OTL: Code:
OTL logfile created on: 01.03.2014 01:22:22 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\X\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16660)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 45,49% Memory free
8,00 Gb Paging File | 5,78 Gb Available in Paging File | 72,24% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 75,13 Gb Total Space | 35,90 Gb Free Space | 47,78% Space Free | Partition Type: NTFS
Drive D: | 390,53 Gb Total Space | 234,50 Gb Free Space | 60,05% Space Free | Partition Type: NTFS
Computer Name: PHANT0M | User Name: X | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2014.03.01 01:20:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\X\Desktop\OTL.exe
PRC - [2014.03.01 00:01:25 | 004,781,832 | ---- | M] (Curse, Inc) -- C:\Users\X\AppData\Roaming\Curse Client\Bin\Curse.exe
PRC - [2014.02.21 08:26:16 | 001,863,560 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
PRC - [2014.02.16 19:14:27 | 001,171,968 | ---- | M] (Spotify Ltd) -- C:\Users\X\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2014.02.16 18:01:13 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013.05.11 11:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.03 03:05:58 | 002,777,736 | ---- | M] (Crawler.com) -- C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
PRC - [2010.09.07 09:26:10 | 000,532,480 | ---- | M] (ROCCAT) -- C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
PRC - [2007.09.02 13:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.exe
========== Modules (No Company Name) ==========
MOD - [2014.02.22 13:46:20 | 000,343,040 | ---- | M] () -- C:\Users\X\AppData\Roaming\Curse Client\Bin\WebRTC_CSharpWrapper.dll
MOD - [2014.02.21 08:26:16 | 016,265,096 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll
MOD - [2014.02.16 18:01:13 | 003,578,992 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2014.01.15 15:57:52 | 000,171,520 | ---- | M] () -- C:\Users\X\AppData\Roaming\Curse Client\Bin\EasyHook32.dll
MOD - [2013.12.13 07:12:44 | 000,307,712 | ---- | M] () -- C:\Users\X\AppData\Roaming\Curse Client\Bin\opus.dll
MOD - [2013.09.24 17:51:10 | 002,957,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\425664125234f98c109b88e368c06a47\System.IdentityModel.ni.dll
MOD - [2013.09.24 17:51:07 | 000,523,776 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\a51e3af81b07c1f99eb457c59e36709a\System.Net.Http.ni.dll
MOD - [2013.09.24 17:51:06 | 019,524,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\8425ade88238e0ff4275482c440cf770\System.ServiceModel.ni.dll
MOD - [2013.09.24 17:50:44 | 000,397,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\2d87130821f30d2d9e6dc2ea6fad545f\System.Xml.Linq.ni.dll
MOD - [2013.09.24 17:50:08 | 000,018,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\df646a0b29f3c1507f8f1ba18b1008ee\PresentationFramework-SystemXml.ni.dll
MOD - [2013.09.24 17:50:08 | 000,013,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio4b37ff64#\5aee59ae2e9334a39da3c4a3622b0446\PresentationFramework-SystemXmlLinq.ni.dll
MOD - [2013.09.24 17:50:07 | 000,016,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877#\f724ee38d18d3ee802ed4eee03ea5ebc\PresentationFramework-SystemData.ni.dll
MOD - [2013.09.24 14:51:40 | 018,524,672 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\cba0deda4a4dc3351b60ef5847331a57\PresentationFramework.ni.dll
MOD - [2013.09.24 14:51:25 | 013,319,168 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web\605f8c525edc9f0a50deff5c0fb44feb\System.Web.ni.dll
MOD - [2013.09.24 14:51:23 | 010,914,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\642dbe544bf2def0f54cbccbd3732744\PresentationCore.ni.dll
MOD - [2013.09.24 14:51:18 | 000,641,024 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\1d8e92865dceef10bd1624e3355963a6\System.Transactions.ni.dll
MOD - [2013.09.24 14:51:17 | 001,870,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\a9d0b7d28ba499f0cdad60cdcbc28945\System.Xaml.ni.dll
MOD - [2013.09.24 14:51:17 | 000,239,616 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404#\1667f6582c16a103b4bc7c76cfd93271\System.ComponentModel.DataAnnotations.ni.dll
MOD - [2013.09.24 14:51:14 | 007,248,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\663e5f9b02779aee04abd14fa4f3da4e\System.Data.ni.dll
MOD - [2013.09.24 14:51:14 | 003,905,024 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\5ad58a64251c19ef5bf00bbed67da6ea\WindowsBase.ni.dll
MOD - [2013.09.24 14:51:14 | 000,786,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\dd59e1b9b7fc83b22fa0086b13a59e53\System.Runtime.Remoting.ni.dll
MOD - [2013.09.24 14:51:11 | 000,462,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\221ec7edb0ebd1961ed8f4bf9a2e9797\PresentationFramework.Aero.ni.dll
MOD - [2013.09.24 14:51:10 | 012,692,992 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\cf69692e15561d1b3b29fa0925ebb2d6\System.Windows.Forms.ni.dll
MOD - [2013.09.24 14:51:07 | 000,985,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Compba577418#\62bc618c9f3bb9c97654da9d5c03bb74\System.ComponentModel.Composition.ni.dll
MOD - [2013.09.24 14:51:06 | 007,559,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\dfbb3911667f61a331d0a4fe2ea4c977\System.Xml.ni.dll
MOD - [2013.09.24 14:51:06 | 006,995,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\7380d35c99a7df2904bdb3412b1964ec\System.Core.ni.dll
