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_fun_park_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_fear_office_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_desert_fortress_csgo.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_base_day_zn7.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-zm_atix_helicopter_mini_go_v1.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-fy_rambohulk_csgo_v1_1.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_vertigo.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_safehouse.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_train_se.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_train.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_sultan.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_sugarcane.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_stmarc.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_slums.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_shorttrain.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_nuke_se.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_lake.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_nuke.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_estate.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_inferno_se.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_inferno.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_dust_se.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_dust2_se.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_dust2.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_dust.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_cambodia.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_bank.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_aztec_se.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_aztec.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-de_aurelia.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_office_se.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_office.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_militia.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_kismayo.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_italy_se.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_italy.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
legals.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-cs_assault.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-blank.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-ar_shoots.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-ar_monastery.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
loading-ar_baggage.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_tchinese.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
leaderboards.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
iconlib.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudwinpanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudweaponselected.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudweaponmodule.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudvotepanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudvoicestatus.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudtrialtimer.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudscreenshotpanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudreticle.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudradarmodule.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudplayercounttime.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudhelpachievementmodule.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudhealtharmormodule.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudfreezepanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
huddeathnotification.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
huddamageindicator.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
hudalertspanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
howtoplay.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
grime.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
gameuirootmovie.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
gamebackground.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
friendslisterpanel.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_schinese.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_japanese.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_russian.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_latin.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
fontlib_korean.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
credits.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
cursor.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
colorlib.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
chooseteam.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
chat.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
background.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
callvote.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
buy-menu.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
autodisconnect.swf        Gepackt: Swf2Swc        06.06.2013 17:36:42        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo\resource\flash\                Untersuchung des Computers       
f_000257        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000246        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000247        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000240        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_00023f        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_00023b        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000217        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_0001f8        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_0001c9        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_0000be        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
f_000085        Gepackt: Swf2Swc        06.06.2013 17:36:39        f:\Steam\SteamApps\common\Counter-Strike Global Offensive\config\html\                Untersuchung des Computers       
