Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Win.32 Dropper_gen + S.M.A.R.T failure predicted HD - 0 (https://www.trojaner-board.de/153475-win-32-dropper_gen-s-m-a-r-t-failure-predicted-hd-0-a.html)

s1uu 05.05.2014 17:49
Win.32 Dropper_gen + S.M.A.R.T failure predicted HD - 0
 
Hallo,

Ich habe mich jetzt die letzten 2 Tage mit google und dem Forum hier beschäftigt. Oft kamen ausssagen, dass diese Hilfestellung nur für das individuelle Problem zu nutzen sind, weshalb ich hier ein neues Thema eröffne.

Ich besitze ein Acer Laptop aspire 5930G
mit 320GB HDD, 4GB RAM, intel core 2 dzo p8400, nvidia geforce 9600 GT turbocache
Meine Browser sind: Mozilla und Google Chrome

Antivir ist Avast


Nun zu meinem Thema:

Ich habe mir das Programm malewarebytes heruntergeladen, habe es durchlaufen lassen und dann zeigte er mir den win.32 dropper_gen an. Er hat es in die Quarantäne geschoben, habe daraufhin einen Neustart gemacht und dann konnte ich nur durch das drücken von F1 weiter machen mit der Meldung: S.M.A.R.T failure predicted hard disc 0
Daraufhin habe ich recherchiert dass der Dropper wohl ziemlich Aggressiv sein soll und meine Meldung darauf hindeutet, dass meine Festplatte demnächst hinüber sein wird.
Bei jedem Neustart sagt er mir ich soll ein Backup machen. was ich dann auf meine Externe Festplatte draufspielen wollte mit etlichen Fehlermeldungen. Habe dann nun nochmal den malewarebytes drüber laufen lassen und gleichzeitig mit avast. Avast hatte dann den dropper auch gefunden und der hat dann beim Neustart einen scan durchgeführt und auch infizierte dateien gefunden. Leider konnte ich die weder löschen noch in Quarantäne verschieben und musste auf "ignorieren" klicken, damit das programm fortfahren konnte. Demnach denke ich dass da noch irgendwas rumläuft. Ein jetztiger scan zeigt nichts mehr an. Allerdings kann ich auch kein CHKDSK ausführen, weil er dann nach den Administratorrechten verlangt. Also habe ich Rechtsklick -> als admin ausführen gemacht und der konnte das System trotzdem nicht scannen.
Habe mir dann das Programm HD Tune runtergeladen welches bei scan auf fehlern seeehr lange gedauert hat, allerdings jedes kleine Kästchen "Grün" war und mir somit keine Fehler angezeigt hat.

Die jetztige Situation ist, dass mein Rechner nurnoch beim Drücken von anfangs F1 hochfährt und in der Startprogrammphase viel länger als sonst benötigt, mit dem zusätzlichen Hinweis, ich soll meine Daten sichern. Aber so wie ich im Forum gelesen habe, dass bei manchen ein Bluscreen kommt ist bei mir nicht der fall.

Was kann ich tun?

schrauber 05.05.2014 20:16
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


s1uu 05.05.2014 21:50
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-05-2014 02
Ran by s1u (administrator) on S1U-PC on 05-05-2014 22:32:26
Running from C:\Users\s1u\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Foxit Corporation) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Yuna Software) C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\s1u\Downloads\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1225920 2014-04-02] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2201032 2014-04-02] (NVIDIA Corporation)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2014-03-23] (Greenshot)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [20131121] => C:\Program Files\AVAST Software\Avast\setup\emupdate\1d9812b0-7ec9-4d58-beeb-0665c0a351b1.exe /check
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3873704 2014-04-29] (AVAST Software)
HKU\S-1-5-21-758192491-693762671-1294062596-1001\...\MountPoints2: {1bddf693-60b3-11e2-9fee-001d723f50d0} - F:\splash_screen.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startzentrale.de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4D3E729883B0CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2417} URL =
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} -  No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 195.234.128.7 195.234.128.16

FireFox:
========
FF ProfilePath: C:\Users\s1u\AppData\Roaming\Mozilla\Firefox\Profiles\vptphykd.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-29]