MOD - [2013.09.24 14:51:05 | 000,802,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\bec16b4a17ccde41796279d03ffa4fe7\System.ServiceModel.Internals.ni.dll
MOD - [2013.09.24 14:51:05 | 000,121,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\8b1a5ba2e581c45c5c478d5813cd44a8\SMDiagnostics.ni.dll
MOD - [2013.09.24 14:51:04 | 002,785,792 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\d1d4bd2cd0772079c6b99c122d196299\System.Runtime.Serialization.ni.dll
MOD - [2013.09.24 14:51:01 | 001,630,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\7f4d08ffa8a1733a95b807e39fc4930f\System.Drawing.ni.dll
MOD - [2013.09.24 14:50:59 | 000,958,464 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\58525c5d513b1f8b2f9237eb8834fa21\System.Configuration.ni.dll
MOD - [2013.09.24 14:50:58 | 009,927,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a1fa328a03c2febf8295cd3d7d1025c1\System.ni.dll
MOD - [2013.09.02 21:13:25 | 000,189,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationTypes\fedb1433422296012c8ce48902458bf1\UIAutomationTypes.ni.dll
MOD - [2013.09.02 21:13:24 | 000,100,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\b6d5fa75e3cc493fa9d509124d5962ba\UIAutomationProvider.ni.dll
MOD - [2013.09.02 19:46:46 | 000,145,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\1346fe7d35b70702029e422970db1201\System.Numerics.ni.dll
MOD - [2013.09.02 19:46:45 | 016,501,248 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll
MOD - [2009.10.31 06:13:52 | 000,061,440 | ---- | M] () -- C:\Program Files (x86)\ROCCAT\Pyra Mouse\hiddriver.dll
MOD - [2007.09.02 13:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.exe
MOD - [2007.09.02 12:57:36 | 000,069,632 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.dll
========== Services (SafeList) ==========
SRV:64bit: - [2013.12.06 21:52:10 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2013.12.06 16:06:06 | 000,344,064 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2014.02.21 08:26:16 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014.02.16 18:01:13 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014.01.31 18:01:30 | 010,820,032 | ---- | M] (SurfRight B.V.) [Auto | Stopped] -- C:\USERS\X\APPDATA\LOCAL\TEMP\RAR$EX71.392\HITMANPRO_X64.EXE -- (HitmanPro37CrusaderBoot)
SRV - [2013.12.11 20:40:36 | 000,569,768 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.11.22 12:36:18 | 000,105,448 | ---- | M] (Razer Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe -- (RzKLService)
SRV - [2013.06.26 11:08:04 | 000,452,912 | ---- | M] (Ralink Technology, Corp.) [Disabled | Stopped] -- C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe -- (RalinkRegistryWriter64)
SRV - [2013.06.26 11:07:18 | 000,391,472 | ---- | M] (Ralink Technology, Corp.) [Disabled | Stopped] -- C:\Program Files (x86)\Ralink\Common\RaRegistry.exe -- (RalinkRegistryWriter)
SRV - [2013.05.11 11:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.04.03 03:06:12 | 001,149,104 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe -- (ST2012_Svc)
SRV - [2012.07.17 14:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012.07.09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2012.07.06 18:20:54 | 001,863,680 | ---- | M] (Ralink) [Disabled | Stopped] -- C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe -- (RaMediaServer)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2014.03.01 00:07:32 | 000,051,496 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\stflt.sys -- (sp_rsdrv2)
DRV:64bit: - [2013.12.06 22:52:14 | 013,207,552 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2013.12.06 21:21:44 | 000,626,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2013.09.24 15:53:50 | 000,094,208 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2013.09.06 20:43:08 | 002,273,072 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2013.08.09 21:22:51 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2013.03.15 16:00:06 | 000,633,680 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\Uim_IMx64.sys -- (Uim_IM)
DRV:64bit: - [2013.03.15 16:00:06 | 000,390,352 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\uim_vimx64.sys -- (Uim_VIM)
DRV:64bit: - [2013.03.15 16:00:06 | 000,090,960 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\uimx64.sys -- (UimBus)
DRV:64bit: - [2012.06.05 06:45:16 | 000,237,968 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)
DRV:64bit: - [2012.05.12 12:31:00 | 000,121,416 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.07 19:42:28 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2011.04.20 02:07:48 | 001,930,240 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 04:24:43 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub)
DRV:64bit: - [2010.11.21 04:23:48 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV:64bit: - [2010.11.21 04:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 04:23:48 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.03.04 11:26:58 | 000,349,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2013.09.19 23:05:02 | 000,059,648 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.2.0)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{758B870D-DF78-4A6A-9955-DEDDCACF94DC}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 8C D1 26 D9 95 CE 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
