Trojaner-Board - Webseiten werden auf Werbung umgeleitet

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Webseiten werden auf Werbung umgeleitet (https://www.trojaner-board.de/152815-webseiten-werbung-umgeleitet.html)

Kerrigan

21.04.2014 14:51

Webseiten werden auf Werbung umgeleitet

Hallo,

ich habe ein sehr nerviges Problem was mich langsam aber sicher zur Verzweifelung treibt. Ich surfe im Internet mit Chrome und seit ein paar Wochen tritt dort ein Werbeproblem auf was merkwürdigerweise nicht alle Webseiten betrifft, aber leider viele.

Wenn ich eine neue Seite öffne wird diese ganz normal geladen, sobald ich jedoch einen Link auf der Seite anklicke öffnet sich statt des normalen Links ein neuer Tab mit nerviger Werbung ( die vorzugsweise in koreanisch ist... ) Wenn ich auf einer der betroffenen Webseiten einfach nur auf eine freie Fläche auf der Seite klicke öffnet sich ebenfalls ein neuer Tab mit Werbung.
Ab und zu erscheint rechts unten auf der Seite ein weiser Balken wo nur der Balken und X zum schließen zu sehen ist. Nahezu alle diese Werbetabs haben übrigens extrem nervige Hintergrundmusik. Teilweise ist die Werbung nicht mal zu sehen und man hat nur den Sound. Stoppen kann man ihn nur wenn man die komplette Seite zumacht obwohl dort nichtmal Werbung zu sehen ist. Das passiert wie gesagt nicht bei allen Seiten ( Twitter ist zum Beispiel nicht betroffen ) aber leider doch bei vielen Seiten. Zum Beispiel auch bei diesem Board hier. :(

Ich hab mir die Anleitung durchgelesen und die Schritte alle ausgeführt. Hier sind die Scans. Ich hoffe wirklich das mir hier jemand helfen kann. Vielen Dank im Vorraus.

Scan FRST

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02

Ran by PC1 (administrator) on PC1-PC-NE on 21-04-2014 15:00:10

Running from C:\Users\PC1\Downloads

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

The only official download link for FRST:

Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 

Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\PC1\AppData\Roaming\Spotify\spotify.exe

(Spotify Ltd) C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\PC1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\MountPoints2: {b3c3e069-3042-11e3-b41d-806e6f6e6963} - D:\autorun.exe

Startup: C:\Users\PC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\PC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR StartupUrls: "hxxp://www.google.com"

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll ()

CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gears.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll No File

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR Extension: (ProxTube) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-02-25]

CHR Extension: (Adblock Plus) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-19]

CHR Extension: (Google Wallet) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-09]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\PC1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:50 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-21 12:50 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-21 12:50 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\PC1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-16 15:57 - 585078025 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-16 15:57 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\TS3Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999.zip

2014-04-09 19:03 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-09 19:03 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-09 19:03 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-09 19:03 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys

2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll

2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll

2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\PC1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\PC1\Downloads\adwcleaner.exe

2014-04-09 18:30 - 2014-04-21 15:00 - 00014824 _____ () C:\Users\PC1\Downloads\FRST.txt

2014-04-09 18:30 - 2014-04-21 15:00 - 00000000 ____D () C:\FRST

2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\PC1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\PC1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\PC1\Documents\Anti-Malware

2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\PC1\Downloads\EmsisoftAntiMalwareSetup_81040.exe

2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0

2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\PC1\Downloads\chromeinstall-7u51.exe

2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-03-27 14:13 - 2014-04-20 21:41 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (2).exe

2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (1).exe

2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000.exe

2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\PC1\Downloads\SZSetup_AID10121_AV.exe

2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader (1).exe

2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader.exe

2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995 (1).zip

2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995.zip
 

==================== One Month Modified Files and Folders =======
 

2014-04-21 15:00 - 2014-04-09 18:30 - 00014824 _____ () C:\Users\PC1\Downloads\FRST.txt

2014-04-21 15:00 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe

2014-04-21 14:42 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\Spotify

2014-04-21 14:20 - 2013-10-08 21:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-21 14:17 - 2013-10-08 19:57 - 01151524 _____ () C:\Windows\WindowsUpdate.log

2014-04-21 14:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\PC1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\PC1\Documents\Anti-Malware

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-21 12:50 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-21 12:49 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-21 12:49 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-21 12:42 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-04-21 12:41 - 2013-10-08 21:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-21 12:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-21 12:41 - 2009-07-14 06:51 - 00036998 _____ () C:\Windows\setupact.log

2014-04-20 23:18 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\PC1\AppData\Local\Battle.net

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\PC1\Downloads\Malkorok.zip

2014-04-20 21:41 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\PC1\AppData\Local\Deployment

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-17 19:39 - 2010-11-21 05:47 - 00281792 _____ () C:\Windows\PFRO.log

2014-04-16 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 16:01 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\PC1\AppData\Local\Google

2014-04-16 15:59 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\PC1\AppData\Local\Spotify

2014-04-16 15:57 - 2014-04-16 15:57 - 585078025 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-16 15:57 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-21 12:50 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-21 12:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-21 12:50 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\TS3Client

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999.zip

2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\PC1\Downloads\SecurityCheck.exe

2014-04-09 18:47 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\PC1\Downloads\adwcleaner.exe

2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\PC1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\PC1\Downloads\FRST64.exe

2014-04-09 18:24 - 2013-10-08 21:41 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\PC1\Downloads\EmsisoftAntiMalwareSetup_81040.exe

2014-04-01 18:15 - 2013-10-08 21:40 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-01 18:15 - 2013-10-08 21:40 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-03-31 03:16 - 2014-04-09 19:03 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-03-31 03:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-03-31 02:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-03-31 01:57 - 2014-04-09 19:03 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0

2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources

2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\PC1\Downloads\chromeinstall-7u51.exe

2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (2).exe

2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (1).exe

2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000.exe

2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\PC1\Downloads\SZSetup_AID10121_AV.exe

2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader (1).exe

2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader.exe

2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995 (1).zip

2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995.zip
 

Some content of TEMP:

====================

C:\Users\PC1\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-04-21 14:43
 

==================== End Of Log ============================

Scan gmer

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-04-21 15:23:07

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD10EALX-009BA0 rev.15.01H15 931,51GB

Running: Gmer-19357.exe; Driver: C:\Users\Username~1\AppData\Local\Temp\agecyuoc.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text   C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[1920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                  00000000765c1465 2 bytes [5C, 76]

.text   C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[1920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                 00000000765c14bb 2 bytes [5C, 76]

.text   ...                                                                                                                                                                   * 2

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                    0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                       00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                     0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                    00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                               00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                        0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                        000007fefd359055 3 bytes [B5, 6F, 06]

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                                000007fefd6b55c8 6 bytes {JMP QWORD [RIP+0xfaa68]}

.text   C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                                000007fefd6cb85c 6 bytes {JMP QWORD [RIP+0xc47d4]}

.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                     0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}

.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                        00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}

.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                      0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}

.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                     00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}

.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                  0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}

.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}

.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                         0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}

.text   C:\Windows\system32\taskeng.exe[2892] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                         000007fefd359055 3 bytes CALL 9000027

.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                         0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}

.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                            00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}

.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                          0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}

.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                         00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}

.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                      0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}

.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                    00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}

.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                             0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}

.text   C:\Windows\system32\Dwm.exe[2908] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                             000007fefd359055 3 bytes CALL 9000027

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                             0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                              0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                             00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                          0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                        00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                 000007fefd359055 3 bytes [B5, 6F, 29]

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiSetInternalUI                                                                                            000007fef6285cd0 6 bytes JMP 23f

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiInstallProductA                                                                                          000007fef6300f20 6 bytes {JMP QWORD [RIP+0x2cf110]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiInstallProductW                                                                                          000007fef630faa8 6 bytes JMP 0

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                                                      000007fef7f67b34 6 bytes JMP 300030

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                                                      000007fef7f703c0 6 bytes JMP 610048

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW                                                                                   000007feff283030 6 bytes {JMP QWORD [RIP+0x2dd000]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!connect + 1                                                                                              000007feff2845c1 5 bytes {JMP QWORD [RIP+0x28ba70]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!listen                                                                                                   000007feff288290 6 bytes {JMP QWORD [RIP+0x2b7da0]}

.text   C:\Windows\Explorer.EXE[2980] C:\Windows\system32\RASAPI32.dll!RasDialW + 1                                                                                           000007fee8e296f5 5 bytes JMP 4d004d

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                    0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                       00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                     0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                    00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                               00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                        0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                        000007fefd359055 3 bytes [B5, 6F, 41]

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                             000007fef7f67b34 6 bytes {JMP QWORD [RIP+0x884fc]}

.text   C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                             000007fef7f703c0 6 bytes {JMP QWORD [RIP+0x9fc70]}

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                00000000773ffc20 3 bytes JMP 7181000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                            00000000773ffc24 2 bytes JMP 7181000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                   00000000773ffd64 3 bytes JMP 717b000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                               00000000773ffd68 2 bytes JMP 717b000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                 00000000774000b4 3 bytes JMP 717e000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                             00000000774000b8 2 bytes JMP 717e000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                00000000774001c4 3 bytes JMP 7187000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                            00000000774001c8 2 bytes JMP 7187000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                             0000000077400a44 3 bytes JMP 7184000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                         0000000077400a48 2 bytes JMP 7184000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                           0000000077401920 3 bytes JMP 7178000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                       0000000077401924 2 bytes JMP 7178000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                    00000000766c3bbb 3 bytes JMP 7175000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                00000000766c3bbf 2 bytes JMP 7175000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                    0000000076cf2c91 4 bytes CALL 71af0000

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendMessageW                                                0000000076ef9679 6 bytes JMP 7196000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!PostMessageW                                                0000000076f012a5 6 bytes JMP 7190000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!PostMessageA                                                0000000076f03baa 6 bytes JMP 7193000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendMessageA                                                0000000076f0612e 6 bytes JMP 7199000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendInput                                                   0000000076f1ff4a 3 bytes JMP 719c000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendInput + 4                                               0000000076f1ff4e 2 bytes JMP 719c000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!mouse_event                                                 0000000076f5027b 6 bytes JMP 71a2000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!keybd_event                                                 0000000076f502bf 6 bytes JMP 719f000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                            0000000076ae70c4 6 bytes JMP 718a000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                            0000000076b03264 6 bytes JMP 718d000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                                      000000007685575a 6 bytes JMP 71a5000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!connect                                                     0000000076856bdd 6 bytes JMP 71ab000a

.text   C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!listen                                                      000000007685b001 6 bytes JMP 71a8000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                  00000000773ffc20 3 bytes JMP 718a000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4              00000000773ffc24 2 bytes JMP 718a000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                     00000000773ffd64 3 bytes JMP 7184000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                 00000000773ffd68 2 bytes JMP 7184000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                   00000000774000b4 3 bytes JMP 7187000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4               00000000774000b8 2 bytes JMP 7187000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                  00000000774001c4 3 bytes JMP 7190000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4              00000000774001c8 2 bytes JMP 7190000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey               0000000077400a44 3 bytes JMP 718d000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4           0000000077400a48 2 bytes JMP 718d000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread             0000000077401920 3 bytes JMP 7181000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4         0000000077401924 2 bytes JMP 7181000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW      00000000766c3bbb 3 bytes JMP 717e000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4  00000000766c3bbf 2 bytes JMP 717e000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493      0000000076cf2c91 4 bytes CALL 71af0000

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendMessageW                  0000000076ef9679 6 bytes JMP 719f000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!PostMessageW                  0000000076f012a5 6 bytes JMP 7199000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!PostMessageA                  0000000076f03baa 6 bytes JMP 719c000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendMessageA                  0000000076f0612e 6 bytes JMP 71a2000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendInput                     0000000076f1ff4a 3 bytes JMP 71a5000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendInput + 4                 0000000076f1ff4e 2 bytes JMP 71a5000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!mouse_event                   0000000076f5027b 6 bytes JMP 71ab000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!keybd_event                   0000000076f502bf 6 bytes JMP 71a8000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW              0000000076ae70c4 6 bytes JMP 7193000a

.text   C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA              0000000076b03264 6 bytes JMP 7196000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                        00000000773ffc20 3 bytes JMP 718a000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                    00000000773ffc24 2 bytes JMP 718a000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                           00000000773ffd64 3 bytes JMP 7184000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                       00000000773ffd68 2 bytes JMP 7184000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                         00000000774000b4 3 bytes JMP 7187000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                     00000000774000b8 2 bytes JMP 7187000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                        00000000774001c4 3 bytes JMP 7190000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                    00000000774001c8 2 bytes JMP 7190000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                     0000000077400a44 3 bytes JMP 718d000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                 0000000077400a48 2 bytes JMP 718d000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                   0000000077401920 3 bytes JMP 7181000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                               0000000077401924 2 bytes JMP 7181000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                            00000000766c3bbb 3 bytes JMP 717e000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                        00000000766c3bbf 2 bytes JMP 717e000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                            0000000076cf2c91 4 bytes CALL 71af0000

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                        0000000076ef9679 6 bytes JMP 719f000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                        0000000076f012a5 6 bytes JMP 7199000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                        0000000076f03baa 6 bytes JMP 719c000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                        0000000076f0612e 6 bytes JMP 71a2000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendInput                                                                           0000000076f1ff4a 3 bytes JMP 71a5000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                       0000000076f1ff4e 2 bytes JMP 71a5000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!mouse_event                                                                         0000000076f5027b 6 bytes JMP 71ab000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!keybd_event                                                                         0000000076f502bf 6 bytes JMP 71a8000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                    0000000076ae70c4 6 bytes JMP 7193000a

.text   C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                    0000000076b03264 6 bytes JMP 7196000a

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                              00000000773ffc20 3 bytes [FF, 25, 1E]

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                          00000000773ffc24 2 bytes [89, 71]

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                 00000000773ffd64 3 bytes JMP 7184000a

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                             00000000773ffd68 2 bytes JMP 7184000a

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                               00000000774000b4 3 bytes JMP 7187000a

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                           00000000774000b8 2 bytes JMP 7187000a

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                              00000000774001c4 3 bytes [FF, 25, 1E]

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                          00000000774001c8 2 bytes [8F, 71]

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                           0000000077400a44 3 bytes [FF, 25, 1E]

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                       0000000077400a48 2 bytes [8C, 71]

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                         0000000077401920 3 bytes [FF, 25, 1E]

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                     0000000077401924 2 bytes [80, 71]

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                  00000000766c3bbb 3 bytes JMP 717e000a

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                              00000000766c3bbf 2 bytes JMP 717e000a

.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                  0000000076cf2c91 4 bytes CALL 71af0000

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                     00000000773ffc20 3 bytes JMP 7184000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                 00000000773ffc24 2 bytes JMP 7184000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                        00000000773ffd64 3 bytes JMP 717e000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                    00000000773ffd68 2 bytes JMP 717e000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                      00000000774000b4 3 bytes JMP 7181000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                  00000000774000b8 2 bytes JMP 7181000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                     00000000774001c4 3 bytes JMP 718a000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                 00000000774001c8 2 bytes JMP 718a000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                  0000000077400a44 3 bytes JMP 7187000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                              0000000077400a48 2 bytes JMP 7187000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                0000000077401920 3 bytes JMP 717b000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                            0000000077401924 2 bytes JMP 717b000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                         00000000766c3bbb 3 bytes JMP 7178000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                     00000000766c3bbf 2 bytes JMP 7178000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                         0000000076cf2c91 4 bytes CALL 71af0000

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                     0000000076ef9679 6 bytes JMP 7199000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                     0000000076f012a5 6 bytes JMP 7193000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                     0000000076f03baa 6 bytes JMP 7196000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                     0000000076f0612e 6 bytes JMP 719c000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendInput                                                                        0000000076f1ff4a 3 bytes JMP 719f000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                    0000000076f1ff4e 2 bytes JMP 719f000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!mouse_event                                                                      0000000076f5027b 6 bytes JMP 71a5000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!keybd_event                                                                      0000000076f502bf 6 bytes JMP 71a2000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                 0000000076ae70c4 6 bytes JMP 718d000a

.text   C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                 0000000076b03264 6 bytes JMP 7190000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                 00000000773ffc20 3 bytes JMP 7184000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                             00000000773ffc24 2 bytes JMP 7184000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                    00000000773ffd64 3 bytes JMP 717e000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                00000000773ffd68 2 bytes JMP 717e000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                  00000000774000b4 3 bytes JMP 7181000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                              00000000774000b8 2 bytes JMP 7181000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                 00000000774001c4 3 bytes JMP 718a000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                             00000000774001c8 2 bytes JMP 718a000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                              0000000077400a44 3 bytes JMP 7187000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                          0000000077400a48 2 bytes JMP 7187000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                            0000000077401920 3 bytes JMP 717b000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                        0000000077401924 2 bytes JMP 717b000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                     00000000766c3bbb 3 bytes JMP 7178000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                 00000000766c3bbf 2 bytes JMP 7178000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                     0000000076cf2c91 4 bytes CALL 71af0000

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                 0000000076ef9679 6 bytes JMP 7199000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                 0000000076f012a5 6 bytes JMP 7193000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                 0000000076f03baa 6 bytes JMP 7196000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                 0000000076f0612e 6 bytes JMP 719c000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendInput                                                                    0000000076f1ff4a 3 bytes JMP 719f000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                0000000076f1ff4e 2 bytes JMP 719f000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!mouse_event                                                                  0000000076f5027b 6 bytes JMP 71a5000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!keybd_event                                                                  0000000076f502bf 6 bytes JMP 71a2000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                             0000000076ae70c4 6 bytes JMP 718d000a

.text   C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                             0000000076b03264 6 bytes JMP 7190000a

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                    00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                  0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                              0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                     000007fefd359055 3 bytes [B5, 6F, 06]

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                    00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                  0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                              0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}

.text   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                     000007fefd359055 3 bytes [B5, 6F, 06]

.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                     0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}

.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                        00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}

.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                      0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}

.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                     00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}

.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                  0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}

.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}

.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                         0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}

.text   C:\Windows\system32\wuauclt.exe[7664] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                         000007fefd359055 3 bytes CALL 9000027

.text   C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4648] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                           00000000765c1465 2 bytes [5C, 76]

.text   C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4648] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                          00000000765c14bb 2 bytes [5C, 76]

.text   ...                                                                                                                                                                   * 2

.text   C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6076] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                          00000000765c1465 2 bytes [5C, 76]

.text   C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6076] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                         00000000765c14bb 2 bytes [5C, 76]

.text   ...                                                                                                                                                                   * 2
 

---- Threads - GMER 2.1 ----
 

Thread  C:\Windows\System32\svchost.exe [5572:7688]                                                                                                                           000007feec939688
 

---- EOF - GMER 2.1 ----

schrauber

21.04.2014 19:10

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Kerrigan

21.04.2014 21:04

Hallo,

danke für die schnelle Antwort! :) Hier ist der gewünschte Scan. Combofix hat gemeckert das Spybot noch an wäre obwohl ich alles deaktiviert hatte. Das Ergebnis des Scans sah so aus:

Code:

ComboFix 14-04-20.01 - Username 21.04.2014  21:52:01.1.6 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8174.6461 [GMT 2:00]

ausgeführt von:: c:\users\Username\Downloads\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}

SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}

SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-03-21 bis 2014-04-21  ))))))))))))))))))))))))))))))

.

.