_984_848a9d097ed913e94dc21596e861ba69        Gepackt: Swf2Swc        06.06.2013 17:35:38        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core_x64/Assets1_1.zip/                Untersuchung des Computers       
_468_ae50bdf99fa1c8fcb2441e2ccc960fdb        Gepackt: Swf2Swc        06.06.2013 17:35:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core_x64/Assets1_1.zip/                Untersuchung des Computers       
_466_d2fb88df706761bab5da9b7825e15fd3        Gepackt: Swf2Swc        06.06.2013 17:35:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core_x64/Assets1_1.zip/                Untersuchung des Computers       
_1060_4678eb3095717a8ebd039396f880388f        Gepackt: Swf2Swc        06.06.2013 17:35:34        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core_x64/Assets1_1.zip/                Untersuchung des Computers       
_990_848a9d097ed913e94dc21596e861ba69        Gepackt: Swf2Swc        06.06.2013 17:35:27        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core/Assets1_1.zip/                Untersuchung des Computers       
_472_ae50bdf99fa1c8fcb2441e2ccc960fdb        Gepackt: Swf2Swc        06.06.2013 17:35:24        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core/Assets1_1.zip/                Untersuchung des Computers       
_470_d2fb88df706761bab5da9b7825e15fd3        Gepackt: Swf2Swc        06.06.2013 17:35:24        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core/Assets1_1.zip/                Untersuchung des Computers       
_1065_4678eb3095717a8ebd039396f880388f        Gepackt: Swf2Swc        06.06.2013 17:35:22        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobePhotoshop12-Core/Assets1_1.zip/                Untersuchung des Computers       
_80_be332eb9be4b3dcfdcd757bbc6e495e5        Gepackt: Swf2Swc        06.06.2013 17:35:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_78_fed581e8e3789157fbc7e2b5d1a4e9cc        Gepackt: Swf2Swc        06.06.2013 17:35:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_75_6eae92679e303e167027be7733b8f6d4        Gepackt: Swf2Swc        06.06.2013 17:35:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_71_ca5898f38b5440b4ccc5c8029e30dfe3        Gepackt: Swf2Swc        06.06.2013 17:35:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_67_7de141aa4750facaa9c8fdc904d65455        Gepackt: Swf2Swc        06.06.2013 17:35:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_63_0235de021a8119d0db394a48facdd0f8        Gepackt: Swf2Swc        06.06.2013 17:35:11        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeOutputModuleAll/Assets1_1.zip/                Untersuchung des Computers       
_3_106a7d7f3761abba652da6e2be214e3b        Gepackt: Swf2Swc        06.06.2013 17:35:10        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeMiniBridge1-mul/Assets1_1.zip/                Untersuchung des Computers       
LightChrome_m.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/LightChrome/                Untersuchung des Computers       
LightChrome_jp.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/LightChrome/                Untersuchung des Computers       
LightChrome_cn.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/LightChrome/                Untersuchung des Computers       
LightChrome.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/LightChrome/                Untersuchung des Computers       
DarkChrome_m.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/DarkChrome/                Untersuchung des Computers       
DarkChrome_jp.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/DarkChrome/                Untersuchung des Computers       
DarkChrome_cn.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/DarkChrome/                Untersuchung des Computers       
DarkChrome.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/Themes/DarkChrome/                Untersuchung des Computers       
AdobeHelp.swf        Gepackt: Swf2Swc        06.06.2013 17:34:36        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeHelp.air/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:34:35        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:34:35        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:34:35        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeHelp/AdobeAIRInstaller.exe/                Untersuchung des Computers       
_8_13784d98d6ae5ed0b52e28e4358d55c2        Gepackt: Swf2Swc        06.06.2013 17:34:18        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtensionManager5.0All/Assets1_1.zip/                Untersuchung des Computers       
_12_72b7f936c68b8b9a1944753702e1f1ff        Gepackt: PE_Patch.Juba        06.06.2013 17:34:17        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtensionManager5.0All/Assets1_1.zip/                Untersuchung des Computers       
_75_519980ab0a9e3419967f5aad47b53927        Gepackt: Swf2Swc        06.06.2013 17:34:15        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtendScriptToolkit3.5.0-mul/Assets2_1.zip/                Untersuchung des Computers       
_329_1d4ea71ea4bf4ce6aa8a8997f317a99f        Gepackt: Swf2Swc        06.06.2013 17:34:15        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtendScriptToolkit3.5.0-mul/Assets2_1.zip/                Untersuchung des Computers       
_322_b10b95a24f29d32ed07587565d5ac92a        Gepackt: Swf2Swc        06.06.2013 17:34:15        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeExtendScriptToolkit3.5.0-mul/Assets2_1.zip/                Untersuchung des Computers       