IE - HKCU\..\SearchScopes\{758B870D-DF78-4A6A-9955-DEDDCACF94DC}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.5.5
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.7: D:\Programme\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3508.0205: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.8: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
[2013.09.02 19:17:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X\AppData\Roaming\mozilla\Extensions
[2014.02.26 20:17:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\9aws0x8x.default\extensions
[2013.12.11 00:36:24 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\X\AppData\Roaming\mozilla\Firefox\Profiles\9aws0x8x.default\extensions\ich@maltegoetz.de
[2014.02.26 20:17:23 | 000,957,290 | ---- | M] () (No name found) -- C:\Users\X\AppData\Roaming\mozilla\firefox\profiles\9aws0x8x.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014.02.16 18:01:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2014.02.16 18:01:13 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter},
CHR - homepage:
CHR - plugin: Erster Nutzer (Disabled) = C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google-Suche = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: AdBlock = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.6_0\
CHR - Extension: avast! Online Security = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\8.0.8_0\
CHR - Extension: Arcane Legends = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibmlkgieigeddcedpbijnpojheoddido\1.0.2.2_0\
CHR - Extension: Chrome In-App Payments service = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0\
CHR - Extension: ScriptSafe = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiigbmnaadbkfbmpbfijlflahbdbdgdf\1.0.6.16_0\
CHR - Extension: Google Mail = C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2014.02.22 07:48:10 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SpywareTerminatorShield] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4:64bit: - HKLM..\Run: [SpywareTerminatorUpdater] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - HKLM..\Run: [ROCCAT Pyra Mouse] C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.EXE (ROCCAT)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\X\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk = C:\Users\X\AppData\Roaming\Curse Client\Bin\Curse.exe (Curse, Inc)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 10.25.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6A388E7-5283-499D-B51C-921B8A671935}: DhcpNameServer = 62.109.121.2 62.109.121.1
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (bootdelete)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2014.03.01 01:20:54 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\X\Desktop\OTL.exe
[2014.03.01 00:43:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
[2014.03.01 00:43:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware
[2014.03.01 00:43:00 | 000,000,000 | ---D | C] -- C:\Users\X\Documents\Anti-Malware
[2014.03.01 00:40:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2
[2014.03.01 00:33:04 | 000,012,872 | ---- | C] (SurfRight B.V.) -- C:\Windows\SysNative\bootdelete.exe
[2014.03.01 00:11:53 | 102,927,640 | ---- | C] (Microsoft Corporation) -- C:\Users\X\Desktop\msert.exe
[2014.03.01 00:09:52 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2014.03.01 00:09:13 | 040,658,208 | ---- | C] (Safer-Networking Ltd. ) -- C:\Users\X\Desktop\spybot-2.2.25.exe
[2014.03.01 00:07:32 | 000,051,496 | ---- | C] (Windows (R) Win 7 DDK provider) -- C:\Windows\SysNative\drivers\stflt.sys
[2014.03.01 00:07:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012
[2014.03.01 00:06:51 | 005,049,344 | ---- | C] (Crawler.com ) -- C:\Users\X\Desktop\SpywareTerminatorSetup_3.0.0.82.exe
[2014.03.01 00:05:31 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERSetup
[2014.02.27 18:20:34 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Roaming\Curse Advertising
[2014.02.27 18:20:12 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Roaming\Curse Client
[2014.02.27 18:19:57 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Roaming\Curse
[2014.02.22 07:54:47 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014.02.22 07:52:33 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2014.02.21 15:42:00 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2014.02.21 15:42:00 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2014.02.21 15:42:00 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2014.02.21 15:41:54 | 000,000,000 | -H-D | C] -- C:\Qoobox
[2014.02.21 15:41:41 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2014.02.17 22:32:33 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Roaming\Malwarebytes
[2014.02.16 18:01:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2014.02.13 00:41:12 | 000,000,000 | ---D | C] -- C:\Users\X\AppData\Roaming\TeamViewer
========== Files - Modified Within 30 Days ==========
[2014.03.01 01:26:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.03.01 01:20:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\X\Desktop\OTL.exe
[2014.03.01 01:15:04 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014.03.01 00:41:53 | 000,000,085 | ---- | M] () -- C:\Windows\wininit.ini
[2014.03.01 00:33:04 | 000,115,600 | ---- | M] () -- C:\Windows\SysNative\.crusader