2014-04-21 19:56 . 2014-04-21 19:56        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-04-21 13:02 . 2014-04-21 13:23        --------        d-----w-        C:\Scans

2014-04-21 11:27 . 2013-09-20 08:49        21040        ----a-w-        c:\windows\system32\sdnclean64.exe

2014-04-21 11:27 . 2014-04-21 11:32        --------        d-----w-        c:\programdata\Spybot - Search & Destroy

2014-04-21 11:27 . 2014-04-21 11:33        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy 2

2014-04-21 10:50 . 2014-04-14 18:13        96168        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2014-04-18 15:55 . 2014-04-17 03:31        10651704        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{D3B4B546-8EB5-45BF-B854-5815069D28B0}\mpengine.dll

2014-04-16 14:03 . 2014-04-16 14:06        --------        d-----w-        c:\windows\system32\appmgmt

2014-04-12 15:16 . 2014-04-13 20:07        --------        d-----w-        c:\users\Username\AppData\Roaming\TS3Client

2014-04-12 15:16 . 2014-04-12 15:16        --------        d-----w-        c:\program files\TeamSpeak 3 Client

2014-04-09 17:03 . 2014-03-31 01:16        23134208        ----a-w-        c:\windows\system32\mshtml.dll

2014-04-09 17:03 . 2014-03-31 01:13        2724864        ----a-w-        c:\windows\system32\mshtml.tlb

2014-04-09 17:03 . 2014-03-31 00:13        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2014-04-09 16:30 . 2014-04-21 13:00        --------        d-----w-        C:\FRST

2014-04-02 22:03 . 2014-04-21 15:17        --------        d-----w-        c:\program files (x86)\Emsisoft Anti-Malware

2014-03-28 00:05 . 2014-03-28 00:05        --------        d-----w-        c:\program files (x86)\MSXML 4.0

2014-03-27 12:13 . 2014-04-20 19:41        119512        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys

2014-03-27 12:13 . 2014-03-27 12:13        --------        d-----w-        c:\programdata\Malwarebytes

2014-03-27 12:08 . 2014-03-27 12:08        --------        d-----w-        c:\users\Username\AppData\Local\Programs

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-04-03 15:55 . 2013-10-14 12:04        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-04-03 15:55 . 2013-10-14 12:04        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-03-31 07:35 . 2010-11-21 03:27        270496        ------w-        c:\windows\system32\MpSigStub.exe

2014-03-04 09:17 . 2014-04-09 16:59        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2014-03-01 05:16 . 2014-03-13 17:51        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll

2014-03-01 04:58 . 2014-03-13 17:51        2765824        ----a-w-        c:\windows\system32\iertutil.dll

2014-03-01 04:52 . 2014-03-13 17:51        66048        ----a-w-        c:\windows\system32\iesetup.dll

2014-03-01 04:51 . 2014-03-13 17:51        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll

2014-03-01 04:42 . 2014-03-13 17:51        53760        ----a-w-        c:\windows\system32\jsproxy.dll

2014-03-01 04:40 . 2014-03-13 17:51        33792        ----a-w-        c:\windows\system32\iernonce.dll

2014-03-01 04:37 . 2014-03-13 17:51        574976        ----a-w-        c:\windows\system32\ieui.dll

2014-03-01 04:33 . 2014-03-13 17:51        139264        ----a-w-        c:\windows\system32\ieUnatt.exe

2014-03-01 04:33 . 2014-03-13 17:51        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe

2014-03-01 04:32 . 2014-03-13 17:51        708608        ----a-w-        c:\windows\system32\jscript9diag.dll

2014-03-01 04:23 . 2014-03-13 17:51        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2014-03-01 04:17 . 2014-03-13 17:51        218624        ----a-w-        c:\windows\system32\ie4uinit.exe

2014-03-01 04:02 . 2014-03-13 17:51        195584        ----a-w-        c:\windows\system32\msrating.dll

2014-03-01 03:54 . 2014-03-13 17:51        5768704        ----a-w-        c:\windows\system32\jscript9.dll

2014-03-01 03:52 . 2014-03-13 17:51        61952        ----a-w-        c:\windows\SysWow64\iesetup.dll

2014-03-01 03:51 . 2014-03-13 17:51        51200        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll

2014-03-01 03:42 . 2014-03-13 17:51        627200        ----a-w-        c:\windows\system32\msfeeds.dll

2014-03-01 03:38 . 2014-03-13 17:51        112128        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2014-03-01 03:37 . 2014-03-13 17:51        553472        ----a-w-        c:\windows\SysWow64\jscript9diag.dll

2014-03-01 03:35 . 2014-03-13 17:51        2041856        ----a-w-        c:\windows\system32\inetcpl.cpl

2014-03-01 03:18 . 2014-03-13 17:51        13051904        ----a-w-        c:\windows\system32\ieframe.dll

2014-03-01 03:14 . 2014-03-13 17:51        4244480        ----a-w-        c:\windows\SysWow64\jscript9.dll

2014-03-01 03:10 . 2014-03-13 17:51        2334208        ----a-w-        c:\windows\system32\wininet.dll

2014-03-01 03:00 . 2014-03-13 17:51        1964032        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2014-03-01 02:38 . 2014-03-13 17:51        1393664        ----a-w-        c:\windows\system32\urlmon.dll

2014-03-01 02:32 . 2014-03-13 17:51        1820160        ----a-w-        c:\windows\SysWow64\wininet.dll

2014-03-01 02:25 . 2014-03-13 17:51        817664        ----a-w-        c:\windows\system32\ieapfltr.dll

2014-02-07 01:23 . 2014-03-13 17:51        3156480        ----a-w-        c:\windows\system32\win32k.sys

2014-02-04 02:32 . 2014-03-13 17:43        1424384        ----a-w-        c:\windows\system32\WindowsCodecs.dll

2014-02-04 02:32 . 2014-03-13 17:43        624128        ----a-w-        c:\windows\system32\qedit.dll

2014-02-04 02:04 . 2014-03-13 17:43        1230336        ----a-w-        c:\windows\SysWow64\WindowsCodecs.dll

2014-02-04 02:04 . 2014-03-13 17:43        509440        ----a-w-        c:\windows\SysWow64\qedit.dll

2014-01-29 02:32 . 2014-03-13 17:46        484864        ----a-w-        c:\windows\system32\wer.dll

2014-01-29 02:06 . 2014-03-13 17:46        381440        ----a-w-        c:\windows\SysWow64\wer.dll

2014-01-28 02:32 . 2014-03-13 17:47        228864        ----a-w-        c:\windows\system32\wwansvc.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Spotify"="c:\users\Username\AppData\Roaming\Spotify\Spotify.exe" [2014-04-09 6087224]

"Spotify Web Helper"="c:\users\Username\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-04-09 1171000]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"RUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe" [2011-09-20 115048]

"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-15 35736]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]

"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-08-30 766208]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

"Gaming mouse"="c:\program files (x86)\Gaming Mouse\Monitor.exe" [2013-07-17 761856]

"GamingKeyboard"="c:\program files (x86)\SHARKOON Skiller\GameMon.exe" [2012-06-07 1803264]

"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]

.

c:\users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2013-10-9 0]

Trillian.lnk - c:\program files (x86)\Trillian\trillian.exe [2013-6-13 2606448]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0\0sdnclean64.exe

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys;c:\windows\SYSNATIVE\DRIVERS\sbapifs.sys [x]

R3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]

R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]

S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]

S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]

S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]

S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]

S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]

S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]

S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

S3 GameKB;SHARKOON Skiller;c:\windows\system32\drivers\GameKB.sys;c:\windows\SYSNATIVE\drivers\GameKB.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192cu.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192cu.sys [x]

S3 rusb3hub;Renesas Electronics USB 3.0 Hub Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3hub.sys [x]

S3 rusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3xhc.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-04-09 16:21        1077576        ----a-w-        c:\program files (x86)\Google\Chrome\Application\34.0.1847.116\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-04-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-14 15:55]

.

2014-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08 19:40]

.

2014-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08 19:40]

.

2014-04-21 c:\windows\Tasks\RtlNICDiagVistaStart.job

- c:\program files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2013-10-08 10:16]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]

"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 121.157.39.117 114.114.114.114

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Notify-SDWinLogon - SDWinLogon.dll

SafeBoot-CleanHlp

SafeBoot-CleanHlp.sys

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.12"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2014-04-21  21:57:56

ComboFix-quarantined-files.txt  2014-04-21 19:57

.

Vor Suchlauf: 14 Verzeichnis(se), 854.355.116.032 Bytes frei

Nach Suchlauf: 18 Verzeichnis(se), 853.954.068.480 Bytes frei

.

- - End Of File - - 732D0B7875C0492AEFEC59F5EB02965C

A36C5E4F47E84449FF07ED3517B43A31

schrauber

22.04.2014 13:50

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Kerrigan

22.04.2014 15:26

Hallo :)

Hier die gewünschten Scans. Ich habe mich genau an deine Anleitung gehalten. Problem leider noch vorhanden. Chrome konnte mein Userprofil nicht mehr herstellen, alle Seiten waren weg. Als ich das Board hier neu öffnete ging das Spiel mit der nervigen Werbung direkt von vorne los! :(

Malwarebytes Scan

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 22.04.2014

Suchlauf-Zeit: 15:16:12

Logdatei: AMBScan.txt

Administrator: Ja
 

Version: 2.00.1.1004

Malware Datenbank: v2014.04.22.03

Rootkit Datenbank: v2014.03.27.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Chameleon: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: User1
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 253490

Verstrichene Zeit: 8 Min, 43 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Shuriken: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 0

(No malicious items detected)
 

Registrierungswerte: 0

(No malicious items detected)
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 0

(No malicious items detected)
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

AdwCleaner Scan

Code:

# AdwCleaner v3.200 - Bericht erstellt am 22/04/2014 um 15:54:51

# Aktualisiert 22/04/2014 von Xplode

# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)

# Benutzername : User1 - User1-PC-NE

# Gestartet von : C:\Users\User1\Desktop\adwcleaner (1).exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatewhilokii_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatewhilokii_rasmancs

Schlüssel Gelöscht : HKCU\Software\OCS
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16521
 
 

-\\ Google Chrome v34.0.1847.116
 

[ Datei : C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht [Extension] : aipfmkinhleccnodemkoofnnofpbbpac

Gelöscht [Extension] : ieadcoanfjloocmfafkebdnfefmohngj

Gelöscht [Extension] : ifohbjbgfchkkfhphahclmkpgejiplfo

Gelöscht [Extension] : igdhbblpcellaljokkpfhcjlagemhgjl
 

*************************
 

AdwCleaner[R0].txt - [11762 octets] - [10/10/2013 01:00:21]

AdwCleaner[R1].txt - [30074 octets] - [26/03/2014 01:32:39]

AdwCleaner[R2].txt - [1301 octets] - [26/03/2014 01:45:59]

AdwCleaner[R3].txt - [1181 octets] - [09/04/2014 18:46:22]

AdwCleaner[R4].txt - [1774 octets] - [22/04/2014 15:51:25]

AdwCleaner[S0].txt - [8969 octets] - [10/10/2013 01:01:06]

AdwCleaner[S1].txt - [29951 octets] - [26/03/2014 01:33:32]

AdwCleaner[S2].txt - [1318 octets] - [26/03/2014 01:49:12]

AdwCleaner[S3].txt - [1243 octets] - [09/04/2014 18:47:47]

AdwCleaner[S4].txt - [1649 octets] - [22/04/2014 15:54:51]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1709 octets] ##########

Junkware Removal Tool Scan

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Professional x64

Ran by User1 on 22.04.2014 at 15:58:44,73

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-196019333-3621520618-2838316431-1000\Software\sweetim
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 22.04.2014 at 16:03:34,02

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Und zu guter letzt ein frischer FRST Scan

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014

Ran by User1 (administrator) on User1-PC-NE on 22-04-2014 16:16:25

Running from C:\Users\User1\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-09]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-22 16:16 - 2014-04-22 16:16 - 00010909 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:50 - 2014-04-22 15:50 - 00001155 _____ () C:\AMBScan.txt

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox

2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:02 - 2014-04-22 16:08 - 00000000 ____D () C:\Scans

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:50 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-21 12:50 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-21 12:50 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-09 19:03 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-09 19:03 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-09 19:03 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-09 19:03 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys

2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll

2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll

2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:30 - 2014-04-22 16:16 - 00000000 ____D () C:\FRST

2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe

2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0

2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe

2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe

2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe

2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe

2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe

2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe

2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe

2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995 (1).zip

2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995.zip
 

==================== One Month Modified Files and Folders =======
 

2014-04-22 16:16 - 2014-04-22 16:16 - 00010909 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:16 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-22 16:10 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-04-22 16:10 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-04-22 16:09 - 2013-10-08 21:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-22 16:09 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-22 16:09 - 2009-07-14 06:51 - 00037278 _____ () C:\Windows\setupact.log

2014-04-22 16:08 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-04-22 16:08 - 2013-10-08 19:57 - 01222240 _____ () C:\Windows\WindowsUpdate.log

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 16:03 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-22 16:03 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:56 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:50 - 2014-04-22 15:50 - 00001155 _____ () C:\AMBScan.txt

2014-04-22 15:20 - 2013-10-08 21:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-22 14:54 - 2010-11-21 05:47 - 00283524 _____ () C:\Windows\PFRO.log

2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox

2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1

2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-21 12:50 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-20 23:18 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-16 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 16:01 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-21 12:50 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-21 12:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-21 12:50 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-09 18:24 - 2013-10-08 21:41 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe

2014-04-01 18:15 - 2013-10-08 21:40 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-01 18:15 - 2013-10-08 21:40 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-03-31 03:16 - 2014-04-09 19:03 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-03-31 03:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-03-31 02:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-03-31 01:57 - 2014-04-09 19:03 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0

2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources

2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe

2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe

2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe

2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe

2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe

2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe

2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe

2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995 (1).zip

2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\User1\Downloads\elvui-6.995.zip
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-04-21 14:43
 

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber

22.04.2014 19:20

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Kerrigan

23.04.2014 20:01

Hallo :)

Hier die gewünschten Scans:

ESET Scan

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=1e8bdc2a473bfb4f8784f3bf236e0012

# engine=17988

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-04-23 02:10:42

# local_time=2014-04-23 04:10:42 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 94 10205 16926675 2970 0

# compatibility_mode=5893 16776573 100 94 8814 149892092 0 0

# scanned=293199

# found=0

# cleaned=0

# scan_time=8199

SecurityCheck Scan

Code:

 Results of screen317's Security Check version 0.99.82  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 Spybot - Search & Destroy 