Chrome:
=======
CHR HomePage:
CHR StartupUrls: "hxxp://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\s1u\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-03]
CHR Extension: (WASP - Web Analytics Solution Profiler) - C:\Users\s1u\AppData\Local\Google\Chrome\User Data\Default\Extensions\niaoghengfohplclhbjnjheodgkejpih [2014-04-06]
CHR Extension: (Google Wallet) - C:\Users\s1u\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-03]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-04-29]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-29] (AVAST Software)
R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [239680 2014-02-19] (Foxit Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 MsgPlusService; C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [125952 2012-12-16] (Yuna Software)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1615192 2014-04-02] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [20541216 2014-04-02] (NVIDIA Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-29] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-29] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-04-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-29] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-02-08] (DT Soft Ltd)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-05] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-21] (NVIDIA Corporation)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-05 22:31 - 2014-05-05 22:32 - 02063872 _____ (Farbar) C:\Users\s1u\Downloads\FRST64 (1).exe
2014-05-05 18:58 - 2014-05-05 19:00 - 00036766 _____ () C:\Users\s1u\Downloads\Addition.txt
2014-05-05 18:57 - 2014-05-05 22:32 - 00012622 _____ () C:\Users\s1u\Downloads\FRST.txt
2014-05-05 18:57 - 2014-05-05 22:32 - 00000000 ____D () C:\FRST
2014-05-05 18:56 - 2014-05-05 18:56 - 02063872 _____ (Farbar) C:\Users\s1u\Downloads\FRST64.exe
2014-05-02 06:35 - 2014-05-02 06:35 - 01310621 _____ () C:\Users\s1u\Downloads\adwcleaner(2).exe
2014-05-01 20:41 - 2014-05-01 20:41 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Mozilla
2014-05-01 20:40 - 2014-05-01 20:40 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-01 20:40 - 2014-05-01 20:40 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-01 20:40 - 2014-05-01 20:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-01 20:40 - 2014-05-01 20:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-01 20:39 - 2014-05-01 20:39 - 00283376 _____ (Mozilla) C:\Users\s1u\Downloads\Firefox Setup Stub 29.0.exe
2014-05-01 12:42 - 2014-05-01 12:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune
2014-05-01 12:42 - 2014-05-01 12:42 - 00000000 ____D () C:\Program Files (x86)\HD Tune
2014-05-01 12:41 - 2014-05-01 12:41 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (3).exe
2014-05-01 12:41 - 2014-05-01 12:41 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (2).exe
2014-05-01 12:40 - 2014-05-01 12:40 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255.exe
2014-05-01 12:40 - 2014-05-01 12:40 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (1).exe
2014-04-29 21:30 - 2014-04-29 21:30 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-29 21:30 - 2014-04-29 21:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-29 21:29 - 2014-04-29 21:31 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-29 21:29 - 2014-04-29 21:29 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-29 21:29 - 2014-04-29 21:29 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-04-29 21:27 - 2014-04-29 21:27 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-29 21:25 - 2014-05-05 20:21 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-29 19:26 - 2014-04-29 19:28 - 88882192 _____ (AVAST Software) C:\Users\s1u\Downloads\avast_free_antivirus_setup_9_0_2018.exe
2014-04-29 19:21 - 2014-04-29 19:21 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-29 19:21 - 2014-04-29 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-29 19:21 - 2014-04-29 19:21 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-29 19:21 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-29 19:21 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-29 19:21 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-29 19:20 - 2014-04-29 19:20 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\s1u\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-29 19:07 - 2014-04-29 19:07 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Greenshot
2014-04-29 19:07 - 2014-04-29 19:07 - 00000000 ____D () C:\Users\s1u\AppData\Local\Greenshot
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Greenshot
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\Program Files\Greenshot
2014-04-29 18:59 - 2014-04-29 18:59 - 01311563 _____ (Greenshot ) C:\Users\s1u\Downloads\Greenshot-INSTALLER-1.1.8.35.exe
2014-04-25 21:32 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-25 21:30 - 2014-04-25 21:31 - 01365865 _____ () C:\Users\s1u\Downloads\AdwCleaner(1).exe
2014-04-25 21:24 - 2014-04-25 21:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-25 21:23 - 2014-04-30 17:43 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-25 19:01 - 2013-12-21 11:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-25 19:01 - 2013-12-21 10:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-25 18:58 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-25 18:58 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-25 18:58 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-25 18:58 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-25 18:58 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-25 18:58 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-25 18:58 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-25 18:58 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-25 18:58 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-25 18:58 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-25 18:58 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-25 18:58 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-25 18:58 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-25 18:58 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-25 18:58 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-25 18:58 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-25 18:58 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-25 18:58 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-25 18:58 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-25 18:58 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-25 18:58 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-25 18:58 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-25 18:58 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-25 18:58 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-25 18:58 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-25 18:58 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-25 18:58 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-25 18:58 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-25 18:58 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-25 18:58 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-25 18:58 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-25 18:58 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-25 18:58 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-25 18:58 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-25 18:58 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-25 18:58 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-25 18:58 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-25 18:58 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-25 18:58 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-25 18:58 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-25 18:58 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-04-25 18:58 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-04-25 18:58 - 2013-12-25 01:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-04-25 18:58 - 2013-12-25 00:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-04-25 18:58 - 2013-12-06 04:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-04-25 18:58 - 2013-12-06 04:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-04-25 18:58 - 2013-12-06 04:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-04-25 18:58 - 2013-12-06 04:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-04-25 18:58 - 2013-11-26 10:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-04-25 18:58 - 2013-11-23 00:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-25 18:57 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-25 18:57 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-25 18:57 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-25 18:57 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-25 18:57 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-25 18:57 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-25 18:57 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-04-25 18:57 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-04-25 18:57 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-04-25 18:57 - 2013-11-27 03:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-04-25 18:53 - 2013-10-19 04:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-04-25 18:53 - 2013-10-19 03:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-04-23 19:59 - 2014-05-05 17:17 - 00002856 _____ () C:\Windows\setupact.log
2014-04-23 19:59 - 2014-04-23 19:59 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-20 11:03 - 2014-03-21 21:43 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-04-20 11:03 - 2014-03-21 21:43 - 00033568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-04-13 18:32 - 2014-04-13 18:32 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-04-13 14:11 - 2014-04-13 14:11 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-04-11 20:56 - 2014-04-11 20:56 - 04464256 _____ (Avira Operations GmbH & Co. KG) C:\Users\s1u\Downloads\avira_de_av___ws.exe