[2014.03.01 00:33:04 | 000,093,378 | ---- | M] () -- C:\Windows\SysNative\bootdelete.lst
[2014.03.01 00:33:04 | 000,012,872 | ---- | M] (SurfRight B.V.) -- C:\Windows\SysNative\bootdelete.exe
[2014.03.01 00:19:10 | 102,927,640 | ---- | M] (Microsoft Corporation) -- C:\Users\X\Desktop\msert.exe
[2014.03.01 00:10:27 | 040,658,208 | ---- | M] (Safer-Networking Ltd. ) -- C:\Users\X\Desktop\spybot-2.2.25.exe
[2014.03.01 00:07:32 | 000,051,496 | ---- | M] (Windows (R) Win 7 DDK provider) -- C:\Windows\SysNative\drivers\stflt.sys
[2014.03.01 00:07:31 | 000,001,042 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
[2014.03.01 00:07:12 | 000,021,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.03.01 00:07:12 | 000,021,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.03.01 00:07:02 | 005,049,344 | ---- | M] (Crawler.com ) -- C:\Users\X\Desktop\SpywareTerminatorSetup_3.0.0.82.exe
[2014.02.28 23:59:33 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014.02.28 23:58:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.02.28 23:58:49 | 3220,873,216 | -HS- | M] () -- C:\hiberfil.sys
[2014.02.27 18:20:43 | 000,001,008 | ---- | M] () -- C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk
[2014.02.27 18:20:43 | 000,000,998 | ---- | M] () -- C:\Users\X\Desktop\Curse.lnk
[2014.02.27 14:05:39 | 000,190,306 | ---- | M] () -- C:\Users\X\Desktop\lcs.xps
[2014.02.26 14:45:54 | 000,090,327 | ---- | M] () -- C:\Users\X\Desktop\yeay.jpg
[2014.02.23 18:09:28 | 000,036,594 | ---- | M] () -- C:\Users\X\Desktop\1800487_3832086498895_312349564_n.jpg
[2014.02.22 18:24:56 | 000,106,260 | ---- | M] () -- C:\Users\X\Desktop\923458_301194626694689_346448997_n.jpg
[2014.02.22 07:48:10 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2014.02.21 08:26:16 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014.02.21 08:26:16 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014.02.20 14:37:08 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\sfc
[2014.02.19 01:07:24 | 003,836,290 | ---- | M] () -- C:\Users\X\Desktop\LET IT GO - Special Edition in 25 Sprachen - DIE EISKÖNIGIN - Frozen - Disney.mp3
[2014.02.18 01:00:40 | 000,045,280 | ---- | M] () -- C:\Users\X\Desktop\1526674_289115094569309_13208725_n.jpg
[2014.02.16 19:14:28 | 000,001,784 | ---- | M] () -- C:\Users\X\Desktop\Spotify.lnk
[2014.02.13 00:04:51 | 000,121,879 | ---- | M] () -- C:\Users\X\Desktop\Identformular.pdf
========== Files Created - No Company Name ==========
[2014.03.01 00:41:45 | 000,000,085 | ---- | C] () -- C:\Windows\wininit.ini
[2014.03.01 00:33:04 | 000,115,600 | ---- | C] () -- C:\Windows\SysNative\.crusader
[2014.03.01 00:31:25 | 000,093,378 | ---- | C] () -- C:\Windows\SysNative\bootdelete.lst
[2014.03.01 00:07:31 | 000,001,042 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
[2014.02.27 18:20:13 | 000,001,008 | ---- | C] () -- C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Curse.lnk
[2014.02.27 18:20:13 | 000,000,998 | ---- | C] () -- C:\Users\X\Desktop\Curse.lnk
[2014.02.27 18:20:13 | 000,000,984 | ---- | C] () -- C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse.lnk
[2014.02.27 14:05:36 | 000,190,306 | ---- | C] () -- C:\Users\X\Desktop\lcs.xps
[2014.02.26 14:45:36 | 000,090,327 | ---- | C] () -- C:\Users\X\Desktop\yeay.jpg
[2014.02.23 18:09:28 | 000,036,594 | ---- | C] () -- C:\Users\X\Desktop\1800487_3832086498895_312349564_n.jpg
[2014.02.22 18:24:56 | 000,106,260 | ---- | C] () -- C:\Users\X\Desktop\923458_301194626694689_346448997_n.jpg
[2014.02.21 15:42:00 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014.02.21 15:42:00 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014.02.21 15:42:00 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014.02.21 15:42:00 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014.02.21 15:42:00 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2014.02.20 14:37:08 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\sfc
[2014.02.19 01:07:19 | 003,836,290 | ---- | C] () -- C:\Users\X\Desktop\LET IT GO - Special Edition in 25 Sprachen - DIE EISKÖNIGIN - Frozen - Disney.mp3
[2014.02.18 01:00:40 | 000,045,280 | ---- | C] () -- C:\Users\X\Desktop\1526674_289115094569309_13208725_n.jpg
[2014.02.13 00:04:51 | 000,121,879 | ---- | C] () -- C:\Users\X\Desktop\Identformular.pdf
[2014.02.08 20:10:25 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014.01.02 14:02:34 | 000,000,000 | -H-- | C] () -- C:\ProgramData\DP45977C.lfl
[2014.01.02 13:41:30 | 000,080,316 | ---- | C] () -- C:\Windows\SysWow64\drivers\FW_7610.bin
[2014.01.02 13:41:30 | 000,046,692 | ---- | C] () -- C:\Windows\SysWow64\drivers\FW_7601.bin
[2014.01.02 13:41:29 | 000,013,973 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat
[2014.01.02 13:41:29 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\FW_2870.bin
[2014.01.02 13:41:29 | 000,004,096 | ---- | C] () -- C:\Windows\SysWow64\drivers\FW_3573.bin
[2014.01.02 13:41:19 | 000,000,451 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.ini
[2014.01.02 13:41:18 | 000,792,416 | ---- | C] () -- C:\Windows\SysWow64\DiagFunc.dll
[2013.12.06 16:44:26 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2013.11.05 19:39:44 | 000,000,000 | -HS- | C] () -- C:\Users\X\AppData\Local\LumaEmu