 Java 7 Update 45  

 Java 7 Update 55  

 Google Chrome 34.0.1847.116  
 ````````Process Check: objlist.exe by Laurent````````  

 Spybot Teatimer.exe is disabled! 

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Und zum Schluss ein frischer FRST Scan

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014

Ran by User1 (administrator) on User1-PC-NE on 23-04-2014 18:00:28

Running from C:\Users\User1\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil64_12_0_0_77_ActiveX.exe [531848 2014-04-03] (Adobe Systems Incorporated)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-23 13:49 - 2014-04-23 18:00 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 13:49 - 2014-04-23 14:00 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-23 13:49 - 2014-04-23 13:55 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:49 - 2014-04-23 13:55 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 00:43 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-23 00:43 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-23 00:43 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-23 00:43 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-22 16:16 - 2014-04-23 18:00 - 00011794 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox

2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:02 - 2014-04-23 18:00 - 00000000 ____D () C:\Scans

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys

2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll

2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll

2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:30 - 2014-04-23 18:00 - 00000000 ____D () C:\FRST

2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe

2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0

2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe

2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe

2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe

2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe

2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe

2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe

2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
 

==================== One Month Modified Files and Folders =======
 

2014-04-23 18:00 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 18:00 - 2014-04-22 16:16 - 00011794 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-23 18:00 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-04-23 18:00 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-04-23 17:46 - 2013-10-08 19:57 - 01274774 _____ () C:\Windows\WindowsUpdate.log

2014-04-23 17:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-23 14:00 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-23 13:55 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:55 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:52 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-23 13:52 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-23 13:45 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-04-23 13:45 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-04-23 13:44 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-23 13:44 - 2009-07-14 06:51 - 00037390 _____ () C:\Windows\setupact.log

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 13:19 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-23 00:41 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-04-22 16:15 - 2014-04-22 16:15 - 02061312 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-22 14:54 - 2010-11-21 05:47 - 00283524 _____ () C:\Windows\PFRO.log

2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox

2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1

2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe

2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0

2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources

2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe

2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe

2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe

2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe

2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe

2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe

2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-04-21 14:43
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Bisher sind keinerlei Probleme mehr zu sehen in meinem Chrome! :) Ich kann endlich wieder Links anklicken ohne Gedudel und Koreanische Werbung! EIN TRAUM! :) Vielen vielen Dank dafür. :dankeschoen::applaus:

Hast du eventuell noch ein paar Tips wie ich in Zukunft verhindern kann mir so einen Mist nochmal einzufangen?

Vielen Dank und viele Grüße

Kerrigan :)

Hallo,

sorry das ich einen neuen Beitrag erstelle. Ich konnte den anderen nicht mehr editieren. Leider ist das Problem wieder da! :( Es ging als ich den Browser neu gemacht hatte ohne Probleme das Board hier aufzurufen. Dann rief ich die Seite Base.de auf um mir dort ein Handy anzuschauen und beim Klicken auf Handys kam die Koreanische Werbung samt Sound in einem extra Tab wieder. :heulen: Und seit dem geht es auch hier im Board wieder los das ich keinen Link ohne nervige extra Werbung klicken kann. *verzweifel*

schrauber

24.04.2014 12:01

Öffne mal bitte FRST, setz nen Haken bei Additional und scanne, poste bitte beide Logfiles.

Kerrigan

24.04.2014 17:03

Huhu,

hier sind die gewünschten Scans!

Scan1

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014

Ran by User1 (administrator) on User1-PC-NE on 24-04-2014 17:58:11

Running from C:\Users\User1\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

(AMD) C:\Windows\system32\atieclxx.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-24 17:58 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-23 13:49 - 2014-04-24 17:55 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-23 13:49 - 2014-04-24 00:00 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 13:49 - 2014-04-23 13:55 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:49 - 2014-04-23 13:55 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 00:43 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-23 00:43 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-23 00:43 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-23 00:43 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-22 16:16 - 2014-04-24 17:58 - 00011646 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-04-24 17:58 - 02061824 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox

2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:02 - 2014-04-23 18:04 - 00000000 ____D () C:\Scans

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys

2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll

2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll

2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:30 - 2014-04-24 17:58 - 00000000 ____D () C:\FRST

2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe

2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0

2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe

2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-03-27 14:13 - 2014-04-22 15:07 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe

2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe

2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe

2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe

2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe

2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
 

==================== One Month Modified Files and Folders =======
 

2014-04-24 17:58 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-04-24 17:58 - 2014-04-22 16:16 - 00011646 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-24 17:58 - 2014-04-22 16:15 - 02061824 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-24 17:58 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-04-24 17:58 - 2013-10-08 19:57 - 01289582 _____ () C:\Windows\WindowsUpdate.log

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-24 17:57 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-24 17:57 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-24 17:56 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-04-24 17:55 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-24 17:55 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-04-24 17:53 - 2010-11-21 05:47 - 00284572 _____ () C:\Windows\PFRO.log

2014-04-24 17:53 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-24 17:53 - 2009-07-14 06:51 - 00037446 _____ () C:\Windows\setupact.log

2014-04-24 00:00 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 23:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-23 18:04 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-23 13:55 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:55 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-04-23 13:49 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 13:19 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-23 00:41 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox

2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1

2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001110 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe

2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG

2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0

2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources

2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg

2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\User1\Downloads\chromeinstall-7u51.exe

2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (2).exe

2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000 (1).exe

2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.0.1000.exe

2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\User1\Downloads\SZSetup_AID10121_AV.exe

2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader (1).exe

2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\AdwCleaner - CHIP-Downloader.exe
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-04-21 14:43
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Scan 2

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-04-2014

Ran by User1 at 2014-04-24 17:59:23

Running from C:\Users\User1\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 

==================== Installed Programs ======================
 

Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)

Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)

AI Suite (HKLM-x32\...\{310BC5E2-31AF-49BB-904D-E71EB93645DC}) (Version: 1.06.22 - )

AMD Accelerated Video Transcoding (Version: 13.15.100.30830 - Advanced Micro Devices, Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (HKLM\...\{1E9871B6-7C44-9A3A-A1C0-F9729663C7F5}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Fuel (Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden

AMD Media Foundation Decoders (Version: 1.0.80830.1925 - Advanced Micro Devices, Inc.) Hidden

ASUSUpdate (HKLM-x32\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 7.18.03 - ASUSTeK Computer Inc.)

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.792 - Curse)

Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)

EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )

Gaming mouse Driver (HKLM-x32\...\{F1A273BD-6A9E-41D8-A111-5E56ACD286F8}) (Version: 1.0 - Togran)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)

Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden

Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2 (HKLM-x32\...\Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2) (Version:  - )

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045F0}) (Version: 7.0.450 - Oracle)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)

Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.92 - ASUSTeK Computer Inc.)

RAIDXpert (HKLM-x32\...\InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}) (Version: 3.2.1540.10 - AMD)

RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)

Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 1.00.0000 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

SHARKOON Skiller (HKLM-x32\...\{91C25547-9534-41A5-823A-1E54BA16EA3F}) (Version: 1.00.0000 - )

Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)

StarCraft (HKLM-x32\...\StarCraft) (Version:  - Blizzard Entertainment)

StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)

Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)

Trillian (HKLM-x32\...\Trillian) (Version:  - Cerulean Studios, LLC)

Turbo Key (HKLM-x32\...\{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}) (Version: 1.01.03 - )

WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
 

==================== Restore Points  =========================
 

21-04-2014 10:49:10 Installed Java 7 Update 55

22-04-2014 13:00:33 Windows Update

22-04-2014 22:42:43 Windows Update

23-04-2014 11:38:19 Revo Uninstaller's restore point - Google Chrome

23-04-2014 11:47:22 Installed Java 7 Update 45
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-03-27 13:55 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

::1 localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {17AE2781-DC90-409D-844F-7505972C986D} - System32\Tasks\{B5B1AE0E-3C4C-4AD9-8669-91E4FF7D9AE7} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {1A00D3E0-B7C3-4A4D-82F2-E64CFE95E5CA} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-28] (ASUSTeK Computer Inc.)

Task: {2B36B741-9E17-40FC-80DC-12A4CE3735F6} - \UpdaterEX No Task File <==== ATTENTION

Task: {2B85E513-10C2-4F23-B5C0-02C37189F04F} - \BonanzaDealsLiveUpdateTaskMachineCore No Task File <==== ATTENTION

Task: {2FE213FF-1F17-4CBA-AD8E-8FF6E5743111} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-03] (Adobe Systems Incorporated)

Task: {33F91DDD-7080-4E4E-A262-923E41365D8C} - System32\Tasks\RtlNICDiagVistaStart => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2011-11-16] (Realtek Semiconductor Corporation.)

Task: {398A692E-F869-4D02-9049-FDC6274CFE5F} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)

Task: {4ABAA26D-889D-4B96-97AA-46AEB8C145C2} - System32\Tasks\{415876D4-2516-46E8-9E35-A397A136CFD5} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {4C3E5020-47BB-437B-BADF-F49A8531515E} - System32\Tasks\{2078D8B4-E896-44F1-8BBC-6CCB8A701A19} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {5C78006B-CFF9-440F-B2B2-314755DE0BC5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)

Task: {7BF2CEF6-25DB-497A-AFD6-7FB0C7BD3997} - System32\Tasks\{2DA44194-053F-4631-A9F3-3DA0216DDF84} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {83815CB9-F200-43DD-982F-8DC23A2B38CB} - \BitGuard No Task File <==== ATTENTION

Task: {8F5A1D53-5645-4D99-86B7-47A0CB71057D} - \BonanzaDealsUpdate No Task File <==== ATTENTION

Task: {AAEB89A6-F600-4874-A562-7EC045EAC8D5} - \EPUpdater No Task File <==== ATTENTION

Task: {ADF24FC4-A0B7-45D3-93BA-9DAC484C82C6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {AE4D9D36-14FC-494D-BA95-37E50E0B340E} - \BonanzaDealsLiveUpdateTaskMachineUA No Task File <==== ATTENTION

Task: {B38E72B5-EF1C-4D7E-9E27-515874A16FD7} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)

Task: {C1E9ADA0-5DCA-4968-A3A7-684D26A19C9A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)

Task: {CCB68486-F473-4770-A71D-50EEA4558A31} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()

Task: {CDA3F082-82A9-46B4-B38C-6B963E504691} - System32\Tasks\{43EA236D-C510-4A42-9726-86138A33EA20} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {DBB33BD9-114C-4DD4-82D7-DE1AF5F88CC4} - System32\Tasks\{98B32694-0566-4AC3-9644-A7CD534B12BD} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {EC05ADE8-4BA1-45A3-97CA-8DC8A51F72CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {EFCB4FEE-9CF2-4B10-9C33-347CAD02CE64} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\RtlNICDiagVistaStart.job => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-08-30 19:47 - 2013-08-30 19:47 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll

2012-10-22 14:41 - 2012-10-22 14:41 - 00749056 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll

2012-10-22 14:42 - 2012-10-22 14:42 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll

2013-08-30 19:47 - 2013-08-30 19:47 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2009-12-15 17:40 - 2009-12-15 17:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

2009-12-15 17:40 - 2009-12-15 17:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe

2009-12-15 17:41 - 2009-12-15 17:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe

2013-12-13 14:46 - 2013-07-17 15:02 - 00761856 _____ () C:\Program Files (x86)\Gaming Mouse\Monitor.exe

2013-08-30 19:47 - 2013-08-30 19:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

2013-10-09 18:22 - 2013-10-09 18:20 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2009-12-15 23:44 - 2009-12-15 23:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll

2014-04-21 13:27 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-04-21 13:27 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-04-21 13:27 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-04-21 13:27 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-04-21 13:27 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2013-10-08 21:42 - 2009-03-19 22:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll

2013-10-08 21:42 - 2009-03-19 22:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll

2013-10-08 21:42 - 2009-01-15 14:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll

2013-10-08 21:42 - 2009-03-25 16:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll

2013-12-13 14:46 - 2013-05-21 11:40 - 00057344 _____ () C:\Program Files (x86)\Gaming Mouse\lan.dll

2013-12-13 14:46 - 2013-01-17 11:04 - 00061440 _____ () C:\Program Files (x86)\Gaming Mouse\hiddriver.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (04/24/2014 05:53:37 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/23/2014 05:53:01 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (04/23/2014 04:41:43 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (04/23/2014 01:50:38 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (04/23/2014 01:50:35 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (04/23/2014 01:50:35 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (04/23/2014 01:44:49 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/23/2014 01:37:13 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (04/23/2014 01:15:24 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/22/2014 04:09:45 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (04/24/2014 05:53:29 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/24/2014 05:53:27 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/24/2014 00:12:08 AM) (Source: DCOM) (User: )

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 

Error: (04/23/2014 01:44:42 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/23/2014 01:44:40 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/23/2014 01:15:20 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/23/2014 01:15:16 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/23/2014 00:42:36 AM) (Source: DCOM) (User: )

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 

Error: (04/22/2014 04:09:40 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/22/2014 04:09:39 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 
 

Microsoft Office Sessions:

=========================

Error: (04/24/2014 05:53:37 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/23/2014 05:53:01 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
 

Error: (04/23/2014 04:41:43 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
 

Error: (04/23/2014 01:50:38 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
 

Error: (04/23/2014 01:50:35 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
 

Error: (04/23/2014 01:50:35 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
 

Error: (04/23/2014 01:44:49 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/23/2014 01:37:13 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
 

Error: (04/23/2014 01:15:24 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/22/2014 04:09:45 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 25%

Total physical RAM: 8174.12 MB

Available physical RAM: 6048.97 MB

Total Pagefile: 16346.41 MB

Available Pagefile: 14089.61 MB

Total Virtual: 8192 MB

Available Virtual: 8191.86 MB
 

==================== Drives ================================
 

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:797.26 GB) NTFS

Drive d: (Englisch12) (CDROM) (Total:0.32 GB) (Free:0 GB) CDFS

Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: DB55773B)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

schrauber

25.04.2014 09:40

Zitat:

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

Die beiden Dateien bitte mal bei www.virustotal.com scannen lassen, Link zum Ergebnis hier posten, ebenso Info wieviele der 51 scanner was gefunden haben.

Verbindest Du Chrome mit einem Google Konto?

Kerrigan

25.04.2014 12:34

Hallo,

ich habe beide Dateien scannen lassen. Bei beiden wurden 0 / 51 gefunden.

Ich verbinde Chrome nicht mit einem Google Konto. Könnte das ein Problem sein?

schrauber

26.04.2014 08:12

Wenn du verbinden würdest dann ja. Nutzt Du einen Adblocker als Addon in Chrome?

Kerrigan

26.04.2014 15:03

Hallo,

ich habe vor der Neuinstallation von Chrome Addblock installiert gehabt. Habe es aber seit dem nicht neu runtergeladen. Eigentlich sollte keine Erweiterung installiert sein. Beim Blick in die Einstellung eben sah ich eine aktive Erweiterung namens Google Docs 0,5. Ich habe keine Ahnung was das ist. Ich habe es nicht wissentlich installiert.

Mir ist eben was aufgefallen. Bei allen Seiten auf denen das Problem auftritt liegt wie ein unsichtbares Fenster über der Webseite. Diese verlinkt egal welche Seite es ist auf einen Link der beginnt mit hxxp://z.myzwqwe12.com/AP5Min.aspx?AID=9775&AUTH=83C558160C usw. Dann kommt noch eine ellenlange Zahl. Hinten dran steht dann noch refer und dahinter kommt die eigentliche Seiten URL auf der ich tatsächlich bin. Eventuell hilft dir das bei der Lokalisierung der Plagegeister.

schrauber

26.04.2014 18:43

Und das ist nur in Chrome, nicht in andern Browsern so?

Kerrigan

26.04.2014 21:50

Ich nutze nur Chrome zum surfen und habe auch nur Chrome und den IE installiert. Im IE ist alles ok. Keine Werbung, keine komischen Links.

Hallo,

nachdem vorhin nichts im IE zu sehen war genau wie beim letzten Test in Chrome dachte ich mir das ich ihn mal eine Weile offen lasse und dann noch mal nachschaue. Mittlerweile gehen da zwar keine Werbetabs auf aber diese doofe kleine weise Fenster was in Chrome ab und zu auf den Webseiten unten ist mit dem X Balken und einem Koreanischem Schriftzeichen daneben taucht nun auch im IE auf :(

schrauber

27.04.2014 18:45

Kannste mir davon mal nen Screenshot zeigen?

Kerrigan

29.04.2014 17:11

Hallo,

sorry das es so lange gedauert hat. Ich war ein paar Tage nicht am PC. Hier ist der gewünschte Screenshot.

hxxp://www.directupload.net/file/d/3607/txs4vanl_gif.htm

Der ist jetzt nur von Chrome. Brauchst du auch aus dem IE einen? Da sieht das Fenster auch so aus. Man sieht es unten Rechts auf dem Screenshot. Seit neuestem sind bei einigen Webseiten auch Wörter im Text blau unterstrichen und mit einem Link versehen! :(

schrauber

30.04.2014 23:24

FRST öffnen, Haken setzen bei Additional und scannen, poste bitte beide Logfiles.

Kerrigan

02.05.2014 17:05

Hallo,

hier sind die beiden gewünschten Scans! :)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-05-2014

Ran by User1 (administrator) on User1-PC-NE on 02-05-2014 17:59:05

Running from C:\Users\User1\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe

(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-30 17:49 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-30 17:49 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:45 - 2014-04-29 21:46 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 18:00 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2014-04-24 18:00 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2014-04-24 17:59 - 2014-04-24 17:59 - 00031039 _____ () C:\Users\User1\Desktop\Addition.txt

2014-04-24 17:58 - 2014-05-02 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-23 13:49 - 2014-05-02 17:52 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-23 13:49 - 2014-05-01 00:00 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 13:49 - 2014-04-29 23:04 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:49 - 2014-04-23 13:55 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:49 - 2014-04-23 13:55 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 00:43 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-23 00:43 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-23 00:43 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-23 00:43 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-22 16:16 - 2014-05-02 17:59 - 00011832 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-05-02 17:58 - 02062336 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox

2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:02 - 2014-04-28 17:17 - 00000000 ____D () C:\Scans

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys

2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll

2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll

2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:30 - 2014-05-02 17:59 - 00000000 ____D () C:\FRST

2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 00:03 - 2014-04-21 17:17 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
 

==================== One Month Modified Files and Folders =======
 

2014-05-02 17:59 - 2014-04-22 16:16 - 00011832 _____ () C:\Users\User1\Desktop\FRST.txt

2014-05-02 17:59 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-05-02 17:58 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-05-02 17:58 - 2014-04-22 16:15 - 02062336 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-05-02 17:58 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-05-02 17:58 - 2013-10-08 19:57 - 01545972 _____ () C:\Windows\WindowsUpdate.log

2014-05-02 17:56 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-05-02 17:54 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-02 17:54 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-02 17:52 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-02 17:51 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-02 17:51 - 2009-07-14 06:51 - 00037782 _____ () C:\Windows\setupact.log

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-05-01 00:02 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-05-01 00:00 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-30 23:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-29 23:04 - 2014-04-23 13:49 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:46 - 2014-04-29 21:45 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-29 21:45 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-29 18:14 - 2013-10-14 14:04 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-29 18:14 - 2013-10-14 14:04 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-29 18:14 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-28 17:17 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-04-28 17:08 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-04-26 16:26 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 17:59 - 2014-04-24 17:59 - 00031039 _____ () C:\Users\User1\Desktop\Addition.txt

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-24 17:53 - 2010-11-21 05:47 - 00284572 _____ () C:\Windows\PFRO.log

2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-23 13:55 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:55 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox

2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1

2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001110 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-14 04:24 - 2014-04-30 17:49 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-14 04:19 - 2014-04-30 17:49 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg

2014-04-03 09:51 - 2014-04-22 15:03 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-03 09:51 - 2014-04-22 15:03 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-03 09:50 - 2014-04-22 15:03 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi

2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\User1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-04-21 14:43
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-05-2014

Ran by User1 at 2014-05-02 17:59:43

Running from C:\Users\User1\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 

==================== Installed Programs ======================
 

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)

Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)

AI Suite (HKLM-x32\...\{310BC5E2-31AF-49BB-904D-E71EB93645DC}) (Version: 1.06.22 - )

AMD Accelerated Video Transcoding (Version: 13.15.100.30830 - Advanced Micro Devices, Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (HKLM\...\{1E9871B6-7C44-9A3A-A1C0-F9729663C7F5}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Fuel (Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden

AMD Media Foundation Decoders (Version: 1.0.80830.1925 - Advanced Micro Devices, Inc.) Hidden

ASUSUpdate (HKLM-x32\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 7.18.03 - ASUSTeK Computer Inc.)

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.792 - Curse)

Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)

EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )

Gaming mouse Driver (HKLM-x32\...\{F1A273BD-6A9E-41D8-A111-5E56ACD286F8}) (Version: 1.0 - Togran)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)

Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden

Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2 (HKLM-x32\...\Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2) (Version:  - )

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045F0}) (Version: 7.0.450 - Oracle)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)

Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.92 - ASUSTeK Computer Inc.)

RAIDXpert (HKLM-x32\...\InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}) (Version: 3.2.1540.10 - AMD)

RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)

Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 1.00.0000 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

SHARKOON Skiller (HKLM-x32\...\{91C25547-9534-41A5-823A-1E54BA16EA3F}) (Version: 1.00.0000 - )

Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)

StarCraft (HKLM-x32\...\StarCraft) (Version:  - Blizzard Entertainment)

StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)

Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)

Trillian (HKLM-x32\...\Trillian) (Version:  - Cerulean Studios, LLC)

Turbo Key (HKLM-x32\...\{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}) (Version: 1.01.03 - )

WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
 

==================== Restore Points  =========================
 

22-04-2014 13:00:33 Windows Update

22-04-2014 22:42:43 Windows Update

23-04-2014 11:38:19 Revo Uninstaller's restore point - Google Chrome

23-04-2014 11:47:22 Installed Java 7 Update 45

24-04-2014 18:18:29 Windows Update

29-04-2014 15:33:43 Windows Update

30-04-2014 22:03:21 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-03-27 13:55 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

::1 localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {17AE2781-DC90-409D-844F-7505972C986D} - System32\Tasks\{B5B1AE0E-3C4C-4AD9-8669-91E4FF7D9AE7} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {1A00D3E0-B7C3-4A4D-82F2-E64CFE95E5CA} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-28] (ASUSTeK Computer Inc.)

Task: {2B36B741-9E17-40FC-80DC-12A4CE3735F6} - \UpdaterEX No Task File <==== ATTENTION

Task: {2B85E513-10C2-4F23-B5C0-02C37189F04F} - \BonanzaDealsLiveUpdateTaskMachineCore No Task File <==== ATTENTION

Task: {2FE213FF-1F17-4CBA-AD8E-8FF6E5743111} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29] (Adobe Systems Incorporated)

Task: {33F91DDD-7080-4E4E-A262-923E41365D8C} - System32\Tasks\RtlNICDiagVistaStart => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2011-11-16] (Realtek Semiconductor Corporation.)

Task: {398A692E-F869-4D02-9049-FDC6274CFE5F} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)

Task: {4ABAA26D-889D-4B96-97AA-46AEB8C145C2} - System32\Tasks\{415876D4-2516-46E8-9E35-A397A136CFD5} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {4C3E5020-47BB-437B-BADF-F49A8531515E} - System32\Tasks\{2078D8B4-E896-44F1-8BBC-6CCB8A701A19} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {5C78006B-CFF9-440F-B2B2-314755DE0BC5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)

Task: {7BF2CEF6-25DB-497A-AFD6-7FB0C7BD3997} - System32\Tasks\{2DA44194-053F-4631-A9F3-3DA0216DDF84} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {83815CB9-F200-43DD-982F-8DC23A2B38CB} - \BitGuard No Task File <==== ATTENTION

Task: {8F5A1D53-5645-4D99-86B7-47A0CB71057D} - \BonanzaDealsUpdate No Task File <==== ATTENTION

Task: {AAEB89A6-F600-4874-A562-7EC045EAC8D5} - \EPUpdater No Task File <==== ATTENTION

Task: {ADF24FC4-A0B7-45D3-93BA-9DAC484C82C6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {AE4D9D36-14FC-494D-BA95-37E50E0B340E} - \BonanzaDealsLiveUpdateTaskMachineUA No Task File <==== ATTENTION

Task: {B38E72B5-EF1C-4D7E-9E27-515874A16FD7} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)

Task: {C1E9ADA0-5DCA-4968-A3A7-684D26A19C9A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)

Task: {CCB68486-F473-4770-A71D-50EEA4558A31} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()

Task: {CDA3F082-82A9-46B4-B38C-6B963E504691} - System32\Tasks\{43EA236D-C510-4A42-9726-86138A33EA20} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {DBB33BD9-114C-4DD4-82D7-DE1AF5F88CC4} - System32\Tasks\{98B32694-0566-4AC3-9644-A7CD534B12BD} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {EC05ADE8-4BA1-45A3-97CA-8DC8A51F72CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {EFCB4FEE-9CF2-4B10-9C33-347CAD02CE64} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\RtlNICDiagVistaStart.job => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-08-30 19:47 - 2013-08-30 19:47 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll

2012-10-22 14:41 - 2012-10-22 14:41 - 00749056 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll

2012-10-22 14:42 - 2012-10-22 14:42 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll

2013-08-30 19:47 - 2013-08-30 19:47 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2009-12-15 17:40 - 2009-12-15 17:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

2013-12-13 14:46 - 2013-07-17 15:02 - 00761856 _____ () C:\Program Files (x86)\Gaming Mouse\Monitor.exe

2013-08-30 19:47 - 2013-08-30 19:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

2009-12-15 17:40 - 2009-12-15 17:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe

2009-12-15 17:41 - 2009-12-15 17:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe

2013-10-09 18:22 - 2013-10-09 18:20 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2009-12-15 23:44 - 2009-12-15 23:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll

2014-04-21 13:27 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-04-21 13:27 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-04-21 13:27 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-04-21 13:27 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-04-21 13:27 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2013-10-08 21:42 - 2009-03-19 22:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll

2013-10-08 21:42 - 2009-03-19 22:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll

2013-10-08 21:42 - 2009-01-15 14:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll

2013-10-08 21:42 - 2009-03-25 16:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll

2013-12-13 14:46 - 2013-05-21 11:40 - 00057344 _____ () C:\Program Files (x86)\Gaming Mouse\lan.dll

2013-12-13 14:46 - 2013-01-17 11:04 - 00061440 _____ () C:\Program Files (x86)\Gaming Mouse\hiddriver.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (05/02/2014 05:51:36 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/30/2014 05:44:25 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/29/2014 05:28:14 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/28/2014 03:03:55 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/26/2014 03:47:53 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/25/2014 01:04:45 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/24/2014 05:53:37 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/23/2014 05:53:01 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (04/23/2014 04:41:43 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (04/23/2014 01:50:38 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
 

System errors:

=============

Error: (05/02/2014 05:51:30 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/02/2014 05:51:29 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/30/2014 05:44:21 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/30/2014 05:44:20 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/29/2014 05:28:11 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/29/2014 05:28:09 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/28/2014 10:22:14 PM) (Source: DCOM) (User: )

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 

Error: (04/28/2014 03:03:51 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/28/2014 03:03:49 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (04/26/2014 08:05:13 PM) (Source: Schannel) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
 
 

Microsoft Office Sessions:

=========================

Error: (05/02/2014 05:51:36 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/30/2014 05:44:25 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/29/2014 05:28:14 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/28/2014 03:03:55 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/26/2014 03:47:53 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/25/2014 01:04:45 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/24/2014 05:53:37 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/23/2014 05:53:01 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
 

Error: (04/23/2014 04:41:43 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
 

Error: (04/23/2014 01:50:38 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\User1\Desktop\esetsmartinstaller_enu.exe
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 26%

Total physical RAM: 8174.12 MB

Available physical RAM: 6023.29 MB

Total Pagefile: 16346.41 MB

Available Pagefile: 14069.41 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:796.85 GB) NTFS

Drive d: (Englisch12) (CDROM) (Total:0.32 GB) (Free:0 GB) CDFS

Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: DB55773B)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

schrauber

04.05.2014 07:09

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

Task: {2B36B741-9E17-40FC-80DC-12A4CE3735F6} - \UpdaterEX No Task File <==== ATTENTION

Task: {2B85E513-10C2-4F23-B5C0-02C37189F04F} - \BonanzaDealsLiveUpdateTaskMachineCore No Task File <==== ATTENTION

Task: {83815CB9-F200-43DD-982F-8DC23A2B38CB} - \BitGuard No Task File <==== ATTENTION

Task: {8F5A1D53-5645-4D99-86B7-47A0CB71057D} - \BonanzaDealsUpdate No Task File <==== ATTENTION

Task: {AAEB89A6-F600-4874-A562-7EC045EAC8D5} - \EPUpdater No Task File <==== ATTENTION

Task: {AE4D9D36-14FC-494D-BA95-37E50E0B340E} - \BonanzaDealsLiveUpdateTaskMachineUA No Task File <==== ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Kerrigan

06.05.2014 18:28

Hier der wünschte Fixdingens :)

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-05-2014

Ran by User1 at 2014-05-06 19:24:52 Run:1

Running from C:\Users\User1\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

Task: {2B36B741-9E17-40FC-80DC-12A4CE3735F6} - \UpdaterEX No Task File <==== ATTENTION

Task: {2B85E513-10C2-4F23-B5C0-02C37189F04F} - \BonanzaDealsLiveUpdateTaskMachineCore No Task File <==== ATTENTION

Task: {83815CB9-F200-43DD-982F-8DC23A2B38CB} - \BitGuard No Task File <==== ATTENTION

Task: {8F5A1D53-5645-4D99-86B7-47A0CB71057D} - \BonanzaDealsUpdate No Task File <==== ATTENTION

Task: {AAEB89A6-F600-4874-A562-7EC045EAC8D5} - \EPUpdater No Task File <==== ATTENTION

Task: {AE4D9D36-14FC-494D-BA95-37E50E0B340E} - \BonanzaDealsLiveUpdateTaskMachineUA No Task File <==== ATTENTION

*****************
 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2B36B741-9E17-40FC-80DC-12A4CE3735F6} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2B36B741-9E17-40FC-80DC-12A4CE3735F6} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UpdaterEX => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2B85E513-10C2-4F23-B5C0-02C37189F04F} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2B85E513-10C2-4F23-B5C0-02C37189F04F} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BonanzaDealsLiveUpdateTaskMachineCore => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{83815CB9-F200-43DD-982F-8DC23A2B38CB} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{83815CB9-F200-43DD-982F-8DC23A2B38CB} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BitGuard => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8F5A1D53-5645-4D99-86B7-47A0CB71057D} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8F5A1D53-5645-4D99-86B7-47A0CB71057D} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BonanzaDealsUpdate => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AAEB89A6-F600-4874-A562-7EC045EAC8D5} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AAEB89A6-F600-4874-A562-7EC045EAC8D5} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EPUpdater => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AE4D9D36-14FC-494D-BA95-37E50E0B340E} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AE4D9D36-14FC-494D-BA95-37E50E0B340E} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BonanzaDealsLiveUpdateTaskMachineUA => Key deleted successfully.
 

==== End of Fixlog ====

schrauber

07.05.2014 11:14

Noch Probleme?

Kerrigan

07.05.2014 16:58

Ja leider nach wie vor die gleichen Probleme. Webseiten öffnen sich ungefragt beim Klick auf leeren Stellen usw. :( Allerdings gehen nun komische Seiten auf. Eben wurde beim Klicken hier im Board ungefragt www.eruutt.com geöfnet und auf der Seite war nix auser diesen Zeichen:

Code:

‹ÌXëS×ÿœÌä¸ÞW¢1»Z        DÚâ$ÍLR{Ò¦Óé0WÒEl¼¬–Ý˜düÇ`%~*Žy¬ŒY ’ÑBJ\>Ø&$%Í«›6ã™ž»+)BˆÔ4ý}ÐÞ½{^÷w~÷œ½ÛwâÌÙÁ?{h£":÷Æo^}e1í÷G×Ç<ƒÞüíàk¯"žu AKª         A        ‹÷âïÄŒhš|šã&&&Ø        TÜàï¹ÔO•«Ãv*A“õk~¦ÿ¹gûLFEIõ´°Ã÷ôôXê–0Á~z%FTºŒ…„q3”4"iíƒ“2aÏºó0¹ qT»ùF°¢Íð:]¼“Aµ£        šHúÓÛ•ˆËáhïv8*»3Æì#ãJêA.S‰¤nöq–ÈŠ‚t(dØÃøT•SµI‘°0bBDcÞ«#„hÒ ŠªsSÀô¥úAÖˆ¥@àù[x[“4¦A Áo8$ù(j°.yr08 ²7ˆ¿]» µ¡w²Ä„aû„ ùƒ¬¯&qk¸A¢ök%w+tdoë}*@Óg!læ¢ÑÔ5/""ª„Æ$áq!€µ Â†T¢ü:‰aÁ¹pvØÎœ•‰‚™6tÂƒÚùæH«^Å ›Ë÷P‡= Ú²%¢©>,“f;š2y„jâ°_H´Iöœ"Œ"        ×°)RX"a¯HêÓvæ I'ŠŠÅ7Ïå$âÓ˜&´."ˆÖ7‚ì¤ða‘(š™6>ù _}¼´³´ž’R{¥{Ö„þQùv|>ûIzÏ†l3—Œfu)m,ü3vÃ¦ ‰øY,Ë"DÎú‚~âÅ*’Aò        2‡Ô,Í–ù¬œØ¸nÓ”±1‡³‰€±ZH‘Ð0{ß(:ŽDSÀGå ©¿"VU¢þÙö«ÑàÛ‚(bs£Nþº×ÒËÛþÂú‚5òŠ¤jXò{ƒ6¨2Œ}De%õ•:£›b¥¹=AM¶µ„ÞC›Eæ›òÃÀBHô±‚lPl·iø)7eYì77ÖK"*v›Y B’@mk;¼RUS`™@g½oí-dD"ýWËN¼˜xUÉ¥¶ƒ¼ zyæé±z½ªûº©Ú"ZÙèz›ö¸ù¬pg5±VèA9ª¥Ä*Kø1§ÀÊ©š:°´‘_:[Etü9‚*Ç%ku¿xLê•Ô\È))$Š§¬0Øó/‹A/[lúV¥UðkX-.ósåÕì•[;áHj/[Ž~0û~anáîÊÞTŠ%yD¸øÜ³ 6f3w.Ÿ0U.‚¯>ÎêJ´—qµFì ú'éÕ/Œ#“6Ð¡ùbA¢Íë™Æy+oÍŽðý}Âh©ŠÏÃ£PjUŽw8Ø€0*6\s )Ó NyKÛyX{Äy@¹ÖÆQ*#¤O¯}1óqå±9Èn/YµélŽ“Ä®ïgòT5)n.½?cdS‰;z’þ˜GòåÒ½R,>WŠEïëÉtnq+½§ÇjZÛç E=þU|ŽJë7²©pÄ¸“M-$¢÷Ó¹¢Qž.Ý[¾¿ºk±Ücð3        c«°]ÔcEcí»Åoõ÷6çsëIj¯|S‡#t¤'S™*x)º½º±]º—ù8û$Ë–ã_…#¹K;ÔþŒ‘¿_¸;Þ(&Rëw£[KëÙÔÜ·¥/ŠÆü£õýJDOÒÙp$ºŸ*n?Œ.fS}°C‚R ?}cf9ñðö&äÛšÐ“SaŠ‘\ChlŒéwº;øNßÑõÉ«Ê½¨# +PP=ÌÞqÎ3Õw¥Ú;ÌŽAÏ…æÆB\^üçÉ¤§Ë?ìp¸;»±«Çëæ{\nÂwö¸»]]nG³ƒïpûÝ„tw‘nØÀ÷t8x_O§ßéîrcB˜~}×xLáïãp?Bá«•K›Ÿ—ß]ÙC}ªŒ¥~w7¬…ÐíoJßÎ‹[ák}œl&žƒÌ÷?SÅ/ÙÉ¾%êüÊ™\Ž}žÙ9ŠC”ëN‹ëuÔdàÍÆŒQø¬x}+±vÃ¸¤'·¾Ú,¥ß+|?»Z)-.„#T¦lä÷b:Ò“ËëÆ•ÄòÚÑE‹3—REúÄbÐÝÈ‡—§Â}^Å|É|ÆR¦’»T)“_ßçÛ…©ìt8²U Ù_ÎKëû+ŸÆŒbEO÷…å«áÈíØônr7=•º¹•GÒŸÎå(ÿ¢ûÅÍë«Ÿä¾×“ÉÝ²Q¼3æ÷ 5j…^¹ZÔ-r6 Šµw®-Ý¨,mW›‹·òñèÉÛ±[ó †õé´±Q\úNO$w·.Ï'*€K6•Oßùë06¿^03YƒÒ+† ëccéTç!ú9Q°Ê·ÉBb-r,‰‚ÅQ¨Ï1 ö±ú Ÿ        ¦Ñ²>‰$NN„ƒN®rNïttðN<A³æŠiAÙ!o‘ÖTüDñ0‹®˜ú‡åŸê•©—L¦¿°ÏM_ÕãwžÔHAÕøé®úÿG`£àD¡zçaè©%–w»L¦ðNvqžëúC÷kgÜ/; ÿ¼³óÜßîpþö-ð8–×Fà×÷‹•ã

Bisher kam da sonst immer nervige Werbung samt Sound auf Koreanisch.

schrauber

08.05.2014 10:39

Öffne bitte nochmal FRST, setz nen haken bei Additional und scanne, poste bitte beide Logfiles.

Kerrigan

08.05.2014 14:31

Huhu,

hier sind die gewünschten Scans. :)

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2014

Ran by User1 (administrator) on User1-PC-NE on 08-05-2014 15:23:32

Running from C:\Users\User1\Desktop

Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-04 02:18 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-04 02:18 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-04 02:18 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-04 02:18 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-30 17:49 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-30 17:49 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:45 - 2014-04-29 21:46 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 18:00 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2014-04-24 18:00 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2014-04-24 17:59 - 2014-05-02 18:00 - 00028262 _____ () C:\Users\User1\Desktop\Addition.txt

2014-04-24 17:58 - 2014-05-06 19:24 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-23 13:49 - 2014-05-08 15:20 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:49 - 2014-05-08 15:20 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-05-08 15:20 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 13:49 - 2014-05-08 15:20 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-23 13:49 - 2014-04-29 23:04 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-22 16:16 - 2014-05-08 15:23 - 00011677 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-05-06 19:24 - 02063872 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox

2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:02 - 2014-05-06 19:34 - 00000000 ____D () C:\Scans

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys

2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys

2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll

2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll

2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:30 - 2014-05-08 15:23 - 00000000 ____D () C:\FRST

2014-04-09 18:30 - 2014-04-21 15:02 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
 

==================== One Month Modified Files and Folders =======
 

2014-05-08 15:23 - 2014-04-22 16:16 - 00011677 _____ () C:\Users\User1\Desktop\FRST.txt

2014-05-08 15:23 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-05-08 15:22 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-05-08 15:22 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-05-08 15:20 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-08 15:20 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-08 15:20 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-08 15:20 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-08 15:18 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-08 15:18 - 2013-10-08 19:57 - 01644474 _____ () C:\Windows\WindowsUpdate.log

2014-05-08 13:15 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-08 13:15 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-08 13:07 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-08 13:07 - 2009-07-14 06:51 - 00038062 _____ () C:\Windows\setupact.log

2014-05-07 00:15 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-05-06 19:34 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-05-06 19:24 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-05-06 19:24 - 2014-04-22 16:15 - 02063872 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-05-06 18:20 - 2013-10-22 18:07 - 00000000 ____D () C:\Users\User1\Documents\StarCraft II

2014-05-06 17:43 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-05-02 20:59 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-05-02 18:00 - 2014-04-24 17:59 - 00028262 _____ () C:\Users\User1\Desktop\Addition.txt

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-29 23:04 - 2014-04-23 13:49 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:46 - 2014-04-29 21:45 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-29 21:45 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-29 18:14 - 2013-10-14 14:04 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-29 18:14 - 2013-10-14 14:04 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-29 18:14 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-29 16:01 - 2014-05-04 02:18 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-29 15:40 - 2014-05-04 02:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-29 14:48 - 2014-05-04 02:18 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-29 14:34 - 2014-05-04 02:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-26 16:26 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-24 17:53 - 2010-11-21 05:47 - 00284572 _____ () C:\Windows\PFRO.log

2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox

2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1

2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001110 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-14 04:24 - 2014-04-30 17:49 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-14 04:19 - 2014-04-30 17:49 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\User1\Downloads\SecurityCheck.exe

2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\User1\Downloads\adwcleaner.exe

2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\User1\Downloads\Addition.txt

2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\User1\Downloads\FRST64.exe

2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-07 14:58
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2014

Ran by User1 at 2014-05-08 15:24:08

Running from C:\Users\User1\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 

==================== Installed Programs ======================
 

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)

Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)

AI Suite (HKLM-x32\...\{310BC5E2-31AF-49BB-904D-E71EB93645DC}) (Version: 1.06.22 - )

AMD Accelerated Video Transcoding (Version: 13.15.100.30830 - Advanced Micro Devices, Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (HKLM\...\{1E9871B6-7C44-9A3A-A1C0-F9729663C7F5}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Fuel (Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden

AMD Media Foundation Decoders (Version: 1.0.80830.1925 - Advanced Micro Devices, Inc.) Hidden

ASUSUpdate (HKLM-x32\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 7.18.03 - ASUSTeK Computer Inc.)

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.792 - Curse)

Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)

EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )

Gaming mouse Driver (HKLM-x32\...\{F1A273BD-6A9E-41D8-A111-5E56ACD286F8}) (Version: 1.0 - Togran)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)

Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden

Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2 (HKLM-x32\...\Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2) (Version:  - )

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045F0}) (Version: 7.0.450 - Oracle)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)

Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.92 - ASUSTeK Computer Inc.)

RAIDXpert (HKLM-x32\...\InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}) (Version: 3.2.1540.10 - AMD)

RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)

Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 1.00.0000 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

SHARKOON Skiller (HKLM-x32\...\{91C25547-9534-41A5-823A-1E54BA16EA3F}) (Version: 1.00.0000 - )

Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)

StarCraft (HKLM-x32\...\StarCraft) (Version:  - Blizzard Entertainment)

StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)

Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)

Trillian (HKLM-x32\...\Trillian) (Version:  - Cerulean Studios, LLC)

Turbo Key (HKLM-x32\...\{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}) (Version: 1.01.03 - )

WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
 

==================== Restore Points  =========================
 

22-04-2014 13:00:33 Windows Update

22-04-2014 22:42:43 Windows Update

23-04-2014 11:38:19 Revo Uninstaller's restore point - Google Chrome

23-04-2014 11:47:22 Installed Java 7 Update 45

24-04-2014 18:18:29 Windows Update

29-04-2014 15:33:43 Windows Update

30-04-2014 22:03:21 Windows Update

04-05-2014 00:17:49 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-03-27 13:55 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

::1 localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {17AE2781-DC90-409D-844F-7505972C986D} - System32\Tasks\{B5B1AE0E-3C4C-4AD9-8669-91E4FF7D9AE7} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {1A00D3E0-B7C3-4A4D-82F2-E64CFE95E5CA} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-28] (ASUSTeK Computer Inc.)

Task: {2FE213FF-1F17-4CBA-AD8E-8FF6E5743111} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29] (Adobe Systems Incorporated)

Task: {33F91DDD-7080-4E4E-A262-923E41365D8C} - System32\Tasks\RtlNICDiagVistaStart => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2011-11-16] (Realtek Semiconductor Corporation.)

Task: {398A692E-F869-4D02-9049-FDC6274CFE5F} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)

Task: {4ABAA26D-889D-4B96-97AA-46AEB8C145C2} - System32\Tasks\{415876D4-2516-46E8-9E35-A397A136CFD5} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {4C3E5020-47BB-437B-BADF-F49A8531515E} - System32\Tasks\{2078D8B4-E896-44F1-8BBC-6CCB8A701A19} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {5C78006B-CFF9-440F-B2B2-314755DE0BC5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)

Task: {7BF2CEF6-25DB-497A-AFD6-7FB0C7BD3997} - System32\Tasks\{2DA44194-053F-4631-A9F3-3DA0216DDF84} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {ADF24FC4-A0B7-45D3-93BA-9DAC484C82C6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {B38E72B5-EF1C-4D7E-9E27-515874A16FD7} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)

Task: {C1E9ADA0-5DCA-4968-A3A7-684D26A19C9A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)

Task: {CCB68486-F473-4770-A71D-50EEA4558A31} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()

Task: {CDA3F082-82A9-46B4-B38C-6B963E504691} - System32\Tasks\{43EA236D-C510-4A42-9726-86138A33EA20} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {DBB33BD9-114C-4DD4-82D7-DE1AF5F88CC4} - System32\Tasks\{98B32694-0566-4AC3-9644-A7CD534B12BD} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {EC05ADE8-4BA1-45A3-97CA-8DC8A51F72CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {EFCB4FEE-9CF2-4B10-9C33-347CAD02CE64} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\RtlNICDiagVistaStart.job => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-08-30 19:47 - 2013-08-30 19:47 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll

2012-10-22 14:41 - 2012-10-22 14:41 - 00749056 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll

2012-10-22 14:42 - 2012-10-22 14:42 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll

2013-08-30 19:47 - 2013-08-30 19:47 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2009-12-15 17:40 - 2009-12-15 17:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

2013-12-13 14:46 - 2013-07-17 15:02 - 00761856 _____ () C:\Program Files (x86)\Gaming Mouse\Monitor.exe

2009-12-15 17:40 - 2009-12-15 17:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe

2009-12-15 17:41 - 2009-12-15 17:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe

2013-08-30 19:47 - 2013-08-30 19:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

2013-10-09 18:22 - 2013-10-09 18:20 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2009-12-15 23:44 - 2009-12-15 23:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll

2014-04-21 13:27 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-04-21 13:27 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-04-21 13:27 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-04-21 13:27 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-04-21 13:27 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2013-10-08 21:42 - 2009-03-19 22:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll

2013-10-08 21:42 - 2009-03-19 22:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll

2013-10-08 21:42 - 2009-01-15 14:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll

2013-10-08 21:42 - 2009-03-25 16:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll

2013-12-13 14:46 - 2013-05-21 11:40 - 00057344 _____ () C:\Program Files (x86)\Gaming Mouse\lan.dll

2013-12-13 14:46 - 2013-01-17 11:04 - 00061440 _____ () C:\Program Files (x86)\Gaming Mouse\hiddriver.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\Software\Classes\exefile:  <===== ATTENTION!
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (05/08/2014 01:07:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/07/2014 02:28:51 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/06/2014 07:35:38 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/06/2014 05:42:33 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/03/2014 04:54:17 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/02/2014 05:51:36 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/30/2014 05:44:25 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/29/2014 05:28:14 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/28/2014 03:03:55 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/26/2014 03:47:53 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (05/08/2014 01:07:29 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/08/2014 01:07:27 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/07/2014 02:28:47 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/07/2014 02:28:46 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/06/2014 07:35:26 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/06/2014 07:35:24 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/06/2014 05:42:27 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/06/2014 05:42:25 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/03/2014 04:54:14 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/03/2014 04:54:12 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 
 

Microsoft Office Sessions:

=========================

Error: (05/08/2014 01:07:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/07/2014 02:28:51 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/06/2014 07:35:38 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/06/2014 05:42:33 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/03/2014 04:54:17 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/02/2014 05:51:36 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/30/2014 05:44:25 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/29/2014 05:28:14 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/28/2014 03:03:55 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (04/26/2014 03:47:53 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 15%

Total physical RAM: 8174.12 MB

Available physical RAM: 6946.26 MB

Total Pagefile: 16346.41 MB

Available Pagefile: 14471.45 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:794.81 GB) NTFS

Drive d: (Englisch12) (CDROM) (Total:0.32 GB) (Free:0 GB) CDFS

Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: DB55773B)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

schrauber

09.05.2014 11:22

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Kerrigan

09.05.2014 16:28

Hey,

hier ist der Fixscan. Ich hab sogar alles neugestartet nach dem FIX aber die Probleme sind immer noch da! :(

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-05-2014 01

Ran by User1 at 2014-05-09 14:29:42 Run:3

Running from C:\Users\User1\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114

*****************
 

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer => Value deleted successfully.
 

==== End of Fixlog ====

Habe eben nochmal Spybot aktualisiert und scannen lassen. Alles was er fand hab ich entfernt. Probleme immer noch da! :( *verzweifel* Doofer Virus :aufsmaul:

schrauber

10.05.2014 14:03

FRisches FRST log bitte.

Kerrigan

10.05.2014 15:42

Bitte schön.

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-05-2014

Ran by User1 (administrator) on User1-PC-NE on 10-05-2014 16:39:54

Running from C:\Users\User1\Desktop

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\spotify.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Program Files (x86)\Trillian\plugins\skypekit.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-04 02:18 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-04 02:18 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-04 02:18 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-04 02:18 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-30 17:49 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-30 17:49 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:45 - 2014-04-29 21:46 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 18:00 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2014-04-24 18:00 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2014-04-24 17:59 - 2014-05-08 21:49 - 00025435 _____ () C:\Users\User1\Desktop\Addition.txt

2014-04-24 17:58 - 2014-05-10 16:39 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-23 13:49 - 2014-05-10 16:37 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-23 13:49 - 2014-05-09 23:25 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 13:49 - 2014-05-08 15:20 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:49 - 2014-05-08 15:20 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-04-29 23:04 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-22 16:16 - 2014-05-10 16:39 - 00013969 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-05-10 16:39 - 02065408 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox

2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:02 - 2014-05-09 14:30 - 00000000 ____D () C:\Scans

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip
 

==================== One Month Modified Files and Folders =======
 

2014-05-10 16:40 - 2014-04-22 16:16 - 00013969 _____ () C:\Users\User1\Desktop\FRST.txt

2014-05-10 16:39 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-05-10 16:39 - 2014-04-22 16:15 - 02065408 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-05-10 16:39 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-05-10 16:38 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-05-10 16:37 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-10 16:37 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-05-10 16:35 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-10 16:35 - 2009-07-14 06:51 - 00038286 _____ () C:\Windows\setupact.log

2014-05-10 00:10 - 2013-10-08 19:57 - 01707598 _____ () C:\Windows\WindowsUpdate.log

2014-05-09 23:25 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-09 23:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-09 17:29 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-09 17:29 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-09 14:30 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-05-08 21:49 - 2014-04-24 17:59 - 00025435 _____ () C:\Users\User1\Desktop\Addition.txt

2014-05-08 15:20 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-08 15:20 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-07 00:15 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-05-06 18:20 - 2013-10-22 18:07 - 00000000 ____D () C:\Users\User1\Documents\StarCraft II

2014-05-06 17:43 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-05-02 20:59 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-29 23:04 - 2014-04-23 13:49 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:46 - 2014-04-29 21:45 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-29 21:45 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-29 18:14 - 2013-10-14 14:04 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-29 18:14 - 2013-10-14 14:04 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-29 18:14 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-29 16:01 - 2014-05-04 02:18 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-29 15:40 - 2014-05-04 02:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-29 14:48 - 2014-05-04 02:18 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-29 14:34 - 2014-05-04 02:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-26 16:26 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-24 17:53 - 2010-11-21 05:47 - 00284572 _____ () C:\Windows\PFRO.log

2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox

2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1

2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001110 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-14 04:24 - 2014-04-30 17:49 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-14 04:19 - 2014-04-30 17:49 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe

2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client

2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe

2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe

2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe

2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999.zip

2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-07 14:58
 

==================== End Of Log ============================

--- --- ---

schrauber

11.05.2014 12:25

Downloade dir bitte Rogue Killer von hier.

Speichere das Tool auf deinem Desktop !
Schließe alle laufenden Programme.
Starte die RogueKiller.exe
Warte bis Prescan abgeschlossen erscheint und klicke dann auf Scannen.
Wenn der Scan beendet wurde, klicke auf Bericht und poste diesen hier.
Du findest die Logdatei RKreport[1].txt auch auf deinem Desktop.

http://i121.photobucket.com/albums/o...iller/TRK2.png

Kerrigan

12.05.2014 13:43

Hallo,

hier ist der Bericht von Rouge. Entfernen sollte ich nichts oder?

Code:

RogueKiller V8.8.15 _x64_ [Mar 27 2014] durch Adlice Software

mail : hxxp://www.adlice.com/contact/

Kommentare : hxxp://forum.adlice.com

Webseite : hxxp://www.adlice.com/softwares/roguekiller/

Blog : hxxp://www.adlice.com
 

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Gestartet in : Normaler Modus

Benutzer : User1 [Admin Rechte]

Funktion : Scannen -- Datum : 05/12/2014 14:37:49

| ARK || FAK || MBR |
 

¤¤¤ Böswillige Prozesse : 0 ¤¤¤
 

¤¤¤ Registry-Einträge : 7 ¤¤¤

[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> GEFUNDEN

[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> GEFUNDEN

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> GEFUNDEN

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> GEFUNDEN

[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> GEFUNDEN

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> GEFUNDEN

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> GEFUNDEN
 

¤¤¤ Geplante Tasks : 0 ¤¤¤
 

¤¤¤ Autostart-Einträge : 0 ¤¤¤
 

¤¤¤ Web-Browsern : 0 ¤¤¤
 

¤¤¤ Browser Addons : 0 ¤¤¤
 

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤
 

¤¤¤ Treiber : [NICHT GELADEN 0x0] ¤¤¤

[Address] EAT @explorer.exe (AsyncGetClassBits) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F70B0)

[Address] EAT @explorer.exe (AsyncInstallDistributionUnit) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F7210)

[Address] EAT @explorer.exe (BindAsyncMoniker) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1F90)

[Address] EAT @explorer.exe (CDLGetLongPathNameA) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F78D0)

[Address] EAT @explorer.exe (CDLGetLongPathNameW) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F78E8)

[Address] EAT @explorer.exe (CORPolicyProvider) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1674)

[Address] EAT @explorer.exe (CoGetClassObjectFromURL) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F73FC)

[Address] EAT @explorer.exe (CoInstall) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F7460)

[Address] EAT @explorer.exe (CoInternetCanonicalizeIUri) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A5660)

[Address] EAT @explorer.exe (CoInternetCombineIUri) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A80A0)

[Address] EAT @explorer.exe (CoInternetCombineUrl) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1946A4)

[Address] EAT @explorer.exe (CoInternetCombineUrlEx) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1943C0)

[Address] EAT @explorer.exe (CoInternetCompareUrl) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E5280)

[Address] EAT @explorer.exe (CoInternetCreateSecurityManager) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF161EE0)

[Address] EAT @explorer.exe (CoInternetCreateZoneManager) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF170810)

[Address] EAT @explorer.exe (CoInternetFeatureSettingsChanged) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF220284)

[Address] EAT @explorer.exe (CoInternetGetProtocolFlags) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E537C)

[Address] EAT @explorer.exe (CoInternetGetSecurityUrl) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E53D0)

[Address] EAT @explorer.exe (CoInternetGetSecurityUrlEx) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A9CD0)

[Address] EAT @explorer.exe (CoInternetGetSession) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF162460)

[Address] EAT @explorer.exe (CoInternetIsFeatureEnabled) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A8DC0)

[Address] EAT @explorer.exe (CoInternetIsFeatureEnabledForIUri) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A51B8)

[Address] EAT @explorer.exe (CoInternetIsFeatureEnabledForUrl) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A1820)

[Address] EAT @explorer.exe (CoInternetIsFeatureZoneElevationEnabled) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E586C)

[Address] EAT @explorer.exe (CoInternetParseIUri) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1956A8)

[Address] EAT @explorer.exe (CoInternetParseUrl) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF171490)

[Address] EAT @explorer.exe (CoInternetQueryInfo) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A7C50)

[Address] EAT @explorer.exe (CoInternetSetFeatureEnabled) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E5AF4)

[Address] EAT @explorer.exe (CompareSecurityIds) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF17D1A4)

[Address] EAT @explorer.exe (CompatFlagsFromClsid) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A4044)

[Address] EAT @explorer.exe (CopyBindInfo) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F3020)

[Address] EAT @explorer.exe (CopyStgMedium) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF16BA0C)

[Address] EAT @explorer.exe (CreateAsyncBindCtx) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1B86C0)

[Address] EAT @explorer.exe (CreateAsyncBindCtxEx) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A3D14)

[Address] EAT @explorer.exe (CreateFormatEnumerator) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1868E0)

[Address] EAT @explorer.exe (CreateIUriBuilder) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF163660)

[Address] EAT @explorer.exe (CreateURLMoniker) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1BCCF4)

[Address] EAT @explorer.exe (CreateURLMonikerEx) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1678D0)

[Address] EAT @explorer.exe (CreateURLMonikerEx2) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A40F0)

[Address] EAT @explorer.exe (CreateUri) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1616F0)

[Address] EAT @explorer.exe (CreateUriFromMultiByteString) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1EE4)

[Address] EAT @explorer.exe (CreateUriPriv) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1EF8)

[Address] EAT @explorer.exe (CreateUriWithFragment) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1F40)

[Address] EAT @explorer.exe (DllCanUnloadNow) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF161600)

[Address] EAT @explorer.exe (DllGetClassObject) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1AAB3C)

[Address] EAT @explorer.exe (DllInstall) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E2458)

[Address] EAT @explorer.exe (DllRegisterServer) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E2464)

[Address] EAT @explorer.exe (DllRegisterServerEx) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1BE070)

[Address] EAT @explorer.exe (DllUnregisterServer) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E2470)

[Address] EAT @explorer.exe (Extract) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F7F74)

[Address] EAT @explorer.exe (FaultInIEFeature) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F8FE8)

[Address] EAT @explorer.exe (FileBearsMarkOfTheWeb) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF196B60)

[Address] EAT @explorer.exe (FindMediaType) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E2E9C)

[Address] EAT @explorer.exe (FindMediaTypeClass) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF186080)

[Address] EAT @explorer.exe (FindMimeFromData) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A50BC)

[Address] EAT @explorer.exe (GetAddSitesFileUrl) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF2202B0)

[Address] EAT @explorer.exe (GetClassFileOrMime) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1BB8EC)

[Address] EAT @explorer.exe (GetClassURL) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E2074)

[Address] EAT @explorer.exe (GetComponentIDFromCLSSPEC) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F92E8)

[Address] EAT @explorer.exe (GetIDNFlagsForUri) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF17C7F0)

[Address] EAT @explorer.exe (GetIUriPriv) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1F60)

[Address] EAT @explorer.exe (GetIUriPriv2) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1F50)

[Address] EAT @explorer.exe (GetLabelsFromNamedHost) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF228B54)

[Address] EAT @explorer.exe (GetMarkOfTheWeb) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF219390)

[Address] EAT @explorer.exe (GetPortFromUrlScheme) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1E94)

[Address] EAT @explorer.exe (GetPropertyFromName) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1EA4)

[Address] EAT @explorer.exe (GetPropertyName) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1EB4)

[Address] EAT @explorer.exe (GetSoftwareUpdateInfo) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1BE070)

[Address] EAT @explorer.exe (GetUrlmonThreadNotificationHwnd) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1BDEB4)

[Address] EAT @explorer.exe (GetZoneFromAlternateDataStreamEx) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF166D90)

[Address] EAT @explorer.exe (HlinkGoBack) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF216E78)

[Address] EAT @explorer.exe (HlinkGoForward) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF216F24)

[Address] EAT @explorer.exe (HlinkNavigateMoniker) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF216FD0)

[Address] EAT @explorer.exe (HlinkNavigateString) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF217004)

[Address] EAT @explorer.exe (HlinkSimpleNavigateToMoniker) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF217038)

[Address] EAT @explorer.exe (HlinkSimpleNavigateToString) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF2175E8)

[Address] EAT @explorer.exe (IECompatLogCSSFix) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F12FC)

[Address] EAT @explorer.exe (IEDllLoader) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E26F0)

[Address] EAT @explorer.exe (IEGetUserPrivateNamespaceName) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F3244)

[Address] EAT @explorer.exe (IEInstallScope) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F7554)

[Address] EAT @explorer.exe (IntlPercentEncodeNormalize) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1F70)

[Address] EAT @explorer.exe (IsAsyncMoniker) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A21FC)

[Address] EAT @explorer.exe (IsDWORDProperty) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1EC4)

[Address] EAT @explorer.exe (IsIntranetAvailable) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF220668)

[Address] EAT @explorer.exe (IsJITInProgress) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF17B328)

[Address] EAT @explorer.exe (IsLoggingEnabledA) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF21855C)

[Address] EAT @explorer.exe (IsLoggingEnabledW) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF218688)

[Address] EAT @explorer.exe (IsStringProperty) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E1ED4)

[Address] EAT @explorer.exe (IsValidURL) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF197610)

[Address] EAT @explorer.exe (MkParseDisplayNameEx) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1B92F0)

[Address] EAT @explorer.exe (ObtainUserAgentString) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1EDCE0)

[Address] EAT @explorer.exe (PrivateCoInstall) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F7560)

[Address] EAT @explorer.exe (QueryAssociations) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF17E9C0)

[Address] EAT @explorer.exe (QueryClsidAssociation) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F0A8C)

[Address] EAT @explorer.exe (RegisterBindStatusCallback) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF19F600)

[Address] EAT @explorer.exe (RegisterFormatEnumerator) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A1C6C)

[Address] EAT @explorer.exe (RegisterMediaTypeClass) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E20C0)

[Address] EAT @explorer.exe (RegisterMediaTypes) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E2210)

[Address] EAT @explorer.exe (RegisterWebPlatformPermanentSecurityManager) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF198C54)

[Address] EAT @explorer.exe (ReleaseBindInfo) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF167D40)

[Address] EAT @explorer.exe (RevokeBindStatusCallback) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF19FBF0)

[Address] EAT @explorer.exe (RevokeFormatEnumerator) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E22CC)

[Address] EAT @explorer.exe (SetAccessForIEAppContainer) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1F3258)

[Address] EAT @explorer.exe (SetSoftwareUpdateAdvertisementState) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1BE070)

[Address] EAT @explorer.exe (ShouldDisplayPunycodeForUri) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1EDE50)

[Address] EAT @explorer.exe (ShouldShowIntranetWarningSecband) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1A3A3C)

[Address] EAT @explorer.exe (ShowTrustAlertDialog) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF220820)

[Address] EAT @explorer.exe (URLDownloadA) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E5CC4)

[Address] EAT @explorer.exe (URLDownloadToCacheFileA) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF217D9C)

[Address] EAT @explorer.exe (URLDownloadToCacheFileW) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF18A0C4)

[Address] EAT @explorer.exe (URLDownloadToFileA) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF217F10)

[Address] EAT @explorer.exe (URLDownloadToFileW) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF18EFD0)

[Address] EAT @explorer.exe (URLDownloadW) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E5D78)

[Address] EAT @explorer.exe (URLOpenBlockingStreamA) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF218058)

[Address] EAT @explorer.exe (URLOpenBlockingStreamW) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF218138)

[Address] EAT @explorer.exe (URLOpenPullStreamA) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF21821C)

[Address] EAT @explorer.exe (URLOpenPullStreamW) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF2182E0)

[Address] EAT @explorer.exe (URLOpenStreamA) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF218408)

[Address] EAT @explorer.exe (URLOpenStreamW) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF2184D0)

[Address] EAT @explorer.exe (UnregisterWebPlatformPermanentSecurityManager) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1BC9B4)

[Address] EAT @explorer.exe (UrlMkBuildVersion) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF1E2804)

[Address] EAT @explorer.exe (UrlMkGetSessionOption) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF173E60)

[Address] EAT @explorer.exe (UrlMkSetSessionOption) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF19D0E4)

[Address] EAT @explorer.exe (UrlmonCleanupCurrentThread) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF18A27C)

[Address] EAT @explorer.exe (WriteHitLogging) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF2185D0)

[Address] EAT @explorer.exe (ZonesReInit) : NSI.dll -> HOOKED (C:\Windows\system32\urlmon.dll @ 0xFF219C30)
 

¤¤¤ Externe Hives: ¤¤¤
 

¤¤¤ Infektion :  ¤¤¤
 

¤¤¤ Hosts-Datei: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts
 
 

127.0.0.1 localhost

::1 localhost
 
 

¤¤¤ MBR überprüfen: ¤¤¤
 

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD10EALX-009BA0 ATA Device +++++

--- User ---

[MBR] 4e08872e192e8c6e0c1d0fedfaeda45f

[BSP] 3b932c3ea17df325cd0025b065592a32 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB

User = LL1 ... OK!

User = LL2 ... OK!
 

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Multi Flash Reader USB Device +++++

Error reading User MBR! ([0x15] Das Gerät ist nicht bereit. )

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] Die Anforderung wird nicht unterstützt. )
 

Abgeschlossen : << RKreport[0]_S_05122014_143749.txt >>

RKreport[0]_S_05122014_143525.txt

schrauber

13.05.2014 09:58

Ok, jetzt alles wa sgefunden wird entfernen lassen, ebenso den Button DNS Fix drücken, dann rebooten und frisches FRST log bitte.

Kerrigan

13.05.2014 16:58

Hey,

hier der Scan.

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01

Ran by User1 (administrator) on User1-PC-NE on 13-05-2014 17:49:17

Running from C:\Users\User1\Desktop

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt

2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt

2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt

2014-05-12 14:37 - 2014-05-12 14:44 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt

2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt

2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe

2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe

2014-05-12 14:31 - 2014-05-13 17:41 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine

2014-05-12 14:31 - 2014-03-26 13:57 - 04493824 _____ () C:\Users\User1\Desktop\RogueKillerX64.exe

2014-05-12 14:31 - 2014-03-26 13:57 - 03945472 _____ () C:\Users\User1\Desktop\RogueKiller.exe

2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip

2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip

2014-05-04 02:18 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-04 02:18 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-04 02:18 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-04 02:18 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-30 17:49 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-30 17:49 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:45 - 2014-04-29 21:46 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 18:00 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2014-04-24 18:00 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2014-04-24 17:59 - 2014-05-08 21:49 - 00025435 _____ () C:\Users\User1\Desktop\Addition.txt

2014-04-24 17:58 - 2014-05-13 17:49 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-23 13:49 - 2014-05-13 17:48 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-23 13:49 - 2014-05-10 20:25 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 13:49 - 2014-05-08 15:20 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:49 - 2014-05-08 15:20 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-04-29 23:04 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-22 16:16 - 2014-05-13 17:49 - 00011876 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-05-13 17:49 - 02066944 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox

2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:02 - 2014-05-13 17:42 - 00000000 ____D () C:\Scans

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
 

==================== One Month Modified Files and Folders =======
 

2014-05-13 17:49 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-05-13 17:49 - 2014-04-22 16:16 - 00011876 _____ () C:\Users\User1\Desktop\FRST.txt

2014-05-13 17:49 - 2014-04-22 16:15 - 02066944 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-05-13 17:49 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-05-13 17:48 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-13 17:48 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-05-13 17:48 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-05-13 17:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-13 17:43 - 2009-07-14 06:51 - 00038454 _____ () C:\Windows\setupact.log

2014-05-13 17:42 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-05-13 17:42 - 2013-10-08 19:57 - 01756908 _____ () C:\Windows\WindowsUpdate.log

2014-05-13 17:42 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-13 17:42 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt

2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt

2014-05-13 17:41 - 2014-05-12 14:31 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine

2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt

2014-05-12 14:44 - 2014-05-12 14:37 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt

2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt

2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe

2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe

2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip

2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip

2014-05-10 20:25 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-10 20:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-08 21:49 - 2014-04-24 17:59 - 00025435 _____ () C:\Users\User1\Desktop\Addition.txt

2014-05-08 15:20 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-08 15:20 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-07 00:15 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-05-06 18:20 - 2013-10-22 18:07 - 00000000 ____D () C:\Users\User1\Documents\StarCraft II

2014-05-06 17:43 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-05-02 20:59 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-29 23:04 - 2014-04-23 13:49 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:46 - 2014-04-29 21:45 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-29 21:45 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-29 18:14 - 2013-10-14 14:04 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-29 18:14 - 2013-10-14 14:04 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-29 18:14 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-29 16:01 - 2014-05-04 02:18 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-29 15:40 - 2014-05-04 02:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-29 14:48 - 2014-05-04 02:18 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-29 14:34 - 2014-05-04 02:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-26 16:26 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-24 17:53 - 2010-11-21 05:47 - 00284572 _____ () C:\Windows\PFRO.log

2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox

2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1

2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001110 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-14 04:24 - 2014-04-30 17:49 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-14 04:19 - 2014-04-30 17:49 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\User1\AppData\Roaming\TS3Client

2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe

2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\ntdll_dump.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-07 14:58
 

==================== End Of Log ============================

--- --- ---

Problem noch da :(

schrauber

14.05.2014 19:01

Bitte mal FRST öffnen, Haken setzen bei Addition und Shortcut, scannen, alle 3 Logs posten.

Kerrigan

14.05.2014 22:12

Hallo,

hier die drei gewünschten Scans.

Code:

Users shortcut scan result (x64) Version: 11-05-2014 01

Ran by User1 at 2014-05-14 23:08:26

Running from C:\Users\User1\Desktop

Boot Mode: Normal

==================== Shortcuts =============================
 