==================== One Month Modified Files and Folders =======

2014-05-05 22:32 - 2014-05-05 22:31 - 02063872 _____ (Farbar) C:\Users\s1u\Downloads\FRST64 (1).exe
2014-05-05 22:32 - 2014-05-05 18:57 - 00012622 _____ () C:\Users\s1u\Downloads\FRST.txt
2014-05-05 22:32 - 2014-05-05 18:57 - 00000000 ____D () C:\FRST
2014-05-05 22:32 - 2009-07-14 06:45 - 00009904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-05 22:32 - 2009-07-14 06:45 - 00009904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-05 22:16 - 2012-10-22 20:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-05 21:42 - 2013-12-03 23:26 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-05 20:21 - 2014-04-29 21:25 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-05 19:30 - 2012-10-22 20:07 - 01533451 _____ () C:\Windows\WindowsUpdate.log
2014-05-05 19:00 - 2014-05-05 18:58 - 00036766 _____ () C:\Users\s1u\Downloads\Addition.txt
2014-05-05 18:56 - 2014-05-05 18:56 - 02063872 _____ (Farbar) C:\Users\s1u\Downloads\FRST64.exe
2014-05-05 17:17 - 2014-04-23 19:59 - 00002856 _____ () C:\Windows\setupact.log
2014-05-05 17:17 - 2013-12-03 23:26 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-05 17:17 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-02 06:45 - 2012-10-24 12:49 - 00490618 _____ () C:\Windows\PFRO.log
2014-05-02 06:43 - 2013-12-22 17:57 - 00000000 ____D () C:\AdwCleaner
2014-05-02 06:35 - 2014-05-02 06:35 - 01310621 _____ () C:\Users\s1u\Downloads\adwcleaner(2).exe
2014-05-01 20:41 - 2014-05-01 20:41 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Mozilla
2014-05-01 20:40 - 2014-05-01 20:40 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-01 20:40 - 2014-05-01 20:40 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-01 20:40 - 2014-05-01 20:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-01 20:40 - 2014-05-01 20:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-01 20:39 - 2014-05-01 20:39 - 00283376 _____ (Mozilla) C:\Users\s1u\Downloads\Firefox Setup Stub 29.0.exe
2014-05-01 12:58 - 2009-07-14 19:58 - 02077766 _____ () C:\Windows\system32\perfh007.dat
2014-05-01 12:58 - 2009-07-14 19:58 - 00602488 _____ () C:\Windows\system32\perfc007.dat
2014-05-01 12:58 - 2009-07-14 07:13 - 00006248 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-01 12:42 - 2014-05-01 12:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune
2014-05-01 12:42 - 2014-05-01 12:42 - 00000000 ____D () C:\Program Files (x86)\HD Tune
2014-05-01 12:41 - 2014-05-01 12:41 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (3).exe
2014-05-01 12:41 - 2014-05-01 12:41 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (2).exe
2014-05-01 12:40 - 2014-05-01 12:40 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255.exe
2014-05-01 12:40 - 2014-05-01 12:40 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (1).exe
2014-04-30 17:43 - 2014-04-25 21:23 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-30 17:39 - 2013-01-27 14:39 - 00001606 _____ () C:\Windows\wininit.ini
2014-04-30 17:38 - 2013-10-22 20:24 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-29 22:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Registration
2014-04-29 21:31 - 2014-04-29 21:29 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-29 21:30 - 2014-04-29 21:30 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-29 21:30 - 2014-04-29 21:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-29 21:29 - 2014-04-29 21:29 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-29 21:29 - 2014-04-29 21:29 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-04-29 21:29 - 2012-10-22 21:35 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-29 21:27 - 2014-04-29 21:27 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-29 21:26 - 2012-10-22 21:26 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-29 19:28 - 2014-04-29 19:26 - 88882192 _____ (AVAST Software) C:\Users\s1u\Downloads\avast_free_antivirus_setup_9_0_2018.exe
2014-04-29 19:21 - 2014-04-29 19:21 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-29 19:21 - 2014-04-29 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-29 19:21 - 2014-04-29 19:21 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-29 19:21 - 2012-10-22 21:23 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-29 19:20 - 2014-04-29 19:20 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\s1u\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-29 19:07 - 2014-04-29 19:07 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Greenshot
2014-04-29 19:07 - 2014-04-29 19:07 - 00000000 ____D () C:\Users\s1u\AppData\Local\Greenshot
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Greenshot
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\Program Files\Greenshot
2014-04-29 18:59 - 2014-04-29 18:59 - 01311563 _____ (Greenshot ) C:\Users\s1u\Downloads\Greenshot-INSTALLER-1.1.8.35.exe
2014-04-29 18:18 - 2012-10-22 20:36 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-29 18:18 - 2012-10-22 20:36 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-29 18:18 - 2012-10-22 20:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-27 10:46 - 2013-12-03 23:27 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-25 21:34 - 2012-10-22 20:28 - 00000000 ___RD () C:\Users\s1u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-25 21:31 - 2014-04-25 21:30 - 01365865 _____ () C:\Users\s1u\Downloads\AdwCleaner(1).exe
2014-04-25 21:28 - 2012-10-29 16:11 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-25 21:24 - 2014-04-25 21:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-25 19:22 - 2009-07-14 06:45 - 02254848 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-25 19:14 - 2013-06-25 23:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-25 19:04 - 2013-12-11 11:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-25 19:01 - 2013-12-11 12:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-25 19:00 - 2013-12-11 12:09 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-25 19:00 - 2013-12-11 12:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-23 19:59 - 2014-04-23 19:59 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-20 11:25 - 2013-03-21 15:03 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-04-20 11:19 - 2013-12-03 16:36 - 00000000 ____D () C:\Users\s1u\AppData\Local\NVIDIA Corporation
2014-04-20 11:18 - 2013-10-22 18:50 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-04-13 18:32 - 2014-04-13 18:32 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-04-13 14:11 - 2014-04-13 14:11 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-04-13 14:11 - 2012-11-09 17:29 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Foxit Software
2014-04-11 20:56 - 2014-04-11 20:56 - 04464256 _____ (Avira Operations GmbH & Co. KG) C:\Users\s1u\Downloads\avira_de_av___ws.exe
2014-04-06 17:06 - 2012-10-25 09:25 - 00000000 ____D () C:\Users\Hang