[2013.08.30 00:17:00 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2013.08.10 20:06:55 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.08.09 21:21:50 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2013.08.09 21:19:31 | 001,602,716 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.03.29 03:13:14 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.03.29 03:13:12 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.03.29 02:38:08 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.03.29 02:38:08 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
========== ZeroAccess Check ==========
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 06:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 05:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
< End of report > Hijackthis: Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 01:37:08, on 01.03.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16660)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Users\X\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
C:\Users\X\AppData\Roaming\Curse Client\Bin\Curse.exe
C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
C:\Users\X\AppData\Local\Temp\OCS\Downloads\fc14996dfa99adfc7baae624196888c5\7b4e384f5b096b9656fee276ba88bb81\HiJackThis204.exe
C:\Windows\SysWOW64\DllHost.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [ROCCAT Pyra Mouse] "C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.EXE"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\X\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKUS\S-1-5-18\..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe -autorun (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe -autorun (User 'Default user')
O4 - Startup: Curse.lnk = X\AppData\Roaming\Curse Client\Bin\Curse.exe
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HitmanPro 3.7 Crusader (Boot) (HitmanPro37CrusaderBoot) - SurfRight B.V. - C:\USERS\X\APPDATA\LOCAL\TEMP\RAR$EX71.392\HITMANPRO_X64.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 7323 bytes FRST:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-02-2014 01
Ran by X (administrator) on PHANT0M on 14-02-2014 20:31:20
Running from C:\Users\X\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() D:\Games\League of Legends\RADS\system\rads_user_kernel.exe
() D:\Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.199\deploy\LoLLauncher.exe
() D:\Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.71\deploy\LolClient.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13657304 2013-10-18] (Realtek Semiconductor)
HKLM-x32\...\Run: [ROCCAT Pyra Mouse] - C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.EXE [532480 2010-09-07] (ROCCAT)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKU\.DEFAULT\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
HKU\.DEFAULT\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\.DEFAULT\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\.DEFAULT\...\Policies\Explorer: [NoResolveSearch] 1
HKU\.DEFAULT\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-1637580094-1292609826-1814546496-1001\...\Run: [RocketDock] - C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-1637580094-1292609826-1814546496-1001\...\Run: [Spotify Web Helper] - "C:\Users\X\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
HKU\S-1-5-21-1637580094-1292609826-1814546496-1001\...\Policies\Explorer: [NoInternetOpenWith] 1
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x008CD126D995CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {758B870D-DF78-4A6A-9955-DEDDCACF94DC} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 62.109.121.1 62.109.121.2
FireFox:
========
FF ProfilePath: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\9aws0x8x.default
FF user.js: detected! => C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\9aws0x8x.default\user.js
FF NewTab: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @videolan.org/vlc,version=2.0.7 - D:\Programme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\9aws0x8x.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: Adblock Plus - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\9aws0x8x.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-09-02]
Chrome:
=======
CHR HomePage:
CHR RestoreOnStartup: "hxxp://google.de/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Extension: (Google Docs) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-08-10]
CHR Extension: (Google Drive) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-08-10]
CHR Extension: (YouTube) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-08-10]
CHR Extension: (Google-Suche) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-08-10]
CHR Extension: (AdBlock) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-08-10]
CHR Extension: (avast! Online Security) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-08-10]
CHR Extension: (Arcane Legends) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibmlkgieigeddcedpbijnpojheoddido [2013-08-10]
CHR Extension: (Chrome In-App Payments service) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (ScriptSafe) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiigbmnaadbkfbmpbfijlflahbdbdgdf [2013-08-10]
CHR Extension: (Google Mail) - C:\Users\X\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-08-10]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [1863680 2012-07-06] (Ralink)
S4 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448 2013-11-22] (Razer Inc.)