_465_faecd355dc8725a13354eacec3036bd5        Gepackt: Swf2Swc        06.06.2013 17:34:14        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_328_dd4bbbb16636b8dbc0bbe8845fe0bd52        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_327_517f25891c3a5eb054ce07845ddfa830        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_325_638d16b0115cdf349c06c7049ee09a4b        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_324_e158abe23ec28d462b9ade877db0efe4        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_323_c7feb13b4dd9292f64b9dce4089f6583        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_322_7316d66c8f8deb2c6f389638fc40c4ff        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_321_16fd859249ea88288fe4f3c457c52985        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_311_81ef711c3c5fa5b11ef624db39efd28e        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_286_855869571cfb78785e8d6b236e655ea5        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_273_93c43351710ccd8111a9c0ad9eaedf12        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_263_2f70ed8d1edea667a06669e248b3dd8f        Gepackt: Swf2Swc        06.06.2013 17:34:13        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeDeviceCentral3-all/Assets1_1.zip/                Untersuchung des Computers       
_78_a31b1c964e59ca5d917955c0e28ac524        Gepackt: Swf2Swc        06.06.2013 17:34:04        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSInfrastructure2-mul/Assets2_1.zip/                Untersuchung des Computers       
StageManager-2.0.swf        Gepackt: Swf2Swc        06.06.2013 17:34:04        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSInfrastructure2-mul/Assets2_1.zip/_76_079b61b763f4ec8d086f503cae0c38ca/                Untersuchung des Computers       
_69_f0f9e01fe08b752aa3cc49d61c24ed90        Gepackt: Swf2Swc        06.06.2013 17:34:04        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSInfrastructure2-mul/Assets2_1.zip/                Untersuchung des Computers       
StageManager-2.0.swf        Gepackt: Swf2Swc        06.06.2013 17:34:04        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSInfrastructure2-mul/Assets2_1.zip/_67_2cdbe922e4bb1bf63fce51b5b031927e/                Untersuchung des Computers       
_69_1e8e0ef078bfabca6339379e16581b77        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_5_678e24457e18b778af0b672bb4cb13ab        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_4_5108810e6bb0b1d171912f652ce7578a        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_40_faccd1ce1677c09b04d18de696b29184        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_3_48ad89004dfc2fe3130e51824775a046        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_39_d8518b8a28f98e266a8ccf8f2b8c2e04        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_38_577e3098b1b600647640e58cc0a8d898        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_37_b75297e686ba7bc107f31acfb952caba        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_36_f885530c039ac5b696d45a86d8b45986        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_2_07106a68865cbbfac03b6b3c6a13e1e6        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_1_02586f2da9ea6ced63ade116038e88f9        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_130_6bc31a39cc046b3348f0e8cc94dec27f        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_125_e070d62e50b57350533ac655e9c476f8        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_119_a4df75124583143c1eab6134612d9572        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_118_def6cf3f158bafc60d4417c1abe55063        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_110_e9de56a77c2badec2c1d0a0ef0826f2f        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
_104_03adcb9b316e83b964b0745331d89b61        Gepackt: Swf2Swc        06.06.2013 17:34:00        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeCSXSExtensions2-mul/Assets2_1.zip/                Untersuchung des Computers       
Photoshop.com_Upload.swf        Gepackt: Swf2Swc        06.06.2013 17:33:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/_521_1dd5b19845901963fe4b8a748de57e75/                Untersuchung des Computers       
Flickr_Upload.swf        Gepackt: Swf2Swc        06.06.2013 17:33:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/_520_9ee52d5961f920a33aca8b55f12c5637/                Untersuchung des Computers       
Facebook_Upload.swf        Gepackt: Swf2Swc        06.06.2013 17:33:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/_519_0367c9878c079653ef91a03774c2ceea/                Untersuchung des Computers       
Computer_Upload.swf        Gepackt: Swf2Swc        06.06.2013 17:33:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/_518_a16a86c6a6cd3c4b6b61119a31c618fd/                Untersuchung des Computers       
_515_8de28d64845152aee3b88d71d6e1901b        Gepackt: Swf2Swc        06.06.2013 17:33:57        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/                Untersuchung des Computers       
_438_0a4d8e83fabb5f83f8c759cc44e32788        Gepackt: Swf2Swc        06.06.2013 17:33:56        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/                Untersuchung des Computers       
_404_31968506068829c2e98475d413ac137b        Gepackt: Swf2Swc        06.06.2013 17:33:56        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/                Untersuchung des Computers       
_353_5305047b79b270938afd4b72e444e174        Gepackt: Swf2Swc        06.06.2013 17:33:56        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeBridge4-mul/Assets1_1.zip/                Untersuchung des Computers       
AMP.swf        Gepackt: Swf2Swc        06.06.2013 17:33:51        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAMP1.8-mul/AdobeAMP1.8-mul.zip/payloads/AdobeAMP1.8-mul/adobe_media_player.air/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:33:48        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAMP1.8-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:33:48        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAMP1.8-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:33:47        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAMP1.8-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:33:45        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:33:45        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
#        Gepackt: Swf2Swc        06.06.2013 17:33:45        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
setup.swf        Gepackt: Swf2Swc        06.06.2013 17:33:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/                Untersuchung des Computers       