Some content of TEMP:
====================
C:\Users\s1u\AppData\Local\Temp\avgnt.exe
C:\Users\s1u\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\s1u\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-01 18:01

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-05-2014 02
Ran by s1u at 2014-05-05 22:51:02
Running from C:\Users\s1u\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe Anchor Service CS3 (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Asset Services CS3 (x32 Version: 3 - Adobe Systems Incorporated) Hidden
Adobe Bridge CS3 (x32 Version: 2 - Adobe Systems Incorporated) Hidden
Adobe Bridge Start Meeting (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Camera Raw 4.0 (x32 Version: 4.0 - Adobe Systems Incorporated) Hidden
Adobe CMaps (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color - Photoshop Specific (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color Common Settings (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color EU Recommended Settings (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color JA Extra Settings (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color NA Extra Settings (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Default Language CS3 (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Device Central CS3 (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe ExtendScript Toolkit 2 (x32 Version: 2.0 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Fonts All (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Help Viewer CS3 (x32 Version: 1 - Adobe Systems Incorporated) Hidden
Adobe Linguistics CS3 (x32 Version: 3.0.0 - Adobe Systems Incorporated) Hidden
Adobe PDF Library Files (x32 Version: 8.0 - Adobe Systems Incorporated) Hidden
Adobe Photoshop CS3 (HKLM-x32\...\Adobe_5f143314a5d434c8511097393d17397) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Photoshop CS3 (x32 Version: 10 - Adobe Systems Incorporated) Hidden
Adobe Setup (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Stock Photos CS3 (x32 Version: 1.5 - Adobe Systems Incorporated) Hidden
Adobe Type Support (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Update Manager CS3 (x32 Version: 5.1.0 - Adobe Systems Incorporated) Hidden
Adobe Version Cue CS3 Client (x32 Version: 3 - Adobe Systems Incorporated) Hidden
Adobe WinSoft Linguistics Plugin (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe XMP Panels CS3 (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.0.3661 - CDBurnerXP)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Pro (HKLM-x32\...\DAEMON Tools Pro) (Version: 5.2.0.0348 - DT Soft Ltd)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{AC53C6A4-1CC4-48A5-91F3-565BB7978B22}) (Version:  - Microsoft)
doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version:  - Softland)
Dropbox (HKCU\...\Dropbox) (Version: 2.0.22 - Dropbox, Inc.)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 1.2.75.126 - Foxit Corporation)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.1.4.217 - Foxit Corporation)
Free Screen To Video V 2.0 (HKLM-x32\...\Free Screen To Video_is1) (Version: 2.0.0.0 - Koyote Soft)
Free YouTube Download version 3.2.0.128 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.0.128 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.11.37.1212 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.37.1212 - DVDVideoSoft Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Greenshot 1.1.8.35 (HKLM\...\Greenshot_is1) (Version: 1.1.8.35 - Greenshot)
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version:  - EFD Software)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (HKLM\...\{0A8BEF69-0DD7-4A8F-9AED-0CB91BEBCB58}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8500 A910 Hilfe (HKLM-x32\...\{871B2A9D-0F12-44B3-88C1-E0CB10A232E4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HyperCam 3 (HKLM-x32\...\HyperCam 3 3.5.1210.30) (Version: 3.5.1210.30 - Solveig Multimedia)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Lexware büro easy 2012 Vorteilsedition (HKLM-x32\...\{41581163-87FB-4E8E-92C2-10366F8A3291}) (Version: 25.40.04.0060 - Haufe-Lexware GmbH & Co.KG)