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2013-08-09] (DT Soft Ltd)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [90960 2013-03-15] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [633680 2013-03-15] (Paragon)
R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [390352 2013-03-15] (Paragon)
U4 SR;
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-14 20:31 - 2014-02-14 20:31 - 00012031 _____ () C:\Users\X\Desktop\FRST.txt
2014-02-14 20:31 - 2014-02-14 20:31 - 00000000 ____D () C:\FRST
2014-02-14 20:30 - 2014-02-14 20:30 - 02152960 _____ (Farbar) C:\Users\X\Desktop\FRST64.exe
2014-02-13 01:43 - 2014-02-13 01:50 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-13 01:43 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-13 00:41 - 2014-02-13 01:14 - 00000000 ____D () C:\Users\X\AppData\Roaming\TeamViewer
2014-02-09 23:15 - 2014-02-09 23:15 - 00000000 ____D () C:\Users\X\AppData\Roaming\Malwarebytes
2014-02-08 20:10 - 2014-02-14 20:28 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-08 20:10 - 2014-02-08 20:10 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-06 23:19 - 2014-02-06 23:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-01-30 23:31 - 2014-01-30 23:31 - 00000000 ____D () C:\output
2014-01-27 21:58 - 2014-02-06 21:20 - 00000000 ____D () C:\Users\X\AppData\Local\Spotify
2014-01-27 21:58 - 2014-01-27 21:58 - 00001784 _____ () C:\Users\X\Desktop\Spotify.lnk
2014-01-27 21:58 - 2014-01-27 21:58 - 00001770 _____ () C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-01-27 21:56 - 2014-02-14 07:02 - 00000000 ____D () C:\Users\X\AppData\Roaming\Spotify
2014-01-27 21:28 - 2014-01-27 21:28 - 510796913 _____ () C:\Windows\MEMORY.DMP
2014-01-27 21:28 - 2014-01-27 21:28 - 00262144 _____ () C:\Windows\Minidump\012714-21964-01.dmp
2014-01-26 21:54 - 2014-01-26 21:54 - 00000000 ____D () C:\Users\X\AppData\Roaming\ASCOMP Software
2014-01-26 20:30 - 2014-01-26 20:30 - 00000000 ____D () C:\ProgramData\launcher
2014-01-26 20:30 - 2014-01-26 20:30 - 00000000 ____D () C:\ProgramData\explauncher
2014-01-26 20:30 - 2014-01-26 20:30 - 00000000 ____D () C:\ProgramData\backup
2014-01-26 20:25 - 2014-01-26 20:25 - 00002413 _____ () C:\Users\Public\Desktop\Paragon Backup & Recovery™ 2013 Free.lnk
2014-01-26 20:24 - 2014-01-26 20:24 - 00000000 ____D () C:\Program Files (x86)\Paragon Software
2014-01-26 20:17 - 2014-01-26 20:17 - 00000693 _____ () C:\Users\X\Desktop\Facebook memes.lnk
2014-01-26 19:24 - 2014-01-26 19:24 - 00000000 ____D () C:\Users\X\Documents\Simply Super Software
2014-01-26 19:24 - 2014-01-26 19:24 - 00000000 ____D () C:\Users\X\AppData\Roaming\Simply Super Software
2014-01-26 19:23 - 2014-01-26 20:01 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.5
2014-01-26 19:23 - 2014-01-26 20:01 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-01-26 19:23 - 2014-01-26 19:23 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-01-26 19:23 - 2014-01-26 19:23 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-01-26 17:58 - 2014-01-26 18:02 - 00000000 ____D () C:\AdwCleaner
2014-01-26 17:43 - 2014-01-26 17:43 - 00000000 ____D () C:\Users\X\AppData\Roaming\Lavasoft
2014-01-26 17:43 - 2014-01-26 17:43 - 00000000 ____D () C:\Program Files\Lavasoft
2014-01-26 17:42 - 2014-01-26 17:42 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-01-26 17:40 - 2014-01-26 17:40 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-01-26 17:38 - 2014-01-26 20:01 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-01-26 17:38 - 2014-01-26 20:01 - 00000000 ____D () C:\Program Files (x86)\Spyware Terminator
2014-01-26 17:38 - 2014-01-26 17:38 - 00000000 ____D () C:\Users\X\AppData\Roaming\Spyware Terminator
2014-01-26 17:05 - 2014-01-26 20:01 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-01-26 17:05 - 2014-01-26 17:05 - 00000000 ____D () C:\Users\X\AppData\Roaming\SUPERAntiSpyware.com
2014-01-26 17:05 - 2014-01-26 17:05 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2014-01-26 16:31 - 2014-01-26 16:31 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-01-26 16:29 - 2014-01-26 20:01 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-01-26 16:29 - 2014-01-26 20:01 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-26 15:44 - 2014-01-26 20:01 - 00000000 ___HD () C:\NTKernel
2014-01-26 15:07 - 2014-01-26 15:07 - 00003184 _____ () C:\Windows\System32\Tasks\Windows Update Check - 0x090301DC
2014-01-26 15:06 - 2014-01-26 20:01 - 00000000 __SHD () C:\ProgramData\h65guhb
2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 _RSHD () C:\Users\X\AppData\Roaming\Microsoft Fx
2014-01-24 07:04 - 2014-01-24 07:05 - 00312690 _____ () C:\Users\X\Documents\ts3_clientui-win64-1382530211-2014-01-24 07_04_58.675900.dmp
==================== One Month Modified Files and Folders =======
2014-02-14 20:31 - 2014-02-14 20:31 - 00012031 _____ () C:\Users\X\Desktop\FRST.txt
2014-02-14 20:31 - 2014-02-14 20:31 - 00000000 ____D () C:\FRST
2014-02-14 20:30 - 2014-02-14 20:30 - 02152960 _____ (Farbar) C:\Users\X\Desktop\FRST64.exe