setup.swf        Gepackt: Swf2Swc        06.06.2013 17:33:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/Adobe AIR/Versions/1.0/Resources/                Untersuchung des Computers       
Adobe AIR Application Installer.swf        Gepackt: Swf2Swc        06.06.2013 17:33:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/payloads/AdobeAIR1.5.3-mul/AdobeAIRInstaller.exe/Adobe AIR/Versions/1.0/                Untersuchung des Computers       
UWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/UWA/UWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 17:33:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/UWA/UWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 17:33:42        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/UWA/UWA.pima/assets/                Untersuchung des Computers       
PWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/LWA/LWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 17:33:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/LWA/LWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 17:33:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/LWA/LWA.pima/assets/                Untersuchung des Computers       
AdobeIDFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:41        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/LWA/LWA.pima/                Untersuchung des Computers       
DWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:40        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/DWA/DWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 17:33:40        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/DWA/DWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 17:33:40        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/DWA/DWA.pima/assets/                Untersuchung des Computers       
AdobeIDFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:40        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/DWA/DWA.pima/                Untersuchung des Computers       
PDAppFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:40        E:\Photoshop CS5\Photoshop_CS5.iso/payloads/AdobeAIR1.5.3-mul/AdobeAIR1.5.3-mul.zip/packages/core/PDApp.pima/                Untersuchung des Computers       
PDAppFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:38        E:\Photoshop CS5\Photoshop_CS5.iso/packages/core/PDApp.pima/                Untersuchung des Computers       
UWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:37        E:\Photoshop CS5\Photoshop_CS5.iso/packages/UWA/UWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 17:33:37        E:\Photoshop CS5\Photoshop_CS5.iso/packages/UWA/UWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 17:33:37        E:\Photoshop CS5\Photoshop_CS5.iso/packages/UWA/UWA.pima/assets/                Untersuchung des Computers       
PWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/LWA/LWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 17:33:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/LWA/LWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 17:33:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/LWA/LWA.pima/assets/                Untersuchung des Computers       
AdobeIDFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/LWA/LWA.pima/                Untersuchung des Computers       
DWAFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/DWA/DWA.pima/                Untersuchung des Computers       
fonts_system.swf        Gepackt: Swf2Swc        06.06.2013 17:33:35        E:\Photoshop CS5\Photoshop_CS5.iso/packages/DWA/DWA.pima/assets/                Untersuchung des Computers       
fonts_clean.swf        Gepackt: Swf2Swc        06.06.2013 17:33:34        E:\Photoshop CS5\Photoshop_CS5.iso/packages/DWA/DWA.pima/assets/                Untersuchung des Computers       
AdobeIDFlex.swf        Gepackt: Swf2Swc        06.06.2013 17:33:34        E:\Photoshop CS5\Photoshop_CS5.iso/packages/DWA/DWA.pima/                Untersuchung des Computers       
CTRL.s3        Gepackt: MIME.Broken        06.06.2013 17:32:27        c:\Windows\System32\DriverStore\FileRepository\atiriol6.inf_amd64_neutral_bde34ad5722cca75\                Untersuchung des Computers       
470640aa4bb7db8e69196b5edb0010933569e98d        Gepackt: PE_Patch        06.06.2013 17:32:16        c:\Windows\SoftwareDistribution\Download\                Untersuchung des Computers       
_E7DB7DAC0E17348AA003F6B166591A6F        Gepackt: PE_Patch        06.06.2013 17:32:09        c:\Windows\Installer\4f639.msi/Data1.cab/                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 17:32:08        c:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744BA0000000010\11.0.0\services.cfg/SWFs/                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 17:32:08        c:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744BA0000000010\11.0.0\dexshare.spi/SWFs/                Untersuchung des Computers       
EchoSign.swf        Gepackt: Swf2Swc        06.06.2013 17:32:08        c:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA71301B744BA0000000010\11.0.0\dexechosign.spi/SWFs/                Untersuchung des Computers       
pbsvc.exe        Gepackt: UPX        06.06.2013 17:31:56        c:\Program Files (x86)\Origin Games\Battlefield 3\__Installer\punkbuster\redist\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:41        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:41        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:41        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:41        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.hdr/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:41        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.hdr/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:41        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.hdr/                Untersuchung des Computers       
_IsRes.dll        Gepackt: UPX        06.06.2013 17:31:41        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\data1.hdr/                Untersuchung des Computers       