Lexware Elster (HKLM-x32\...\{9EFF1D7C-C4B0-4DEF-965C-261CB9604CD9}) (Version: 12.03.00.0188 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (HKLM-x32\...\{F3C2ECAA-1B4D-4B75-9105-106B0D03EF02}) (Version: 2.80.00.0007 - Haufe-Lexware GmbH & Co.KG)
Lexware online banking (HKLM-x32\...\{CB21905F-BE58-4DC9-8FC1-6EE2EA210423}) (Version: 16.00.00.0001 - Haufe-Lexware GmbH & Co.KG)
Mafia Game (HKLM-x32\...\Mafia Game) (Version:  - )
Mafia II (HKLM-x32\...\Steam App 50130) (Version:  - 2K Czech)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Messenger Plus! for Skype (HKLM-x32\...\Messenger Plus! for Skype) (Version: 1.5.0.121 - Yuna Software)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Access Runtime 2010 (HKLM\...\Office14.AccessRT) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0 - Microsoft Corporation) Hidden
Microsoft Office Access Runtime 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Runtime MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 29.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0 (x86 de)) (Version: 29.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Nero Burning Core (x32 Version: 15.0.25001 - Nero AG) Hidden
Nero Burning ROM (x32 Version: 15.0.25001 - Nero AG) Hidden
Nero Burning ROM 2014 (HKLM-x32\...\{DEBA969E-2E0A-431B-8F81-E651C6C0F852}) (Version: 15.0.03600 - Nero AG)
Nero Burning ROM Help (CHM) (x32 Version: 15.0.00021 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 11.0.16700 - Nero AG) Hidden
Nero ControlCenter Help (CHM) (x32 Version: 15.0.00015 - Nero AG) Hidden
Nero Core Components (x32 Version: 11.0.23200 - Nero AG) Hidden
Nero SharedVideoCodecs (x32 Version: 1.0.15005 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.13300.42.0 - Nero AG) Hidden
NVIDIA GeForce Experience 2.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.82 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.151.1095 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 12.4.55 (Version: 12.4.55 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden
NVIDIA Update 12.4.55 (Version: 12.4.55 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 12.4.55 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.22 (Version: 1.2.22 - NVIDIA Corporation) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
PDF Settings (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )
PosteRazor (HKLM-x32\...\PosteRazor_is1) (Version: 1.5 - Alessandro Portale)
Prerequisite installer (x32 Version: 15.0.0005 - Nero AG) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{08798025-46CC-4EB0-A0B3-4E25DA3BBC10}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 1.8.323 - NVIDIA Corporation) Hidden
Skype™ 6.3 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.107 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
SUCCESSCONTROL CRM (HKLM-x32\...\{A5DF065B-8BB2-429D-8D3C-DAD29E597AC7}) (Version: 4.1.1 - Steppat GmbH  - D 55743 Idar-Oberstein)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{FEF4C57D-0975-4D3C-ACC7-DCD038C3788F}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{79C725A1-3964-421C-A528-78C1C083C7C7}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.AccessRT_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.AccessRT_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.AccessRT_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{B6AD7E27-012A-4B63-82BA-AF62893E5435}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{07DC9C6C-E916-4F42-8677-716930ED0393}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.AccessRT_{8A6BDA63-4D23-4485-A466-8979E10BCF49}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.AccessRT_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.AccessRT_{77374F16-2DC6-4EEF-AFAD-C59FDA2E010D}) (Version:  - Microsoft)
VLC media player 2.0.8 (HKLM-x32\...\VLC media player) (Version: 2.0.8 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Utils (HKLM-x32\...\Windows Utils) (Version:  - )