2014-02-14 20:28 - 2014-02-08 20:10 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-14 20:26 - 2013-10-24 18:43 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-14 20:24 - 2009-07-14 05:45 - 00021248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-14 20:24 - 2009-07-14 05:45 - 00021248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-14 20:20 - 2013-08-09 19:06 - 01119397 _____ () C:\Windows\WindowsUpdate.log
2014-02-14 20:17 - 2014-01-08 21:00 - 00002567 _____ () C:\Windows\setupact.log
2014-02-14 20:17 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-14 07:38 - 2013-08-10 20:27 - 00000000 ____D () C:\Users\X\AppData\Roaming\TS3Client
2014-02-14 07:15 - 2013-08-10 15:52 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-14 07:02 - 2014-01-27 21:56 - 00000000 ____D () C:\Users\X\AppData\Roaming\Spotify
2014-02-13 21:25 - 2014-01-10 20:03 - 00000000 ____D () C:\Users\X\Desktop\Eminem - The Marshall Mathers LP 2 iM1
2014-02-13 01:50 - 2014-02-13 01:43 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-13 01:14 - 2014-02-13 00:41 - 00000000 ____D () C:\Users\X\AppData\Roaming\TeamViewer
2014-02-09 23:15 - 2014-02-09 23:15 - 00000000 ____D () C:\Users\X\AppData\Roaming\Malwarebytes
2014-02-09 23:14 - 2014-01-08 21:21 - 00094312 _____ () C:\Windows\PFRO.log
2014-02-08 20:10 - 2014-02-08 20:10 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-08 20:10 - 2013-08-10 15:52 - 00004096 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-08 01:17 - 2013-09-02 19:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-06 23:19 - 2014-02-06 23:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-06 21:20 - 2014-01-27 21:58 - 00000000 ____D () C:\Users\X\AppData\Local\Spotify
2014-02-05 23:26 - 2013-10-24 18:43 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-05 23:26 - 2013-09-02 19:23 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-05 23:26 - 2013-09-02 19:23 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-05 22:34 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-30 23:31 - 2014-01-30 23:31 - 00000000 ____D () C:\output
2014-01-27 21:58 - 2014-01-27 21:58 - 00001784 _____ () C:\Users\X\Desktop\Spotify.lnk
2014-01-27 21:58 - 2014-01-27 21:58 - 00001770 _____ () C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2014-01-27 21:28 - 2014-01-27 21:28 - 510796913 _____ () C:\Windows\MEMORY.DMP
2014-01-27 21:28 - 2014-01-27 21:28 - 00262144 _____ () C:\Windows\Minidump\012714-21964-01.dmp
2014-01-27 21:28 - 2013-08-16 22:48 - 00000000 ____D () C:\Windows\Minidump
2014-01-26 22:19 - 2013-08-09 21:26 - 00000000 ___RD () C:\Users\X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-26 22:15 - 2014-01-02 13:53 - 00000000 ____D () C:\Windows\pss
2014-01-26 22:14 - 2013-12-04 15:35 - 00000000 ____D () C:\Program Files\CCleaner
2014-01-26 22:08 - 2013-08-09 21:26 - 00092632 _____ () C:\Users\X\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-26 22:07 - 2009-07-14 05:45 - 00372016 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-26 21:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-01-26 21:54 - 2014-01-26 21:54 - 00000000 ____D () C:\Users\X\AppData\Roaming\ASCOMP Software
2014-01-26 21:53 - 2013-11-10 04:44 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-26 21:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-01-26 21:52 - 2009-07-14 03:34 - 00000387 _____ () C:\Windows\win.ini
2014-01-26 21:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2014-01-26 21:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\oobe
2014-01-26 20:30 - 2014-01-26 20:30 - 00000000 ____D () C:\ProgramData\launcher
2014-01-26 20:30 - 2014-01-26 20:30 - 00000000 ____D () C:\ProgramData\explauncher
2014-01-26 20:30 - 2014-01-26 20:30 - 00000000 ____D () C:\ProgramData\backup
2014-01-26 20:25 - 2014-01-26 20:25 - 00002413 _____ () C:\Users\Public\Desktop\Paragon Backup & Recovery™ 2013 Free.lnk
2014-01-26 20:24 - 2014-01-26 20:24 - 00000000 ____D () C:\Program Files (x86)\Paragon Software
2014-01-26 20:17 - 2014-01-26 20:17 - 00000693 _____ () C:\Users\X\Desktop\Facebook memes.lnk
2014-01-26 20:04 - 2013-08-09 21:26 - 00000000 ____D () C:\Users\X
2014-01-26 20:01 - 2014-01-26 19:23 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.5
2014-01-26 20:01 - 2014-01-26 19:23 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-01-26 20:01 - 2014-01-26 17:38 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-01-26 20:01 - 2014-01-26 17:38 - 00000000 ____D () C:\Program Files (x86)\Spyware Terminator
2014-01-26 20:01 - 2014-01-26 17:05 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-01-26 20:01 - 2014-01-26 16:29 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-01-26 20:01 - 2014-01-26 16:29 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-26 20:01 - 2014-01-26 15:44 - 00000000 ___HD () C:\NTKernel
2014-01-26 20:01 - 2014-01-26 15:06 - 00000000 __SHD () C:\ProgramData\h65guhb
2014-01-26 20:01 - 2014-01-08 19:51 - 00000000 ____D () C:\ProgramData\Razer
2014-01-26 20:01 - 2014-01-08 19:51 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-01-26 20:01 - 2014-01-08 19:14 - 00000000 ____D () C:\Users\X\AppData\Roaming\newnext.me