isrt.dll        Gepackt: UPX        06.06.2013 17:31:41        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\data1.hdr/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.cab/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.cab/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\data1.cab/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.hdr/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.hdr/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.hdr/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\                Untersuchung des Computers       
_IsRes.dll        Gepackt: UPX        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\data1.cab/                Untersuchung des Computers       
mediaplayer.swf        Gepackt: Swf2Swc        06.06.2013 17:31:40        c:\Program Files (x86)\GreenTree Applications\YTD Video Downloader\                Untersuchung des Computers       
nvflsh32.sys        Gepackt: PE_Patch        06.06.2013 17:31:40        c:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\NvTool\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.cab/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
isrt.dll        Gepackt: UPX        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{40FEF622-6E0F-46B6-824B-A40C178FD4CD}\data1.cab/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.cab/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:40        c:\Program Files (x86)\InstallShield Installation Information\{186C2C57-BD0C-457B-B8C2-F3897406D97F}\data1.cab/                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 17:31:37        c:\Program Files (x86)\Adobe\Reader 11.0\Reader\Services\Services.cfg/SWFs/                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 17:31:37        c:\Program Files (x86)\Adobe\Reader 11.0\Reader\Services\DEXShare.spi/SWFs/                Untersuchung des Computers       
EchoSign.swf        Gepackt: Swf2Swc        06.06.2013 17:31:37        c:\Program Files (x86)\Adobe\Reader 11.0\Reader\Services\DEXEchoSign.spi/SWFs/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:23        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:23        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:23        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe/#/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:22        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:22        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:22        c:\Program Files\NVIDIA Corporation\Installer2\Display.3DVision.{DA956FCB-7E5A-46C4-8821-D6D59D92C90A}\3DVision_311.06.exe\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:19        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe/#/ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:19        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe/#/ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:19        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe/#/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:18        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe\ISSetup.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:18        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe\ISSetup.dll/                Untersuchung des Computers       
ISSetup.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:18        c:\NVIDIA\DisplayDriver\310.70\Win8_WinVista_Win7_64\International\NV3DVision\3DVision_310.70.exe\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:31:13        c:\Documents and Settings\user\Downloads\TFC.exe/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:31:13        c:\Documents and Settings\user\Downloads\TFC.exe/                Untersuchung des Computers       
TFC.exe        Gepackt: PE_Patch.PECompact        06.06.2013 17:31:13        c:\Documents and Settings\user\Downloads\                Untersuchung des Computers       
83CFCd01        Gepackt: Swf2Swc        06.06.2013 17:30:25        c:\Documents and Settings\user\AppData\Local\Mozilla\Firefox\Profiles\zym5a3q7.default\Cache\E\64\                Untersuchung des Computers       
E2E7Bd01        Gepackt: Swf2Swc        06.06.2013 17:30:24        c:\Documents and Settings\user\AppData\Local\Mozilla\Firefox\Profiles\zym5a3q7.default\Cache\1\E2\                Untersuchung des Computers       
BFB18d01        Gepackt: Swf2Swc        06.06.2013 17:30:24        c:\Documents and Settings\user\AppData\Local\Mozilla\Firefox\Profiles\zym5a3q7.default\Cache\0\7B\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:30:24        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/#/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:30:24        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/#/                Untersuchung des Computers       
#        Gepackt: PE_Patch.PECompact        06.06.2013 17:30:24        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/                Untersuchung des Computers       
OpenSans-Regular-webfont[1].eot        Gepackt: EOT        06.06.2013 17:30:24        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\                Untersuchung des Computers       
Firefox%20Setup%2013.0.1[1].exe        Gepackt: UPX        06.06.2013 17:30:24        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/isrt.dll/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/isrt.dll/                Untersuchung des Computers       
isrt.dll        Gepackt: PE_Patch.PECompact        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\17089_01[1].exe/                Untersuchung des Computers       
16[1].swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WMZ36B54\                Untersuchung des Computers       
OpenSans-Light-webfont[1].eot        Gepackt: EOT        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INOB6UCQ\                Untersuchung des Computers       
logo[2].swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INOB6UCQ\                Untersuchung des Computers       
drivers_notification_DE_march2009[1].swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INOB6UCQ\                Untersuchung des Computers       