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk -> C:\Windows\Installer\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\SC_Reader.ico ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk -> C:\Windows\ehome\ehshell.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk -> C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk -> C:\Windows\System32\WindowsAnytimeUpgradeui.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk -> C:\Program Files\DVD Maker\DVDMaker.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk -> C:\Windows\System32\xpsrchvw.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\Account- und Rechnungssupport.lnk -> C:\World of Warcraft\Data\deDE\AccountBilling.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\Technischer Kundendienst.lnk -> C:\World of Warcraft\Data\deDE\TechSupport.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft\World of Warcraft.lnk -> C:\World of Warcraft\World of Warcraft Launcher.exe (Blizzard Entertainment)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Benutzerhandbuch für die Konsolenversion von RAR.lnk -> C:\Program Files\WinRAR\Rar.txt ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Hilfe zu WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.chm ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Was ist neu in dieser Version.lnk -> C:\Program Files\WinRAR\WhatsNew.txt ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.exe (Alexander Roshal)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client\TeamSpeak 3 Client.lnk -> C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe (TeamSpeak Systems GmbH)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client\Uninstall.lnk -> C:\Program Files\TeamSpeak 3 Client\Uninstall.exe (TeamSpeak Systems GmbH)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\Battle.net-Accountverwaltung.lnk -> C:\Program Files (x86)\StarCraft II\Support\BattlenetAccount.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\Blizzard Tech-Support.lnk -> C:\Program Files (x86)\StarCraft II\Support\TechSupport.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\PTR von StarCraft II.lnk -> C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe (No File)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II - Handbuch.lnk -> C:\Program Files (x86)\StarCraft II\Support\Manual.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II - Karten-Editor.lnk -> C:\Program Files (x86)\StarCraft II\Support\SC2Editor.exe (Blizzard Entertainment, Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II\StarCraft II.lnk -> C:\Program Files (x86)\StarCraft II\StarCraft II.exe (Blizzard Entertainment)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft\Kampagnen-Editor von StarCraft.lnk -> C:\StarCraft1\StarCraft\StarEdit.exe (No File)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft\Registrierung von StarCraft - Brood War.lnk -> C:\StarCraft1\StarCraft\Register Starcraft.url (No File)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft\StarCraft - Brood War.lnk -> C:\StarCraft1\StarCraft\StarCraft.exe (No File)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft\StarCraft deinstallieren.lnk -> C:\Program Files (x86)\Common Files\Blizzard Entertainment\StarCraft\Uninstall.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\Create System Report.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDLogReport.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\File Scan.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFiles.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\Immunization.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\Rootkit Scan.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDRootAlyzer.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\Spybot-S&D Start Center.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\System Scan.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\Tray Icon (Live Protection).lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2\Uninstall Spybot-S&D.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\unins000.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SHARKOON Skiller\Deinstallieren.lnk -> C:\Program Files (x86)\InstallShield Installation Information\{91C25547-9534-41A5-823A-1E54BA16EA3F}\setup.exe (Macrovision Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SHARKOON Skiller\SHARKOON Skiller Konfigurator.lnk -> C:\Program Files (x86)\SHARKOON Skiller\GameSetting.exe (Game Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Realtek\Realtek Ethernet Diagnostic Utility\Realtek Ethernet Diagnostic Utility.lnk -> C:\Program Files (x86)\REALTEK\Realtek Ethernet Diagnostic Utility\8169Diag.exe (Realtek Semiconductor Corporation.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Access 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\accicons.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Excel 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\xlicons.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office InfoPath 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\inficon.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Outlook 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\outicon.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office PowerPoint 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\pptico.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Publisher 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\pubs.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Word 2003.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\wordicon.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Digitale Signatur für VBA-Projekte.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Clip Organizer.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\cagicon.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Spracheinstellungen.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Access Snapshot Viewer.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Imaging.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\mspicons.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Scanning.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\mspicons.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Picture Manager.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\oisicon.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware entfernen.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Create Recovery Disc.lnk -> C:\Windows\System32\recdisc.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Remote Assistance.lnk -> C:\Windows\System32\msra.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk -> C:\Program Files (x86)\Java\jre7\bin\javacpl.exe (Oracle Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone\Hearthstone.lnk -> C:\Program Files (x86)\Hearthstone\Hearthstone Beta Launcher.exe (Blizzard Entertainment)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Grundschule Lernspass mit Hexe Lilli\Englisch Klasse 1+2\Englisch Klasse 1+2 - entfernen.lnk -> C:\Program Files (x86)\Grundschule Lernspass mit Hexe Lilli\Englisch Klasse 1+2\UNWISE.EXE ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Grundschule Lernspass mit Hexe Lilli\Englisch Klasse 1+2\Englisch Klasse 1+2.lnk -> C:\Program Files (x86)\Grundschule Lernspass mit Hexe Lilli\Englisch Klasse 1+2\Englisch.exe (Macromedia, Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Grundschule Lernspass mit Hexe Lilli\Englisch Klasse 1+2\Hilfe.lnk -> C:\Program Files (x86)\Grundschule Lernspass mit Hexe Lilli\Englisch Klasse 1+2\Hilfe.pdf ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III\Battle.net-Accountverwaltung.lnk -> C:\Program Files (x86)\Diablo III\BattlenetAccount.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III\Blizzard Tech-Support.lnk -> C:\Program Files (x86)\Diablo III\TechSupport.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III\Diablo III - Handbuch.lnk -> C:\Program Files (x86)\Diablo III\Manual.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III\Diablo III.lnk -> C:\Program Files (x86)\Diablo III\Diablo III Launcher.exe (Blizzard Entertainment)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net\Battle.net.lnk -> C:\Program Files (x86)\Battle.net\Battle.net Launcher.exe (Blizzard Entertainment)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira Desktop\Avira Free Antivirus Hilfe.lnk -> C:\Program Files (x86)\Avira\AntiVir Desktop\avwin.chm ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira Desktop\Avira Free Antivirus starten.lnk -> C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira Desktop\Avira im Internet.lnk -> C:\Program Files (x86)\Avira\AntiVir Desktop\weblink.url ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira Desktop\Readme anzeigen.lnk -> C:\Program Files (x86)\Avira\AntiVir Desktop\readme.txt ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\Turbo Key\Turbo Key V1.01.03.lnk -> C:\Program Files\ASUS\Turbo Key\TurboKey.exe (ASUSTeK Computer Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\Turbo Key\Uninstall.lnk -> C:\Program Files (x86)\InstallShield Installation Information\{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}\Setup.exe (InstallShield Software Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\PC Probe II\Manual for PC Probe II.lnk -> C:\Program Files (x86)\ASUS\PC Probe II\manual.pdf ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\PC Probe II\PC Probe II V1.04.92.lnk -> C:\Program Files (x86)\ASUS\PC Probe II\Probe2.exe (ASUSTeK Computer Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\PC Probe II\UnInstall PC Probe II .lnk -> C:\Program Files (x86)\InstallShield Installation Information\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}\Setup.exe (InstallShield Software Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\EPU-4 Engine\EPU-4 Engine V1.02.01.lnk -> C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe (ASUSTeK Computer Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\EPU-4 Engine\Uninstall.lnk -> C:\Program Files (x86)\InstallShield Installation Information\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}\Setup.exe (InstallShield Software Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\ASUSUpdate\ASUSUpdate.lnk -> C:\Program Files (x86)\ASUS\ASUSUpdate\Update.exe (ASUSTeK Computer Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\ASUSUpdate\Mylogo User Manual.lnk -> C:\Program Files (x86)\ASUS\ASUSUpdate\MyLogo2.pdf ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\ASUSUpdate\MyLogo.lnk -> C:\Program Files (x86)\ASUS\ASUSUpdate\MyLogo.exe (ASUSTeK Computer Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\ASUSUpdate\Uninstall ASUSUpdate.lnk -> C:\Program Files (x86)\InstallShield Installation Information\{587178E7-B1DF-494E-9838-FA4DD36E873C}\Setup.exe (InstallShield Software Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\AI Suite\AI Suite v1.06.22.lnk -> C:\Program Files\ASUS\Ai Suite\AiSuite.exe (ASUSTeK Computer Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\AI Suite\Manual for Q-Fan.lnk -> C:\Program Files\ASUS\Ai Suite\Q-Fan 2.pdf ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS\AI Suite\UnInstall.lnk -> C:\Program Files (x86)\InstallShield Installation Information\{310BC5E2-31AF-49BB-904D-E71EB93645DC}\Setup.exe (InstallShield Software Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center\AMD Catalyst Control Center.lnk -> C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD\RAIDXpert\RAIDXpert.lnk -> C:\Program Files (x86)\AMD\RAIDXpert\RAIDXpert.URL ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk -> C:\Windows\System32\comexp.msc ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk -> C:\Windows\System32\odbcad32.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk -> C:\Windows\System32\iscsicpl.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk -> C:\Windows\System32\MdSched.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk -> C:\Windows\System32\printmanagement.msc ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk -> C:\Windows\System32\services.msc ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk -> C:\Windows\System32\msconfig.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk -> C:\Windows\System32\WF.msc ()

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk -> C:\Windows\System32\calc.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk -> C:\Windows\System32\DisplaySwitch.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\NetworkProjection.lnk -> C:\Windows\System32\NetProj.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk -> C:\Windows\System32\mspaint.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk -> C:\Windows\System32\mstsc.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk -> C:\Windows\System32\SnippingTool.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk -> C:\Windows\System32\SoundRecorder.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk -> C:\Windows\System32\StikyNot.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk -> C:\Windows\System32\mobsync.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk -> C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\TabTip.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk -> C:\Program Files\Windows Journal\Journal.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk -> C:\Windows\System32\charmap.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\dfrgui.lnk -> C:\Windows\System32\dfrgui.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk -> C:\Windows\System32\cleanmgr.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Information.lnk -> C:\Windows\System32\msinfo32.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\System Restore.lnk -> C:\Windows\System32\rstrui.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer Reports.lnk -> C:\Windows\System32\migwiz\PostMig.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk -> C:\Windows\System32\migwiz\migwiz.exe (Microsoft Corporation)

Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{E8AE0286-9A63-4F4F-B479-0E4E4A2A8EB5}\PlayTasks\0\Play.lnk -> C:\Program Files (x86)\Diablo III\Diablo III Launcher.exe (Blizzard Entertainment)

Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{21C35C68-A6C5-4A75-8FFD-DB503CE6F67B}\PlayTasks\0\Play.lnk -> C:\World of Warcraft\World of Warcraft Launcher.exe (Blizzard Entertainment)

Shortcut: C:\ProgramData\Microsoft\Internet Explorer\Quick Launch\Spybot-S&D Start Center.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe (Safer-Networking Ltd.)

Shortcut: C:\ProgramData\Microsoft\Internet Explorer\Quick Launch\System Scan.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe (Safer-Networking Ltd.)

Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)

Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)

Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)

Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk -> C:\Windows\System32\eudcedit.exe (Microsoft Corporation)

Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)

Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)

Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)

Shortcut: C:\Users\Public\Desktop\Battle.net.lnk -> C:\Program Files (x86)\Battle.net\Battle.net Launcher.exe (Blizzard Entertainment)

Shortcut: C:\Users\Public\Desktop\Diablo III.lnk -> C:\Program Files (x86)\Diablo III\Diablo III Launcher.exe (Blizzard Entertainment)

Shortcut: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

Shortcut: C:\Users\Public\Desktop\Hearthstone.lnk -> C:\Program Files (x86)\Hearthstone\Hearthstone Beta Launcher.exe (Blizzard Entertainment)

Shortcut: C:\Users\Public\Desktop\Hexe Lilli - Englisch 1+2.lnk -> C:\Program Files (x86)\Grundschule Lernspass mit Hexe Lilli\Englisch Klasse 1+2\Englisch.exe (Macromedia, Inc.)

Shortcut: C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)

Shortcut: C:\Users\Public\Desktop\SHARKOON Skiller Konfigurator.lnk -> C:\Program Files (x86)\SHARKOON Skiller\GameSetting.exe (Game Inc.)

Shortcut: C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe (Safer-Networking Ltd.)

Shortcut: C:\Users\Public\Desktop\StarCraft - Brood War.lnk -> C:\StarCraft1\StarCraft\StarCraft.exe (No File)

Shortcut: C:\Users\Public\Desktop\StarCraft II.lnk -> C:\Program Files (x86)\StarCraft II\StarCraft II.exe (Blizzard Entertainment)

Shortcut: C:\Users\Public\Desktop\Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

Shortcut: C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk -> C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe (TeamSpeak Systems GmbH)

Shortcut: C:\Users\Public\Desktop\TeamViewer 8.lnk -> C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH)

Shortcut: C:\Users\Public\Desktop\World of Warcraft.lnk -> C:\World of Warcraft\World of Warcraft Launcher.exe (Blizzard Entertainment)

Shortcut: C:\Users\User1\Links\Desktop.lnk -> C:\Users\User1\Desktop ()

Shortcut: C:\Users\User1\Links\Downloads.lnk -> C:\Users\User1\Downloads ()

Shortcut: C:\Users\User1\Documents\StarCraft II\Satyra.111@2.lnk -> C:\Users\User1\Documents\StarCraft II\Accounts\100212177\2-S2-1-1061245 ()

Shortcut: C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk -> C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)

Shortcut: C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk -> C:\Users\User1\Downloads\ComboFix.exe (Swearware)

Shortcut: C:\Users\User1\Desktop\Revo Uninstaller.lnk -> C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe (VS Revo Group)

Shortcut: C:\Users\User1\Desktop\Spotify.lnk -> C:\Users\User1\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)

Shortcut: C:\Users\User1\Desktop\Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk -> C:\Users\User1\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Benutzerhandbuch für die Konsolenversion von RAR.lnk -> C:\Program Files\WinRAR\Rar.txt ()

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Hilfe zu WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.chm ()

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Was ist neu in dieser Version.lnk -> C:\Program Files\WinRAR\WhatsNew.txt ()

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.exe (Alexander Roshal)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller\Revo Uninstaller.lnk -> C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe (VS Revo Group)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller\Uninstall.lnk -> C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\uninst.exe (VS Revo Group Ltd.)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller\Website.lnk -> C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revo Uninstaller.url ()

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk -> C:\Windows\System32\eudcedit.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)

Shortcut: C:\Users\User1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\b15f30ab853b7d31\Diablo III.lnk -> C:\Program Files (x86)\Diablo III\Diablo III Launcher.exe (Blizzard Entertainment)

Shortcut: C:\Users\User1\AppData\Local\Microsoft\Windows\GameExplorer\{08425964-74C0-48D9-8FA4-9E9D88FD0B69}\PlayTasks\0\Spielen.lnk -> C:\StarCraft1\StarCraft\StarCraft.exe (No File)
 
 
 
 

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DefaultPrograms

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Neues Office-Dokument.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe () -> -n

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Office-Dokument öffnen.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe () -> -f

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk -> C:\Windows\System32\wuapp.exe (Microsoft Corporation) -> startmenu

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) -> /showgadgets

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Assistent zum Speichern eigener Einstellungen.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\opwicon.exe () -> /u

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Anwendungswiederherstellung.lnk -> C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe () -> -c

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.BackupAndRestore

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk -> C:\Program Files (x86)\Java\jre7\bin\javacpl.exe (Oracle Corporation) -> -tab about

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk -> C:\Program Files (x86)\Java\jre7\bin\javacpl.exe (Oracle Corporation) -> -tab update

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gaming Mouse\Gaming Mouse Driver.lnk -> C:\Program Files (x86)\Gaming Mouse\Monitor.exe () -> 1

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gaming Mouse\Uninstall.lnk -> C:\Program Files (x86)\InstallShield Installation Information\{F1A273BD-6A9E-41D8-A111-5E56ACD286F8}\setup.exe (Macrovision Corporation) -> -runfromtemp -l0x0009

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center\Hilfe.lnk -> C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.exe (ATI Technologies Inc.) -> Start Help -help

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk -> C:\Windows\System32\compmgmt.msc () -> /s

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk -> C:\Windows\System32\eventvwr.msc () -> /s

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk -> C:\Windows\System32\perfmon.msc () -> /s

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk -> C:\Windows\System32\secpol.msc () -> /s

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation) -> -NoExit -ImportSystemModules

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk -> C:\Windows\System32\mblctr.exe (Microsoft Corporation) -> /open

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> %SystemRoot%\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Resource Monitor.lnk -> C:\Windows\System32\perfmon.exe (Microsoft Corporation) -> /res

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Speech Recognition.lnk -> C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) -> -SpeechUX

ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter

ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo

ShortcutWithArgument: C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK -> C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG) -> /CFG="C:\Program Files (x86)\Avira\AntiVir Desktop\quicksysscan.avp"

ShortcutWithArgument: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller\Run Hunter Mode.lnk -> C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe (VS Revo Group) -> -hunter

ShortcutWithArgument: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.EaseOfAccessCenter

ShortcutWithArgument: C:\Users\User1\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo

ShortcutWithArgument: C:\Users\User1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook starten.lnk -> C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE (Microsoft Corporation) ->  /recycle

ShortcutWithArgument: C:\Users\User1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
 
 

InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam Support Center.url -> hxxp://support.steampowered.com/

InternetURL: C:\Users\User1\Favorites\Windows Live\Windows Live Gallery.url -> hxxp://go.microsoft.com/fwlink/?LinkId=70742

InternetURL: C:\Users\User1\Favorites\Windows Live\Windows Live Ideas.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72700

InternetURL: C:\Users\User1\Favorites\Windows Live\Windows Live Mail.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72681

InternetURL: C:\Users\User1\Favorites\Windows Live\Windows Live Spaces.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72682

InternetURL: C:\Users\User1\Favorites\MSN-Websites\MSN Auto.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72680

InternetURL: C:\Users\User1\Favorites\MSN-Websites\MSN Fernsehen.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72659

InternetURL: C:\Users\User1\Favorites\MSN-Websites\MSN Money.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72640

InternetURL: C:\Users\User1\Favorites\MSN-Websites\MSN Nachrichten.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72636

InternetURL: C:\Users\User1\Favorites\MSN-Websites\MSN Sport.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72635

InternetURL: C:\Users\User1\Favorites\MSN-Websites\MSN.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72630

InternetURL: C:\Users\User1\Favorites\Microsoft-Websites\IE-Site auf Microsoft.com.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72186

InternetURL: C:\Users\User1\Favorites\Microsoft-Websites\Microsoft Deutschland GmbH.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72520

InternetURL: C:\Users\User1\Favorites\Microsoft-Websites\Microsoft Store.url -> hxxp://go.microsoft.com/fwlink/?linkid=140813

InternetURL: C:\Users\User1\Favorites\Microsoft-Websites\Microsoft Windows - Start.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72629

InternetURL: C:\Users\User1\Favorites\Microsoft-Websites\Microsoft zu Hause.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72406

InternetURL: C:\Users\User1\Favorites\Microsoft-Websites\Microsoft.com durchsuchen.url -> hxxp://go.microsoft.com/fwlink/?LinkId=72893

InternetURL: C:\Users\User1\Favorites\Microsoft-Websites\Site für IE Add-Ons.url -> hxxp://go.microsoft.com/fwlink/?LinkId=50893

InternetURL: C:\Users\User1\Favorites\Links\Vorgeschlagene Sites.url -> https://ieonline.microsoft.com/#ieslice

InternetURL: C:\Users\User1\Favorites\Links\Web Slice-Katalog.url -> hxxp://go.microsoft.com/fwlink/?LinkId=121315

InternetURL: C:\Users\User1\Desktop\Left 4 Dead 2.url -> steam://rungameid/550

InternetURL: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Left 4 Dead 2.url -> steam://rungameid/550

InternetURL: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse\Curse Client online support.url -> hxxp://clientsupport.curse.com/
 

==================== End of log =============================

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-05-2014 01

Ran by User1 at 2014-05-14 23:08:05

Running from C:\Users\User1\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
 

==================== Installed Programs ======================
 

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)

AI Suite (HKLM-x32\...\{310BC5E2-31AF-49BB-904D-E71EB93645DC}) (Version: 1.06.22 - )

AMD Accelerated Video Transcoding (Version: 13.15.100.30830 - Advanced Micro Devices, Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (HKLM\...\{1E9871B6-7C44-9A3A-A1C0-F9729663C7F5}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Fuel (Version: 2013.0830.1944.33589 - Ihr Firmenname) Hidden

AMD Media Foundation Decoders (Version: 1.0.80830.1925 - Advanced Micro Devices, Inc.) Hidden

ASUSUpdate (HKLM-x32\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 7.18.03 - ASUSTeK Computer Inc.)

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.792 - Curse)

Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)

EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )

Gaming mouse Driver (HKLM-x32\...\{F1A273BD-6A9E-41D8-A111-5E56ACD286F8}) (Version: 1.0 - Togran)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)

Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden

Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2 (HKLM-x32\...\Grundschule Lernspass mit Hexe Lilli Englisch Klasse 1+2) (Version:  - )

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045F0}) (Version: 7.0.450 - Oracle)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)

Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.92 - ASUSTeK Computer Inc.)

RAIDXpert (HKLM-x32\...\InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}) (Version: 3.2.1540.10 - AMD)

RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)

Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 1.00.0000 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

SHARKOON Skiller (HKLM-x32\...\{91C25547-9534-41A5-823A-1E54BA16EA3F}) (Version: 1.00.0000 - )

Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)

StarCraft (HKLM-x32\...\StarCraft) (Version:  - Blizzard Entertainment)

StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)

Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)

Trillian (HKLM-x32\...\Trillian) (Version:  - Cerulean Studios, LLC)

Turbo Key (HKLM-x32\...\{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}) (Version: 1.01.03 - )

WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)

World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
 

==================== Restore Points  =========================
 

24-04-2014 18:18:29 Windows Update

29-04-2014 15:33:43 Windows Update

30-04-2014 22:03:21 Windows Update

04-05-2014 00:17:49 Windows Update

09-05-2014 12:36:55 Windows Update

13-05-2014 15:40:11 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-03-27 13:55 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

::1 localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {17AE2781-DC90-409D-844F-7505972C986D} - System32\Tasks\{B5B1AE0E-3C4C-4AD9-8669-91E4FF7D9AE7} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {1A00D3E0-B7C3-4A4D-82F2-E64CFE95E5CA} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-28] (ASUSTeK Computer Inc.)

Task: {2FE213FF-1F17-4CBA-AD8E-8FF6E5743111} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)

Task: {33F91DDD-7080-4E4E-A262-923E41365D8C} - System32\Tasks\RtlNICDiagVistaStart => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2011-11-16] (Realtek Semiconductor Corporation.)

Task: {398A692E-F869-4D02-9049-FDC6274CFE5F} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)

Task: {4ABAA26D-889D-4B96-97AA-46AEB8C145C2} - System32\Tasks\{415876D4-2516-46E8-9E35-A397A136CFD5} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {4C3E5020-47BB-437B-BADF-F49A8531515E} - System32\Tasks\{2078D8B4-E896-44F1-8BBC-6CCB8A701A19} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {5C78006B-CFF9-440F-B2B2-314755DE0BC5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)

Task: {7BF2CEF6-25DB-497A-AFD6-7FB0C7BD3997} - System32\Tasks\{2DA44194-053F-4631-A9F3-3DA0216DDF84} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {ADF24FC4-A0B7-45D3-93BA-9DAC484C82C6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {B38E72B5-EF1C-4D7E-9E27-515874A16FD7} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)