2014-01-26 20:01 - 2014-01-08 19:14 - 00000000 ____D () C:\Users\X\AppData\Local\genienext
2014-01-26 20:01 - 2014-01-08 19:13 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2014-01-26 20:01 - 2013-12-04 15:44 - 00000000 ____D () C:\Users\X\AppData\Roaming\Wise Registry Cleaner
2014-01-26 20:01 - 2013-12-04 15:35 - 00000000 ____D () C:\Users\X\AppData\Roaming\DesktopIconForAmazon
2014-01-26 20:01 - 2013-09-02 19:42 - 00000000 ____D () C:\Users\X\AppData\Roaming\PhotoScape
2014-01-26 20:01 - 2013-08-09 19:11 - 00000000 ____D () C:\Program Files (x86)\RocketDock
2014-01-26 20:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-26 20:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-01-26 19:58 - 2013-09-02 19:17 - 00000000 ____D () C:\Users\X\AppData\Local\Mozilla
2014-01-26 19:58 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-01-26 19:57 - 2014-01-08 19:14 - 00000000 ____D () C:\Users\X\AppData\Local\Mobogenie
2014-01-26 19:57 - 2013-10-29 23:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-01-26 19:30 - 2010-11-21 07:50 - 00127494 _____ () C:\Windows\system32\perfc007.dat
2014-01-26 19:24 - 2014-01-26 19:24 - 00000000 ____D () C:\Users\X\Documents\Simply Super Software
2014-01-26 19:24 - 2014-01-26 19:24 - 00000000 ____D () C:\Users\X\AppData\Roaming\Simply Super Software
2014-01-26 19:23 - 2014-01-26 19:23 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-01-26 19:23 - 2014-01-26 19:23 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-01-26 18:17 - 2010-11-21 08:00 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-01-26 18:02 - 2014-01-26 17:58 - 00000000 ____D () C:\AdwCleaner
2014-01-26 17:43 - 2014-01-26 17:43 - 00000000 ____D () C:\Users\X\AppData\Roaming\Lavasoft
2014-01-26 17:43 - 2014-01-26 17:43 - 00000000 ____D () C:\Program Files\Lavasoft
2014-01-26 17:42 - 2014-01-26 17:42 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-01-26 17:40 - 2014-01-26 17:40 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-01-26 17:38 - 2014-01-26 17:38 - 00000000 ____D () C:\Users\X\AppData\Roaming\Spyware Terminator
2014-01-26 17:05 - 2014-01-26 17:05 - 00000000 ____D () C:\Users\X\AppData\Roaming\SUPERAntiSpyware.com
2014-01-26 17:05 - 2014-01-26 17:05 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2014-01-26 16:31 - 2014-01-26 16:31 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-01-26 15:07 - 2014-01-26 15:07 - 00003184 _____ () C:\Windows\System32\Tasks\Windows Update Check - 0x090301DC
2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 _RSHD () C:\Users\X\AppData\Roaming\Microsoft Fx
2014-01-24 07:05 - 2014-01-24 07:04 - 00312690 _____ () C:\Users\X\Documents\ts3_clientui-win64-1382530211-2014-01-24 07_04_58.675900.dmp
2014-01-22 20:36 - 2014-01-08 19:52 - 00000000 ____D () C:\Users\X\AppData\Local\Razer
2014-01-15 19:55 - 2010-11-21 07:50 - 00702964 _____ () C:\Windows\system32\perfh007.dat
2014-01-15 19:55 - 2010-11-21 07:50 - 00150604 _____ () C:\Windows\system32\perfc007(25).dat
2014-01-15 19:55 - 2009-07-14 06:13 - 01629372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-15 19:55 - 2009-07-14 03:36 - 00123008 _____ () C:\Windows\system32\perfc009(26).dat
Some content of TEMP:
====================
C:\Users\X\AppData\Local\Temp\BackupSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-08 11:06
==================== End Of Log ============================ --- --- ---
Und zu guter letzt
Eset Online Scanner: Code:
C:\AdwCleaner\Quarantine\C\Users\X\AppData\Local\genienext\nengine.dll.vir Win32/NextLive.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\X\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe.vir a variant of Win32/Mobogenie.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\X\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe.vir a variant of Win32/Mobogenie.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\X\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\nengine.dll.vir Win32/NextLive.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\X\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe.vir a variant of Win32/Mobogenie.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\X\AppData\Local\Temp\OCS\ocs_v71a.exe.vir a variant of Win32/DownloadSponsor.A potentially unwanted application
C:\Users\X\AppData\Local\genienext\nengine.dll Win32/NextLive.A potentially unwanted application
C:\Users\X\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\DaemonProcess.exe a variant of Win32/Mobogenie.A potentially unwanted application
C:\Users\X\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\Mobogenie.exe a variant of Win32/Mobogenie.A potentially unwanted application
C:\Users\X\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\nengine.dll Win32/NextLive.A potentially unwanted application
C:\Users\X\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\New_UpdateMoboGenie.exe a variant of Win32/Mobogenie.A potentially unwanted application
C:\Users\X\AppData\Roaming\newnext.me\nengine.dll Win32/NextLive.A potentially unwanted application |