29d241ab-ffa9-4ce1-bc19-5fcdcfecf657[1].swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\INOB6UCQ\                Untersuchung des Computers       
16[1].swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BW87YDVC\                Untersuchung des Computers       
OpenSans-Semibold-webfont[1].eot        Gepackt: EOT        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BNU7X8LK\                Untersuchung des Computers       
krb[1].swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BNU7X8LK\                Untersuchung des Computers       
aseru.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\zQr3eksSpnwq4ibRgfjcS2RIP3w=.dt2/                Untersuchung des Computers       
yatta.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\rxhHRWZFifWPJsblHwOPI4du0PY=.dt2/                Untersuchung des Computers       
knock.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\rXcZb6ekO9S3jB29KleJkBOXYmY=.dt2/                Untersuchung des Computers       
sad_blocks.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\RASG82FHEcFvd4GNG+agI+ySKy1M=.dt2/                Untersuchung des Computers       
punch.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\PSxahz1f6qTgCU4UU0cALUXBjw4=.dt2/                Untersuchung des Computers       
star.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\OxlFvKTDqxjyjj7+6Obz0DdN678=.dt2/                Untersuchung des Computers       
bow.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\Nt2FqWL50Iag4EvPJjVS0IoDBFQ4=.dt2/                Untersuchung des Computers       
firefly.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\MRZ8IxHqteehfHqu9JeZn0pUmQE=.dt2/                Untersuchung des Computers       
daisuki.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\jkmFW1chv5xvX1dIBhXZ0H5irPU=.dt2/                Untersuchung des Computers       
eyeball.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\enMqwlYLN4AvpmaOrIfYLWsVAdA=.dt2/                Untersuchung des Computers       
lightbulb.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\CFMGHHhzvqtshATFxrIj05VlzLY=.dt2/                Untersuchung des Computers       
cry.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\BjZmlzbZBo42FjxSxambo4D541Hg=.dt2/                Untersuchung des Computers       
heartkey.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\B1yxoWDJQ9FmoHcMiEHg3gkjbUQ=.dt2/                Untersuchung des Computers       
taxi.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\AQeQVsEXfntgB2EAzgelqTsHnR8=.dt2/                Untersuchung des Computers       
kiss.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\alxGH2FFbmTzeLEdtRHmv6GBUzdw=.dt2/                Untersuchung des Computers       
snowboarder_girl.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\5SYAzoFL2Gum2FEN2uLskOiDM0aE=.dt2/                Untersuchung des Computers       
arigatou.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\3vCybcrVq+QHLV1YUc1sjyM9v8s=.dt2/                Untersuchung des Computers       
laugh.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\4m4V6Go0+6LudOMv2FjsacIcmVVU=.dt2/                Untersuchung des Computers       
sleepy.swf        Gepackt: Swf2Swc        06.06.2013 17:30:23        c:\Documents and Settings\user\AppData\Local\Microsoft\Messenger\cihan.costur@haw-hamburg.de\ObjectStore\Winks3\1NKy92FbzJ6+mP82KkhxtOmU72Fs=.dt2/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/rmbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/rmbr.3XE/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/pevb.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/pevb.3XE/                Untersuchung des Computers       
pevb.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/pev.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/pev.3XE/                Untersuchung des Computers       
pev.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/mbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/mbr.3XE/                Untersuchung des Computers       
catchme.3XE        Gepackt: UPX        06.06.2013 17:30:20        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
f_014c37        Gepackt: Swf2Swc        06.06.2013 17:30:19        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
FileKill.3XE        Gepackt: UPX        06.06.2013 17:30:19        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
f_014bc7        Gepackt: Swf2Swc        06.06.2013 17:30:18        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_014bc5        Gepackt: Swf2Swc        06.06.2013 17:30:18        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
ERDNT.e_e        Gepackt: UPX        06.06.2013 17:30:18        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 17:30:17        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/rmbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 17:30:17        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/rmbr.3XE/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:30:17        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/pevb.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:30:17        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/pevb.3XE/                Untersuchung des Computers       
pevb.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 17:30:17        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
PecBundle        Gepackt: PECompact        06.06.2013 17:30:16        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/pev.3XE/PE_Patch.PECompact/                Untersuchung des Computers       
PE_Patch.PECompact        Gepackt: PecBundle        06.06.2013 17:30:16        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/pev.3XE/                Untersuchung des Computers       
pev.3XE        Gepackt: PE_Patch.PECompact        06.06.2013 17:30:16        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
#        Gepackt: PE_Patch        06.06.2013 17:30:16        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/mbr.3XE/                Untersuchung des Computers       
data0000.res        Gepackt: PE_Patch        06.06.2013 17:30:16        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/mbr.3XE/                Untersuchung des Computers       