Task: {C1E9ADA0-5DCA-4968-A3A7-684D26A19C9A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-23] (Google Inc.)

Task: {CCB68486-F473-4770-A71D-50EEA4558A31} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()

Task: {CDA3F082-82A9-46B4-B38C-6B963E504691} - System32\Tasks\{43EA236D-C510-4A42-9726-86138A33EA20} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {DBB33BD9-114C-4DD4-82D7-DE1AF5F88CC4} - System32\Tasks\{98B32694-0566-4AC3-9644-A7CD534B12BD} => C:\StarCraft1\StarCraft\StarCraft.exe

Task: {EC05ADE8-4BA1-45A3-97CA-8DC8A51F72CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {EFCB4FEE-9CF2-4B10-9C33-347CAD02CE64} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\RtlNICDiagVistaStart.job => C:\Program Files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-08-30 19:47 - 2013-08-30 19:47 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll

2012-10-22 14:41 - 2012-10-22 14:41 - 00749056 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll

2012-10-22 14:42 - 2012-10-22 14:42 - 03645952 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll

2013-08-30 19:47 - 2013-08-30 19:47 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2009-12-15 17:40 - 2009-12-15 17:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

2013-12-13 14:46 - 2013-07-17 15:02 - 00761856 _____ () C:\Program Files (x86)\Gaming Mouse\Monitor.exe

2013-08-30 19:47 - 2013-08-30 19:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

2009-12-15 17:40 - 2009-12-15 17:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe

2009-12-15 17:41 - 2009-12-15 17:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe

2013-10-09 18:22 - 2013-10-09 18:20 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2009-12-15 23:44 - 2009-12-15 23:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll

2014-04-21 13:27 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-04-21 13:27 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-04-21 13:27 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-04-21 13:27 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-04-21 13:27 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2013-10-08 21:42 - 2009-03-19 22:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll

2013-10-08 21:42 - 2009-03-19 22:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll

2013-10-08 21:42 - 2009-01-15 14:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll

2013-10-08 21:42 - 2009-03-25 16:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll

2013-10-08 22:23 - 2009-04-29 14:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll

2013-12-13 14:46 - 2013-05-21 11:40 - 00057344 _____ () C:\Program Files (x86)\Gaming Mouse\lan.dll

2013-12-13 14:46 - 2013-01-17 11:04 - 00061440 _____ () C:\Program Files (x86)\Gaming Mouse\hiddriver.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\Software\Classes\exefile:  <===== ATTENTION!
 

==================== Disabled items from MSCONFIG ==============
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (05/14/2014 05:38:31 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/13/2014 05:43:27 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/13/2014 05:35:48 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/12/2014 02:26:05 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/10/2014 04:35:44 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/09/2014 05:22:18 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/09/2014 02:31:12 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/09/2014 02:26:31 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/08/2014 01:07:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/07/2014 02:28:51 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (05/14/2014 05:38:26 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/14/2014 05:38:25 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/13/2014 05:43:20 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/13/2014 05:43:19 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/13/2014 05:35:42 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/13/2014 05:35:40 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/12/2014 02:26:02 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/12/2014 02:26:00 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/10/2014 04:35:41 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "Machine Debug Manager" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (05/10/2014 04:35:39 PM) (Source: Service Control Manager) (User: ) (EventID: 7000)

Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 
 

Microsoft Office Sessions:

=========================

Error: (05/14/2014 05:38:31 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/13/2014 05:43:27 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/13/2014 05:35:48 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/12/2014 02:26:05 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/10/2014 04:35:44 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/09/2014 05:22:18 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/09/2014 02:31:12 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/09/2014 02:26:31 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/08/2014 01:07:32 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/07/2014 02:28:51 PM) (Source: WinMgmt) (User: ) (EventID: 10)

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 14%

Total physical RAM: 8174.12 MB

Available physical RAM: 7016.77 MB

Total Pagefile: 16346.41 MB

Available Pagefile: 14463.83 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:799.1 GB) NTFS

Drive d: (Englisch12) (CDROM) (Total:0.32 GB) (Free:0 GB) CDFS

Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: DB55773B)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01

Ran by User1 (administrator) on User1-PC-NE on 14-05-2014 23:07:32

Running from C:\Users\User1\Desktop

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-23]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-23]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-23]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-23]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-23]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-23]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt

2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt

2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt

2014-05-12 14:37 - 2014-05-12 14:44 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt

2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt

2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe

2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe

2014-05-12 14:31 - 2014-05-13 17:41 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine

2014-05-12 14:31 - 2014-03-26 13:57 - 04493824 _____ () C:\Users\User1\Desktop\RogueKillerX64.exe

2014-05-12 14:31 - 2014-03-26 13:57 - 03945472 _____ () C:\Users\User1\Desktop\RogueKiller.exe

2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip

2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip

2014-05-04 02:18 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-04 02:18 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-04 02:18 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-04 02:18 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-30 17:49 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-30 17:49 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:45 - 2014-04-29 21:46 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 18:00 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2014-04-24 18:00 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2014-04-24 17:59 - 2014-05-08 21:49 - 00025435 _____ () C:\Users\User1\Desktop\Addition.txt

2014-04-24 17:58 - 2014-05-13 17:49 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-23 13:49 - 2014-05-14 22:25 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-23 13:49 - 2014-05-14 17:38 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-23 13:49 - 2014-05-08 15:20 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-04-23 13:49 - 2014-05-08 15:20 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-04-23 13:49 - 2014-04-29 23:04 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:48 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 00:43 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-23 00:43 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-23 00:43 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-23 00:43 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-23 00:43 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-23 00:43 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-23 00:43 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-23 00:43 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-23 00:43 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-23 00:43 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-23 00:43 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-23 00:43 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-23 00:43 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-23 00:43 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-23 00:43 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-23 00:43 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-23 00:43 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-23 00:43 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-23 00:43 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-23 00:43 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-23 00:43 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-23 00:43 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-23 00:43 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-23 00:43 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-23 00:43 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-23 00:43 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-23 00:43 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-23 00:43 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-22 16:16 - 2014-05-14 23:07 - 00011743 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-05-13 17:49 - 02066944 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:51 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-04-21 21:51 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-04-21 21:51 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-04-21 21:51 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:57 - 2014-04-21 21:57 - 00000000 ____D () C:\Qoobox

2014-04-21 20:57 - 2014-04-21 21:56 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:02 - 2014-05-13 17:42 - 00000000 ____D () C:\Scans

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-21 17:17 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-16 15:57 - 2014-04-21 17:17 - 00000000 ____D () C:\Windows\Minidump

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
 

==================== One Month Modified Files and Folders =======
 

2014-05-14 23:07 - 2014-04-22 16:16 - 00011743 _____ () C:\Users\User1\Desktop\FRST.txt

2014-05-14 23:07 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-05-14 23:07 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-05-14 22:25 - 2014-04-23 13:49 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-14 22:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-14 22:08 - 2013-10-08 19:57 - 01828744 _____ () C:\Windows\WindowsUpdate.log

2014-05-14 19:15 - 2013-10-14 14:04 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-14 19:15 - 2013-10-14 14:04 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-05-14 19:15 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-05-14 17:46 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-05-14 17:46 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-14 17:46 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-14 17:38 - 2014-04-23 13:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-14 17:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-14 17:38 - 2009-07-14 06:51 - 00038510 _____ () C:\Windows\setupact.log

2014-05-14 00:11 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-05-14 00:11 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-05-13 22:47 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-05-13 17:49 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-05-13 17:49 - 2014-04-22 16:15 - 02066944 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-05-13 17:42 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt

2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt

2014-05-13 17:41 - 2014-05-12 14:31 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine

2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt

2014-05-12 14:44 - 2014-05-12 14:37 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt

2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt

2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe

2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe

2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip

2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip

2014-05-08 21:49 - 2014-04-24 17:59 - 00025435 _____ () C:\Users\User1\Desktop\Addition.txt

2014-05-08 15:20 - 2014-04-23 13:49 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-08 15:20 - 2014-04-23 13:49 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-06 18:20 - 2013-10-22 18:07 - 00000000 ____D () C:\Users\User1\Documents\StarCraft II

2014-05-06 17:43 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-05-02 20:59 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-05-01 00:03 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-29 23:04 - 2014-04-23 13:49 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:46 - 2014-04-29 21:45 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-29 21:45 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-29 16:01 - 2014-05-04 02:18 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-29 15:40 - 2014-05-04 02:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-29 14:48 - 2014-05-04 02:18 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-29 14:34 - 2014-05-04 02:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-25 13:18 - 2014-04-25 13:18 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (2).exe

2014-04-24 18:01 - 2014-04-24 18:01 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih (1).exe

2014-04-24 17:57 - 2014-04-24 17:57 - 01071360 _____ (Solid State Networks) C:\Users\User1\Downloads\install_flashplayer13x32axau_mssa_aaa_aih.exe

2014-04-24 17:53 - 2010-11-21 05:47 - 00284572 _____ () C:\Windows\PFRO.log

2014-04-23 16:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-04-23 13:49 - 2014-04-23 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-04-23 13:49 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-23 13:47 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-23 13:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe

2014-04-21 21:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Apps\2.0

2014-04-21 21:57 - 2014-04-21 21:57 - 00019605 _____ () C:\ComboFix.txt

2014-04-21 21:57 - 2014-04-21 20:57 - 00000000 ____D () C:\Qoobox

2014-04-21 21:57 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-04-21 21:56 - 2014-04-21 20:57 - 00000000 ____D () C:\Windows\erdnt

2014-04-21 21:56 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-04-21 21:42 - 2014-04-21 21:42 - 00001514 _____ () C:\Users\User1\Desktop\ComboFix - Verknüpfung.lnk

2014-04-21 20:56 - 2014-04-21 20:56 - 05196870 ____R (Swearware) C:\Users\User1\Downloads\ComboFix.exe

2014-04-21 17:17 - 2014-04-21 17:17 - 00456072 _____ () C:\Windows\Minidump\042114-20997-01.dmp

2014-04-21 17:17 - 2014-04-16 15:57 - 782533897 _____ () C:\Windows\MEMORY.DMP

2014-04-21 17:17 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump

2014-04-21 17:17 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware

2014-04-21 15:35 - 2014-04-21 15:35 - 00002098 _____ () C:\Users\User1\Desktop\Avira Free Antivirus starten.lnk

2014-04-21 15:32 - 2014-04-21 15:32 - 00002108 _____ () C:\Users\User1\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK

2014-04-21 15:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-04-21 15:06 - 2014-04-21 15:06 - 00380416 _____ () C:\Users\User1\Downloads\Gmer-19357.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00050477 _____ () C:\Users\User1\Downloads\Defogger.exe

2014-04-21 15:04 - 2014-04-21 15:04 - 00000480 _____ () C:\Users\User1\Downloads\defogger_disable.log

2014-04-21 15:04 - 2014-04-21 15:04 - 00000000 _____ () C:\Users\User1\defogger_reenable

2014-04-21 15:04 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1

2014-04-21 15:02 - 2014-04-09 18:30 - 00035861 _____ () C:\Users\User1\Downloads\FRST.txt

2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\User1\Downloads\FRST64 (1).exe

2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\User1\Documents\ProcAlyzer Dumps

2014-04-21 13:27 - 2014-04-21 13:27 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking

2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\User1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe

2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\User1\Documents\Anti-Malware

2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (3).zip

2014-04-21 13:06 - 2013-10-09 17:30 - 00001110 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk

2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk

2014-04-21 12:50 - 2014-04-21 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\User1\Downloads\Malkorok.zip

2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (2).zip

2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\User1\Downloads\elvui-6.999 (1).zip

2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe

2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe

2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe

2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe

2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google

2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe

2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp

2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\User1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe

2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-14 20:05 - 2014-04-23 13:48 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-14 20:05 - 2014-04-23 13:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-14 20:04 - 2014-04-23 13:48 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-14 04:24 - 2014-04-30 17:49 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-14 04:19 - 2014-04-30 17:49 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\ntdll_dump.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-14 21:11
 

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber

15.05.2014 19:54

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\Software\Classes\exefile:  <===== ATTENTION!

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Router auf Werkseinstellungen zurücksetzen. Verbindungsdaten neu eingeben.

RogueKiller öffnen, PreScan, Scannen, dann DNS Fix klicken.

Frisches FRST log bitte.

Kerrigan

17.05.2014 15:01

Hallo Schrauber,

sorry für die lange Antwortzeit. Ich hatte super viel zu tun und habe eine Frage. Der PC wird nur via WLan mit dem Netz verbunden und hat keine direkte Verbindung zum Router da ich zwei Router nutze. ( Einen nur für WLAN und einen für den normalen Netzzugang ) Muss ich dann trotzdem den Router komplett zurücksetzen?

schrauber

18.05.2014 12:28

Hast Du mehrere Rechner in deinem Netz`? Wenn ja haben die anderen keine Probleme?

Ich schätze mal du hast das jetzt falsch beschrieben, es sieht bei dir bestimmt so aus:

Internet > Dose an der Wand > Router/Modem > Wlan Router(aber Modem deaktiviert) > Rechner.

Kerrigan

18.05.2014 14:56

Hallo Schrauber,

ja ich habe mehrere Rechner in einem Netzwerk. Es gibt allerdings nur auf einem ( wenig genutztem ) die Probleme. Der betroffene PC hat keine direkte Kabelverbindung zum Router sondern ist nur per WLAN angeschlossen.

Ich habe die Anschlussart tatsächlich etwas komisch beschrieben. Deine Beschreibung stimmt soweit. Der eine Router wird nur als Brücke benutzt für den WLAN Router. Beide Router sind per Kabel mit meinem Hauptrechner verbunden bei dem es keinerlei Probleme gibt. ( Virensuche, Malwaresuche, Trojanersuche usw. zeigten keinerlei Betroffene Dateien, keine erkennbaren Probleme treten auf )

Muss ich trotzdem beide Router auf Werkseinstellungen zurücksetzen oder reicht es eventuell aus das WLAN zu deaktivieren bis alle Prüfungen / Reinigungen gelaufen sind?

schrauber

19.05.2014 09:47

Wenn nur der Rechner Probleme macht, der am WLAN hängt, dann den WLAN Router zurücksetzen.

Kerrigan

21.05.2014 23:56

Hallo,

hier die Scans. Problem leider immer noch da. :(

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01 (ATTENTION: ====> FRST version is 11 days old and could be outdated)

Ran by User1 (administrator) on User1-PC-NE on 22-05-2014 00:35:46

Running from C:\Users\User1\Desktop

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\spotify.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Program Files (x86)\Trillian\plugins\skypekit.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6170168 2014-05-14] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-14] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-15]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-15]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-15]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-15]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-15]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-15]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-22 00:21 - 2014-05-22 00:21 - 00000963 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_002154.txt

2014-05-22 00:20 - 2014-05-22 00:20 - 00001916 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_002056.txt

2014-05-22 00:18 - 2014-05-22 00:18 - 00001880 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_001801.txt

2014-05-22 00:18 - 2014-05-22 00:18 - 00000930 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_001829.txt

2014-05-17 01:19 - 2014-05-06 07:14 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-17 01:19 - 2014-05-06 07:14 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-17 01:19 - 2014-05-06 05:48 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-17 01:19 - 2014-05-06 05:48 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-17 01:19 - 2014-05-06 05:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-17 01:19 - 2014-05-06 05:26 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-17 01:19 - 2013-12-21 11:39 - 00600064 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-05-17 01:19 - 2013-12-21 09:56 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02238976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02049536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-15 19:51 - 2014-05-15 19:51 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat

2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat

2014-05-15 19:51 - 2014-05-15 19:51 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2014-05-15 19:51 - 2014-05-15 19:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2014-05-15 19:51 - 2014-05-15 19:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2014-05-15 19:51 - 2014-05-15 19:51 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2014-05-15 19:51 - 2014-05-15 19:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

2014-05-15 19:48 - 2014-05-15 19:49 - 00000000 ____D () C:\Windows\system32\MRT

2014-05-15 19:48 - 2014-05-04 17:12 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-05-15 19:47 - 2014-05-15 19:47 - 00002027 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk

2014-05-15 00:43 - 2014-05-15 00:43 - 00001846 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05152014_004326.txt

2014-05-15 00:38 - 2014-05-15 00:38 - 00000000 ____D () C:\Users\User1\AppData\Local\Adobe

2014-05-15 00:22 - 2014-05-22 00:35 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-15 00:22 - 2014-05-22 00:32 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-15 00:22 - 2014-05-15 00:27 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-15 00:22 - 2014-05-15 00:27 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-15 00:22 - 2014-05-15 00:22 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-05-15 00:22 - 2014-05-15 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-05-14 23:36 - 2014-05-15 00:09 - 38410232 _____ (Google Inc.) C:\Users\User1\Downloads\ChromeStandaloneSetup_34.0.1847.137.exe

2014-05-14 23:28 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-05-14 23:08 - 2014-05-14 23:21 - 00041697 _____ () C:\Users\User1\Desktop\Shortcut.txt

2014-05-14 17:49 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-05-14 17:49 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-05-14 17:49 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-05-14 17:49 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-05-14 17:49 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-05-14 17:49 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-05-14 17:49 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-05-14 17:49 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-05-14 17:49 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-05-14 17:49 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-05-14 17:49 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-05-14 17:49 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-05-14 17:49 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-05-14 17:49 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-05-14 17:49 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-05-14 17:49 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-05-14 17:49 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-05-14 17:49 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-05-14 17:49 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-05-14 17:49 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt

2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt

2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt

2014-05-12 14:37 - 2014-05-12 14:44 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt

2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt

2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe

2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe

2014-05-12 14:31 - 2014-05-13 17:41 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine

2014-05-12 14:31 - 2014-03-26 13:57 - 04493824 _____ () C:\Users\User1\Desktop\RogueKillerX64.exe

2014-05-12 14:31 - 2014-03-26 13:57 - 03945472 _____ () C:\Users\User1\Desktop\RogueKiller.exe

2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip

2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip

2014-05-01 00:03 - 2014-05-15 19:37 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:45 - 2014-04-29 21:46 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-24 18:00 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2014-04-24 18:00 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2014-04-24 17:59 - 2014-05-14 23:21 - 00025318 _____ () C:\Users\User1\Desktop\Addition.txt

2014-04-24 17:58 - 2014-05-13 17:49 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-04-23 13:48 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-23 13:48 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-22 16:16 - 2014-05-22 00:35 - 00012260 _____ () C:\Users\User1\Desktop\FRST.txt

2014-04-22 16:15 - 2014-05-13 17:49 - 02066944 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-22 15:03 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-22 15:03 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:01 - 2014-04-22 15:02 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
 

==================== One Month Modified Files and Folders =======
 

2014-05-22 00:36 - 2014-04-22 16:16 - 00012260 _____ () C:\Users\User1\Desktop\FRST.txt

2014-05-22 00:35 - 2014-05-15 00:22 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-22 00:35 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-05-22 00:35 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-05-22 00:32 - 2014-05-15 00:22 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-22 00:31 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-22 00:31 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-22 00:23 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-22 00:23 - 2009-07-14 06:51 - 00039014 _____ () C:\Windows\setupact.log

2014-05-22 00:22 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-05-22 00:22 - 2013-10-08 19:57 - 01307340 _____ () C:\Windows\WindowsUpdate.log

2014-05-22 00:21 - 2014-05-22 00:21 - 00000963 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_002154.txt

2014-05-22 00:20 - 2014-05-22 00:20 - 00001916 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_002056.txt

2014-05-22 00:18 - 2014-05-22 00:18 - 00001880 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_001801.txt

2014-05-22 00:18 - 2014-05-22 00:18 - 00000930 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_001829.txt

2014-05-22 00:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-21 17:42 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-05-17 00:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-05-15 20:00 - 2013-10-08 20:20 - 00001417 _____ () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-05-15 19:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-05-15 19:56 - 2013-10-14 15:35 - 00020687 _____ () C:\Windows\IE10_main.log

2014-05-15 19:51 - 2014-05-15 19:51 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02238976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02049536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-15 19:51 - 2014-05-15 19:51 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat

2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat

2014-05-15 19:51 - 2014-05-15 19:51 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2014-05-15 19:51 - 2014-05-15 19:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2014-05-15 19:51 - 2014-05-15 19:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2014-05-15 19:51 - 2014-05-15 19:51 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2014-05-15 19:51 - 2014-05-15 19:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

2014-05-15 19:49 - 2014-05-15 19:48 - 00000000 ____D () C:\Windows\system32\MRT

2014-05-15 19:47 - 2014-05-15 19:47 - 00002027 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk

2014-05-15 19:47 - 2013-10-08 22:23 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2014-05-15 19:42 - 2013-10-08 22:23 - 00000000 ____D () C:\ProgramData\Adobe

2014-05-15 19:42 - 2013-10-08 20:20 - 00000000 ___RD () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-15 19:42 - 2013-10-08 20:20 - 00000000 ___RD () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-05-15 19:37 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-05-15 19:37 - 2010-11-21 05:47 - 00285442 _____ () C:\Windows\PFRO.log

2014-05-15 00:43 - 2014-05-15 00:43 - 00001846 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05152014_004326.txt

2014-05-15 00:38 - 2014-05-15 00:38 - 00000000 ____D () C:\Users\User1\AppData\Local\Adobe

2014-05-15 00:38 - 2013-10-09 13:36 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Adobe

2014-05-15 00:27 - 2014-05-15 00:22 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-15 00:27 - 2014-05-15 00:22 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-15 00:22 - 2014-05-15 00:22 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-05-15 00:22 - 2014-05-15 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-05-15 00:22 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-05-15 00:22 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-05-15 00:09 - 2014-05-14 23:36 - 38410232 _____ (Google Inc.) C:\Users\User1\Downloads\ChromeStandaloneSetup_34.0.1847.137.exe

2014-05-14 23:27 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-05-14 23:21 - 2014-05-14 23:08 - 00041697 _____ () C:\Users\User1\Desktop\Shortcut.txt

2014-05-14 23:21 - 2014-04-24 17:59 - 00025318 _____ () C:\Users\User1\Desktop\Addition.txt

2014-05-14 19:15 - 2013-10-14 14:04 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-14 19:15 - 2013-10-14 14:04 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-05-14 19:15 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-05-14 00:11 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-05-14 00:11 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-05-13 22:47 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-05-13 17:49 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-05-13 17:49 - 2014-04-22 16:15 - 02066944 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-05-13 17:42 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt

2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt

2014-05-13 17:41 - 2014-05-12 14:31 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine

2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt

2014-05-12 14:44 - 2014-05-12 14:37 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt

2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt

2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe

2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe

2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip

2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip

2014-05-09 08:14 - 2014-05-14 17:49 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-05-09 08:11 - 2014-05-14 17:49 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-05-06 18:20 - 2013-10-22 18:07 - 00000000 ____D () C:\Users\User1\Documents\StarCraft II

2014-05-06 07:14 - 2014-05-17 01:19 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-06 07:14 - 2014-05-17 01:19 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-06 05:48 - 2014-05-17 01:19 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-06 05:48 - 2014-05-17 01:19 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-06 05:37 - 2014-05-17 01:19 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-06 05:26 - 2014-05-17 01:19 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-04 17:12 - 2014-05-15 19:48 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-05-02 20:59 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-04-29 22:06 - 2014-04-29 22:06 - 00078313 _____ () C:\Users\User1\Downloads\CT_MailMod_5.4.2.2.zip

2014-04-29 21:46 - 2014-04-29 21:46 - 00061123 _____ () C:\Users\User1\Downloads\TradeSkillMaster_Mailing-v2.2.1.zip

2014-04-29 21:46 - 2014-04-29 21:45 - 00849575 _____ () C:\Users\User1\Downloads\TradeSkillMaster-v2.5.12.1.zip

2014-04-29 21:45 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Deployment

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieUserList

2014-04-23 13:39 - 2014-04-23 13:39 - 00000000 __SHD () C:\Users\User1\AppData\Local\EmieSiteList

2014-04-23 13:37 - 2014-04-23 13:37 - 02347384 _____ (ESET) C:\Users\User1\Desktop\esetsmartinstaller_enu.exe

2014-04-23 13:37 - 2014-04-23 13:37 - 00001272 _____ () C:\Users\User1\Desktop\Revo Uninstaller.lnk

2014-04-23 13:37 - 2014-04-23 13:37 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-04-23 13:23 - 2014-04-23 13:23 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\User1\Desktop\revosetup95.exe

2014-04-23 13:23 - 2014-04-23 13:23 - 00855379 _____ () C:\Users\User1\Desktop\SecurityCheck.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 02347384 _____ (ESET) C:\Users\User1\Downloads\esetsmartinstaller_enu.exe

2014-04-23 13:22 - 2014-04-23 13:22 - 00016569 _____ () C:\Users\User1\Desktop\Download (1).htm

2014-04-22 16:15 - 2014-04-22 16:15 - 00016102 _____ () C:\Users\User1\Desktop\Download.htm

2014-04-22 16:03 - 2014-04-22 16:03 - 00000818 _____ () C:\Users\User1\Desktop\JRT.txt

2014-04-22 15:58 - 2014-04-22 15:58 - 00000000 ____D () C:\Windows\ERUNT

2014-04-22 15:55 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner

2014-04-22 15:07 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-22 15:03 - 2014-04-22 15:03 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-22 15:03 - 2014-04-22 15:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-22 15:02 - 2014-04-22 15:02 - 01335637 _____ () C:\Users\User1\Desktop\adwcleaner (1).exe

2014-04-22 15:02 - 2014-04-22 15:01 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\User1\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-22 15:01 - 2014-04-22 15:01 - 01016261 _____ (Thisisu) C:\Users\User1\Desktop\JRT.exe
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\ntdll_dump.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe

[2014-05-14 17:49] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C
 

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-14 21:11
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-05-2014 01

Ran by User1 at 2014-05-22 00:15:10 Run:4

Running from C:\Users\User1\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\Software\Classes\exefile:  <===== ATTENTION!

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114

*****************
 

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\Software\Classes\exefile => Key deleted successfully.

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer => Value deleted successfully.
 

==== End of Fixlog ====

Code:

RogueKiller V8.8.14 _x64_ [Mar 26 2014] durch Adlice Software

mail : hxxp://www.adlice.com/contact/

Kommentare : hxxp://forum.adlice.com

Webseite : hxxp://www.adlice.com/softwares/roguekiller/

Blog : hxxp://www.adlice.com
 

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Gestartet in : Normaler Modus

Benutzer : User1 [Admin Rechte]

Funktion : Scannen -- Datum : 05/22/2014 00:20:56

| ARK || FAK || MBR |
 

¤¤¤ Böswillige Prozesse : 0 ¤¤¤
 

¤¤¤ Registry-Einträge : 0 ¤¤¤
 

¤¤¤ Geplante Tasks : 0 ¤¤¤
 

¤¤¤ Autostart-Einträge : 0 ¤¤¤
 

¤¤¤ Web-Browsern : 0 ¤¤¤
 

¤¤¤ Browser Addons : 0 ¤¤¤
 

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤
 

¤¤¤ Treiber : [NICHT GELADEN 0x0] ¤¤¤
 

¤¤¤ Externe Hives: ¤¤¤
 

¤¤¤ Infektion :  ¤¤¤
 

¤¤¤ Hosts-Datei: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts
 
 

127.0.0.1 localhost

::1 localhost
 
 

¤¤¤ MBR überprüfen: ¤¤¤
 

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD10EALX-009BA0 ATA Device +++++

--- User ---

[MBR] 4e08872e192e8c6e0c1d0fedfaeda45f

[BSP] 3b932c3ea17df325cd0025b065592a32 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB

User = LL1 ... OK!

User = LL2 ... OK!
 

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Multi Flash Reader USB Device +++++

Error reading User MBR! ([0x15] Das Gerät ist nicht bereit. )

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] Die Anforderung wird nicht unterstützt. )
 

Abgeschlossen : << RKreport[0]_S_05222014_002056.txt >>

RKreport[0]_D_05132014_174137.txt;RKreport[0]_S_05122014_143525.txt;RKreport[0]_S_05122014_143749.txt

RKreport[0]_S_05132014_173940.txt;RKreport[0]_S_05152014_004326.txt;RKreport[0]_S_05222014_001801.txt

schrauber

22.05.2014 13:43

hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Kerrigan

23.05.2014 17:45

Hallo Schrauber,

leider macht mein USB Stick ein paar Macken sodas ich mir einen neuen kaufen muss. Das schaffe ich aber erst am Montag. Also bitte nicht wundern wenn vorher keine Antwort kommt. :)

Es gibt leider noch ein neues Problem. Das gleiche Problem wie auf meinem zweit PC ist mittlerweile auf meinem Tablet... ( Kindle Fire HD ) Ich surfe mit dem Tablet sehr selten und habe keine Ahnung wie das dort hin kommt. Ich habe keine Lust das komplette Tablet neu zu machen nur um mir dann nächste Woche diesen Mist nochmal einzufangen. Ich wüsste eben gerne wo ich das her habe und wie ich eine neue Infizierung verhindern kann. Die einzigen Seiten die ich mit meinem Tablett besuche sind irgendwelche Twitch Streams ( zB: www.twitch.tv/gsl / www.twitch.tv/proleague ) oder hxxp://wiki.teamliquid.net/ eigentlich alles große und bekannte Seiten. Hast du einen Tip wie ich dieser Werbehölle entkomme? :headbang:

schrauber

24.05.2014 11:24

Router mal auf Werkseinstellungen zurücksetzen.

Kerrigan

29.05.2014 22:10

Hi,

also ich habe nun ein paar Optionen versucht aber leider erscheint bei keiner einzigen die Option Computer reparieren. Und egal was ich auswähle, der PC startet irgendwie immer ganz normal Window.

In dem Menü das erscheint wenn ich beim booten F8 drücke stehen nur zur Auswahl:

Sata:4M-WDC
CDROM: 4S-TSSTcorp
USB:Multi Flash Reader
USB: USB Disk 3.0

Was soll ich nun tun?

Nachtrag:

Obwohl ich nichts getan habe auser eventuell mal vom USB Stick zu booten ( Wo nur das FRST Tool drauf war ) ist seit jetzt eben das Problem plötzlich verschwunden. Keine Symptome mehr zu sehen, Klicks lösen keine Werbung aus, keine komischen leeren Fenster werden geladen. Gestern war das Problem definitiv noch da! Ich verstehe nix mehr. :(

Nachtrag 2:

Rechner läuft nun seit 6 Stunden Problemlos und ohne das ich irgendwie neue Seiten angesurft hätte ist nun der ganze nervige Werbekram wieder da...:headbang:

schrauber

30.05.2014 22:06

Du drückst warscheinlich zu früh F8. Aber egal, jetzt ist es ja weg. FRST log vom Desktop bitte.

Kerrigan

06.06.2014 17:09

Hallo,

sorry das ich mich so lange nicht gemeldet habe, aber ich hab keine Mail bekommen das es eine neue Antwort gab. :( Und eben wollte ich mal nachfragen was da los ist und merke du hast schon längst geantwortet. :(

ALSO.... hier ist erstmal der Scan:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-06-2014

Ran by User1 (administrator) on User1-PC-NE on 06-06-2014 17:55:13

Running from C:\Users\User1\Desktop

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\spotify.exe

(Spotify Ltd) C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\Gaming Mouse\Monitor.exe

(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Program Files (x86)\Trillian\plugins\skypekit.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)

HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)

HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)

HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-04] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()

HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\User1\AppData\Roaming\Spotify\Spotify.exe [6170168 2014-05-14] (Spotify Ltd)

HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\User1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-14] (Spotify Ltd)

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk

ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
 

FireFox:

========

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 

Chrome: 

=======

CHR Extension: (Google Docs) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-15]

CHR Extension: (Google Drive) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-15]

CHR Extension: (YouTube) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-15]

CHR Extension: (Google-Suche) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-15]

CHR Extension: (Google Wallet) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-15]

CHR Extension: (Google Mail) - C:\Users\User1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-15]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-04] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)

S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
 

==================== Drivers (Whitelisted) ====================
 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-04] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-04] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)

R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation                           )

R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)

R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-06-04] (Windows (R) Win 7 DDK provider)

U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-04 18:25 - 2014-06-06 10:58 - 00000000 ____D () C:\ProgramData\Spyware Terminator

2014-06-04 18:25 - 2014-06-04 18:25 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys

2014-06-04 18:25 - 2014-06-04 18:25 - 00001046 _____ () C:\Users\Public\Desktop\Spyware Terminator 2012.lnk

2014-06-04 18:25 - 2014-06-04 18:25 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spyware Terminator

2014-06-04 18:25 - 2014-06-04 18:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012

2014-06-04 18:25 - 2014-06-04 18:25 - 00000000 ____D () C:\Program Files (x86)\Spyware Terminator

2014-06-04 18:23 - 2014-06-04 18:23 - 05049344 _____ (Crawler.com ) C:\Users\User1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe

2014-05-22 00:21 - 2014-05-22 00:21 - 00000963 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_002154.txt

2014-05-22 00:20 - 2014-05-22 00:57 - 00001912 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_002056.txt

2014-05-22 00:18 - 2014-05-22 00:18 - 00001880 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_001801.txt

2014-05-22 00:18 - 2014-05-22 00:18 - 00000930 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_001829.txt

2014-05-17 01:19 - 2014-05-06 07:14 - 19274752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-17 01:19 - 2014-05-06 07:14 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-17 01:19 - 2014-05-06 05:48 - 14367232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-17 01:19 - 2014-05-06 05:48 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-17 01:19 - 2014-05-06 05:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-17 01:19 - 2014-05-06 05:26 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-17 01:19 - 2013-12-21 11:39 - 00600064 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-05-17 01:19 - 2013-12-21 09:56 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02238976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02049536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-15 19:51 - 2014-05-15 19:51 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat

2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat

2014-05-15 19:51 - 2014-05-15 19:51 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2014-05-15 19:51 - 2014-05-15 19:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2014-05-15 19:51 - 2014-05-15 19:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2014-05-15 19:51 - 2014-05-15 19:51 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2014-05-15 19:51 - 2014-05-15 19:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

2014-05-15 19:48 - 2014-05-15 19:49 - 00000000 ____D () C:\Windows\system32\MRT

2014-05-15 19:48 - 2014-05-04 17:12 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-05-15 19:47 - 2014-05-15 19:47 - 00002027 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk

2014-05-15 00:43 - 2014-05-15 00:43 - 00001846 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05152014_004326.txt

2014-05-15 00:38 - 2014-05-15 00:38 - 00000000 ____D () C:\Users\User1\AppData\Local\Adobe

2014-05-15 00:22 - 2014-06-06 17:34 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-15 00:22 - 2014-06-06 17:32 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-15 00:22 - 2014-05-22 23:43 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-05-15 00:22 - 2014-05-15 00:27 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-15 00:22 - 2014-05-15 00:27 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-15 00:22 - 2014-05-15 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-05-14 23:36 - 2014-05-15 00:09 - 38410232 _____ (Google Inc.) C:\Users\User1\Downloads\ChromeStandaloneSetup_34.0.1847.137.exe

2014-05-14 23:28 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-05-14 23:08 - 2014-05-14 23:21 - 00041697 _____ () C:\Users\User1\Desktop\Shortcut.txt

2014-05-14 17:49 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-05-14 17:49 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-05-14 17:49 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-05-14 17:49 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-05-14 17:49 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-05-14 17:49 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-05-14 17:49 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-05-14 17:49 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-05-14 17:49 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-05-14 17:49 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-05-14 17:49 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-05-14 17:49 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-05-14 17:49 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-05-14 17:49 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-05-14 17:49 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-05-14 17:49 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-05-14 17:49 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-05-14 17:49 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-05-14 17:49 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-05-14 17:49 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-05-14 17:49 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-05-14 17:49 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-05-14 17:49 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt

2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt

2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt

2014-05-12 14:37 - 2014-05-12 14:44 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt

2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt

2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe

2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe

2014-05-12 14:31 - 2014-05-13 17:41 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine

2014-05-12 14:31 - 2014-03-26 13:57 - 04493824 _____ () C:\Users\User1\Desktop\RogueKillerX64.exe

2014-05-12 14:31 - 2014-03-26 13:57 - 03945472 _____ () C:\Users\User1\Desktop\RogueKiller.exe

2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip

2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip
 

==================== One Month Modified Files and Folders =======
 

2014-06-06 17:55 - 2014-04-22 16:16 - 00013802 _____ () C:\Users\User1\Desktop\FRST.txt

2014-06-06 17:55 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST

2014-06-06 17:55 - 2013-10-08 20:20 - 00000000 ____D () C:\Users\User1\AppData\Local\Temp

2014-06-06 17:54 - 2014-04-24 17:58 - 00000000 ____D () C:\Users\User1\Desktop\FRST-OlderVersion

2014-06-06 17:54 - 2014-04-22 16:15 - 02072576 _____ (Farbar) C:\Users\User1\Desktop\FRST64.exe

2014-06-06 17:41 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job

2014-06-06 17:34 - 2014-05-15 00:22 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-06 17:34 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spotify

2014-06-06 17:32 - 2014-05-15 00:22 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-06 17:26 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-06 17:26 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-06 17:23 - 2013-10-08 19:57 - 01626243 _____ () C:\Windows\WindowsUpdate.log

2014-06-06 17:19 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-06 17:19 - 2009-07-14 06:51 - 00040744 _____ () C:\Windows\setupact.log

2014-06-06 10:58 - 2014-06-04 18:25 - 00000000 ____D () C:\ProgramData\Spyware Terminator

2014-06-06 01:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-04 18:58 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\User1\AppData\Local\Spotify

2014-06-04 18:51 - 2013-10-09 18:22 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-06-04 18:51 - 2013-10-09 18:22 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-06-04 18:25 - 2014-06-04 18:25 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys

2014-06-04 18:25 - 2014-06-04 18:25 - 00001046 _____ () C:\Users\Public\Desktop\Spyware Terminator 2012.lnk

2014-06-04 18:25 - 2014-06-04 18:25 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Spyware Terminator

2014-06-04 18:25 - 2014-06-04 18:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012

2014-06-04 18:25 - 2014-06-04 18:25 - 00000000 ____D () C:\Program Files (x86)\Spyware Terminator

2014-06-04 18:23 - 2014-06-04 18:23 - 05049344 _____ (Crawler.com ) C:\Users\User1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe

2014-06-02 02:44 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\User1\AppData\Local\Battle.net

2014-06-01 23:08 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft

2014-06-01 23:07 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-06-01 23:03 - 2013-10-22 18:07 - 00000000 ____D () C:\Program Files (x86)\StarCraft II

2014-06-01 22:58 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-05-29 17:22 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat

2014-05-29 17:22 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat

2014-05-29 17:22 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-05-22 23:43 - 2014-05-15 00:22 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-05-22 00:57 - 2014-05-22 00:20 - 00001912 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_002056.txt

2014-05-22 00:21 - 2014-05-22 00:21 - 00000963 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_002154.txt

2014-05-22 00:18 - 2014-05-22 00:18 - 00001880 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05222014_001801.txt

2014-05-22 00:18 - 2014-05-22 00:18 - 00000930 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05222014_001829.txt

2014-05-17 00:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-05-15 20:00 - 2013-10-08 20:20 - 00001417 _____ () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-05-15 19:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-05-15 19:56 - 2013-10-14 15:35 - 00020687 _____ () C:\Windows\IE10_main.log

2014-05-15 19:51 - 2014-05-15 19:51 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02238976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 02049536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-15 19:51 - 2014-05-15 19:51 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat

2014-05-15 19:51 - 2014-05-15 19:51 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat

2014-05-15 19:51 - 2014-05-15 19:51 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2014-05-15 19:51 - 2014-05-15 19:51 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2014-05-15 19:51 - 2014-05-15 19:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2014-05-15 19:51 - 2014-05-15 19:51 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2014-05-15 19:51 - 2014-05-15 19:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll

2014-05-15 19:51 - 2014-05-15 19:51 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2014-05-15 19:51 - 2014-05-15 19:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

2014-05-15 19:49 - 2014-05-15 19:48 - 00000000 ____D () C:\Windows\system32\MRT

2014-05-15 19:47 - 2014-05-15 19:47 - 00002027 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk

2014-05-15 19:47 - 2013-10-08 22:23 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2014-05-15 19:42 - 2013-10-08 22:23 - 00000000 ____D () C:\ProgramData\Adobe

2014-05-15 19:42 - 2013-10-08 20:20 - 00000000 ___RD () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-05-15 19:42 - 2013-10-08 20:20 - 00000000 ___RD () C:\Users\User1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2014-05-15 19:37 - 2014-05-01 00:03 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-05-15 19:37 - 2010-11-21 05:47 - 00285442 _____ () C:\Windows\PFRO.log

2014-05-15 00:43 - 2014-05-15 00:43 - 00001846 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05152014_004326.txt

2014-05-15 00:38 - 2014-05-15 00:38 - 00000000 ____D () C:\Users\User1\AppData\Local\Adobe

2014-05-15 00:38 - 2013-10-09 13:36 - 00000000 ____D () C:\Users\User1\AppData\Roaming\Adobe

2014-05-15 00:27 - 2014-05-15 00:22 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-15 00:27 - 2014-05-15 00:22 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-15 00:22 - 2014-05-15 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-05-15 00:22 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\User1\AppData\Local\Google

2014-05-15 00:22 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google

2014-05-15 00:09 - 2014-05-14 23:36 - 38410232 _____ (Google Inc.) C:\Users\User1\Downloads\ChromeStandaloneSetup_34.0.1847.137.exe

2014-05-14 23:27 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java

2014-05-14 23:21 - 2014-05-14 23:08 - 00041697 _____ () C:\Users\User1\Desktop\Shortcut.txt

2014-05-14 23:21 - 2014-04-24 17:59 - 00025318 _____ () C:\Users\User1\Desktop\Addition.txt

2014-05-14 19:15 - 2013-10-14 14:04 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-14 19:15 - 2013-10-14 14:04 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-05-14 19:15 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-05-13 17:42 - 2014-04-21 15:02 - 00000000 ____D () C:\Scans

2014-05-13 17:41 - 2014-05-13 17:41 - 00002445 _____ () C:\Users\User1\Desktop\RKreport[0]_D_05132014_174137.txt

2014-05-13 17:41 - 2014-05-13 17:41 - 00000860 _____ () C:\Users\User1\Desktop\RKreport[0]_DN_05132014_174143.txt

2014-05-13 17:41 - 2014-05-12 14:31 - 00000000 ____D () C:\Users\User1\Desktop\RK_Quarantine

2014-05-13 17:39 - 2014-05-13 17:39 - 00002346 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05132014_173940.txt

2014-05-12 14:44 - 2014-05-12 14:37 - 00017189 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143749.txt

2014-05-12 14:35 - 2014-05-12 14:35 - 00017160 _____ () C:\Users\User1\Desktop\RKreport[0]_S_05122014_143525.txt

2014-05-12 14:33 - 2014-05-12 14:33 - 04527616 _____ () C:\Users\User1\Desktop\RogueKillerX64 (1).exe

2014-05-12 14:32 - 2014-05-12 14:32 - 04527616 _____ () C:\Users\User1\Downloads\RogueKillerX64.exe

2014-05-12 14:30 - 2014-05-12 14:30 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14 (1).zip

2014-05-12 14:29 - 2014-05-12 14:29 - 02619924 _____ () C:\Users\User1\Downloads\RogueKiller_8.8.14.zip

2014-05-09 08:14 - 2014-05-14 17:49 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-05-09 08:11 - 2014-05-14 17:49 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
 

Some content of TEMP:

====================

C:\Users\User1\AppData\Local\Temp\avgnt.exe

C:\Users\User1\AppData\Local\Temp\ntdll_dump.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-06-01 20:50
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Eine kurze Zusammenfassung der Ereignisse;

Nachdem der Werbeterror kurzzeitig weg war ( cirka 6 Stunden lang ) kam er wieder und nervte mich erfolgreich bis vorgestern. Dann brachte mich eine Freundin auf den Gedanken mal zu vergleichen was bei meinem Hauptrechner anders ist ( Der ja nicht befallen wird von dem Ding ) und dabei bin ich darauf gekommen das dort ein Programm läuft was auf meinem zweit Rechner nicht installiert ist. Ich habe dann auch auf dem Rechner hier Spyware Terminator installiert und es durchlaufen lassen. Gefunden wurde jede Menge Malware. Nach dem Scan und dem löschen der Malware habe ich den PC neu gestartet und Chrome aufgemacht. Werbeterror noch da.... :(

Am nächsten Tag startete ich ganz normal den PC. Spyware Terminator lief wieder durch, fand noch ein paar kleine Infektionen im IE und entfernte auch diese. Seit dem ist keine Spur mehr von meinem Plagegeist zu entdecken! JIPPPPIYYYYYY! Seit zwei Tagen Ruhe vor dem Werbeterror. Ein TRAUM!

Meinst du das reicht aus um alles zu beseitigen? Siehst du irgendwas böses noch in dem Scan?

schrauber

07.06.2014 11:16

Die FRST Logs sind nach dem Scan mit Spyware Terminator?

Kerrigan

07.06.2014 11:37

Ja genau die sind nach dem Scan entstanden.

schrauber

08.06.2014 09:26

und jetzt keine Probleme mehr? Gibt es mehrere Rechner in deinem Netzwerk? Wenn ja bitte mal ein FRST log von einem anderne Rechner. Ich würde gerne was checken.

Alle Zeitangaben in WEZ +1. Es ist jetzt 13:05 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131