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-12-11 15:28 - 00450660 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com
127.0.0.1        www.100sexlinks.com
127.0.0.1        100sexlinks.com
127.0.0.1        10sek.com
127.0.0.1        www.10sek.com
127.0.0.1        www.1-2005-search.com
127.0.0.1        1-2005-search.com
127.0.0.1        123fporn.info
127.0.0.1        www.123fporn.info
127.0.0.1        123haustiereundmehr.com
127.0.0.1        www.123haustiereundmehr.com
127.0.0.1        123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {1CA831DB-5615-443A-A409-8464BC0D96BE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-03] (Google Inc.)
Task: {30660999-058B-429D-84CA-493CAC76EEB7} - \Plus-HD-2.2-codedownloader No Task File <==== ATTENTION
Task: {3BB53CA0-CEC2-47DD-9639-7E11FBC592CC} - \Plus-HD-2.2-chromeinstaller No Task File <==== ATTENTION
Task: {406A55F4-1C1C-4677-8629-568F1409802C} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [2011-10-28] (Hewlett-Packard)
Task: {4E715A28-C125-4988-9F62-8BBF1484471A} - \Plus-HD-2.2-updater No Task File <==== ATTENTION
Task: {667F6DAC-F8B7-404F-815B-AC306D9BDF96} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-29] (AVAST Software)
Task: {758C00E5-2032-4083-98B2-43543C182D69} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29] (Adobe Systems Incorporated)
Task: {7C37916D-E8ED-45F2-8501-88E2E94250AC} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {99C0EDAB-1440-4026-BDB5-DF9A1E4AC4C4} - \Plus-HD-2.2-enabler No Task File <==== ATTENTION
Task: {A19B3A43-C8B7-4652-B7AE-76CB8238990F} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {AE555A96-19BF-445F-A9AA-3B6DC56311DA} - \Plus-HD-2.2-firefoxinstaller No Task File <==== ATTENTION
Task: {CEE2720C-8D88-4038-A753-3AE8B49C10F6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-03] (Google Inc.)
Task: {DAA9D0C8-AD73-43C8-BCFC-62858F46CEE8} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {F6FEED0C-4FA6-42CA-8AA2-28DF15C0C4E5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-12-03 23:42 - 2013-11-11 17:02 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-02 06:26 - 2014-05-02 06:26 - 02252800 _____ () C:\Program Files\AVAST Software\Avast\defs\14050100\algo.dll
2014-05-05 17:18 - 2014-05-05 17:18 - 02252800 _____ () C:\Program Files\AVAST Software\Avast\defs\14050500\algo.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-04-29 21:28 - 2014-04-29 21:28 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-04-27 10:46 - 2014-04-24 02:33 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\chrome_elf.dll
2014-04-27 10:46 - 2014-04-24 02:33 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\libglesv2.dll
2014-04-27 10:46 - 2014-04-24 02:33 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\libegl.dll
2014-04-27 10:46 - 2014-04-24 02:33 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\pdf.dll
2014-04-27 10:46 - 2014-04-24 02:33 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll
2014-04-27 10:46 - 2014-04-24 02:33 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ffmpegsumo.dll
2014-04-27 10:46 - 2014-04-24 02:33 - 13692232 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^Users^s1u^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^s1u^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk => C:\Windows\pss\OpenOffice.org 3.4.1.lnk.Startup
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: DAEMON Tools Pro Agent => "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
MSCONFIG\startupreg: HP Officejet Pro 8500 A910 (NET) => "C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\ScanToPCActivationApp.exe" -deviceID "CN09FAM2R1:NW" -scfn "HP Officejet Pro 8500 A910 (NET)" -AutoStart 1
MSCONFIG\startupreg: IntelliPoint => "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: LexwareInfoService => C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart
MSCONFIG\startupreg: MessengerPlusForSkypeService => "C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe"
MSCONFIG\startupreg: Mikogo => "C:\Users\s1u\AppData\Roaming\Mikogo 4\mikogo-host.exe" -asp
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Steam => "D:\Steam\Steam.exe" -silent
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Java\jre6\bin\jusched.exe"