f_014a0d        Gepackt: Swf2Swc        06.06.2013 17:30:15        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
catchme.3XE        Gepackt: UPX        06.06.2013 17:30:15        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
f_01491c        Gepackt: Swf2Swc        06.06.2013 17:30:15        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0148cf        Gepackt: Swf2Swc        06.06.2013 17:30:15        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
FileKill.3XE        Gepackt: UPX        06.06.2013 17:30:14        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
f_014753        Gepackt: JSPack        06.06.2013 17:30:14        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
ERDNT.e_e        Gepackt: UPX        06.06.2013 17:30:14        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\f_014306/UPX/                Untersuchung des Computers       
f_01435d        Gepackt: Swf2Swc        06.06.2013 17:30:14        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_01435c        Gepackt: Swf2Swc        06.06.2013 17:30:14        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_014306        Gepackt: UPX        06.06.2013 17:30:14        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0142b1        Gepackt: JSPack        06.06.2013 17:30:14        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_014214        Gepackt: Swf2Swc        06.06.2013 17:30:13        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_014213        Gepackt: Swf2Swc        06.06.2013 17:30:13        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_013e3b        Gepackt: Swf2Swc        06.06.2013 17:30:13        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_013c31        Gepackt: Swf2Swc        06.06.2013 17:30:13        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_013c30        Gepackt: Swf2Swc        06.06.2013 17:30:13        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_013c2f        Gepackt: Swf2Swc        06.06.2013 17:30:13        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_01363e        Gepackt: Swf2Swc        06.06.2013 17:30:12        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0134e6        Gepackt: Swf2Swc        06.06.2013 17:30:12        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0134d8        Gepackt: Swf2Swc        06.06.2013 17:30:12        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_01347a        Gepackt: Swf2Swc        06.06.2013 17:30:12        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_012e9f        Gepackt: Swf2Swc        06.06.2013 17:30:12        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_012de4        Gepackt: Swf2Swc        06.06.2013 17:30:12        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_012de3        Gepackt: Swf2Swc        06.06.2013 17:30:12        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_012002        Gepackt: Swf2Swc        06.06.2013 17:30:12        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011e6c        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011e6b        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011e69        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011821        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0116c4        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0114cf        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011498        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_011450        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
f_0113b5        Gepackt: Swf2Swc        06.06.2013 17:30:11        c:\Documents and Settings\user\AppData\Local\Google\Chrome\User Data\Default\Cache\                Untersuchung des Computers       
yrzXiAvgeQQdopyG8QSg8Q.eot        Gepackt: EOT        06.06.2013 17:30:05        c:\Documents and Settings\user\Anwendungsdaten\DAEMON Tools Lite\MediaInfo\fonts\                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 17:30:04        c:\Documents and Settings\user\Anwendungsdaten\Adobe\Acrobat\11.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_DEXShare_5F_11_2E_0_2E_1_2E_2.spi/SWFs/                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 17:30:04        c:\Documents and Settings\user\Anwendungsdaten\Adobe\Acrobat\11.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_cfg_5F_11_2E_0_2E_1_2E_2.cfg/SWFs/                Untersuchung des Computers       
3F8FBd01        Gepackt: Swf2Swc        06.06.2013 17:30:02        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\C\57\                Untersuchung des Computers       
E85D9d01        Gepackt: Swf2Swc        06.06.2013 17:30:02        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\C\3F\                Untersuchung des Computers       
0B602d01        Gepackt: Swf2Swc        06.06.2013 17:30:02        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\B\A7\                Untersuchung des Computers       
AFDC8d01        Gepackt: Swf2Swc        06.06.2013 17:30:00        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\7\CF\                Untersuchung des Computers       
53DC6d01        Gepackt: Swf2Swc        06.06.2013 17:29:58        c:\Documents and Settings\Coskun\AppData\Local\Mozilla\Firefox\Profiles\yex5hj7e.default\Cache\0\33\                Untersuchung des Computers       
SharePane.swf        Gepackt: Swf2Swc        06.06.2013 17:29:57        c:\Documents and Settings\Coskun\Anwendungsdaten\Adobe\Acrobat\11.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_DEXShare_5F_11_2E_0_2E_1_2E_2.spi/SWFs/                Untersuchung des Computers       
Update.swf        Gepackt: Swf2Swc        06.06.2013 17:29:57        c:\Documents and Settings\Coskun\Anwendungsdaten\Adobe\Acrobat\11.0\ServicesRdr\com_2E_adobe_2E_acrobat_2E_services_2E_cfg_5F_11_2E_0_2E_1_2E_2.cfg/SWFs/                Untersuchung des Computers       
        Aufgabe wurde gestartet        06.06.2013 17:29:20                        Untersuchung des Computers       
Rootkit-Suche: wurde abgeschlossen vor 2 Stunden  (Ereignisse: 2, Objekte: 1605, Zeit: 00:02:06)
scheint alles sauber zu sein

schrauber 07.06.2013 06:56
Jo, wie erwartet :)

Chico92 07.06.2013 08:26
Was mache ich jetzt mit den warnungen bei kaspersky? Überspringen?

Ein fettes dankeschön von mir für die ganze mühe und hilfe

schrauber 07.06.2013 09:15
Was für Warnungen? :)

wegen dem gepackten Müll?

Chico92 07.06.2013 15:50
Also ich meine die Bedrohungen werden immer noch angezeigt bei kaspersky

schrauber 07.06.2013 17:56
Du willst mich ärgern oder? ;)

es werden keine Bedrohungen angezeigt, nichts von svhost oder sonstwas, das Log ist der Beweis.

Das einzige was angezeigt wird ist gepackter Müll. Gepackte dateien können nicht richtig gescannt werden, deshalb die Hinweise von Kaspersky.

Chico92 07.06.2013 18:51
Ah ok.

perfekt! dankeschön für alles!!

soll ich dann auf überspringen klicken?

schrauber 08.06.2013 09:40
Genau. du kannst die Teile aber auf einfach von hand löschen wenn Du die nicht brauchst :)


Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Falls Du Lob/Kritik loswerden möchtest:
Lob, Kritik und Wünsche - Trojaner-Board


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Chico92 09.06.2013 23:27
Vielen Dank für alles!!

Alles erledigt und keine Fragen mehr. Echt großen Respekt für die ganze ehrenamtliche Arbeit!!



Vielen Dank nochmals!!!!!

schrauber 10.06.2013 06:56
Gern geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:49 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131