==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/05/2014 07:47:44 PM) (Source: System Restore) (User: )
Description: Der geplante Wiederherstellungspunkt konnte nicht erstellt werden. Zusätzliche Informationen: (0x80042308).

Error: (05/05/2014 07:47:44 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80042308).

Error: (05/05/2014 05:27:33 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (05/02/2014 06:46:54 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_stisvc, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: wiaservc.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7ca0f
Ausnahmecode: 0x40000015
Fehleroffset: 0x0000000000047a6b
ID des fehlerhaften Prozesses: 0x968
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_stisvc0
Pfad der fehlerhaften Anwendung: svchost.exe_stisvc1
Pfad des fehlerhaften Moduls: svchost.exe_stisvc2
Berichtskennung: svchost.exe_stisvc3

Error: (05/01/2014 06:04:18 PM) (Source: System Restore) (User: )
Description: Der geplante Wiederherstellungspunkt konnte nicht erstellt werden. Zusätzliche Informationen: (0x80042308).

Error: (05/01/2014 06:04:18 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80042308).

Error: (05/01/2014 03:45:31 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde nicht erfolgreich abgeschlossen, da eine Schattenkopie nicht erstellt werden konnte. Löschen Sie auf dem zu sichernden Laufwerk nicht benötigte Dateien, um Speicherplatz freizugeben, und wiederholen Sie den Vorgang.

Error: (05/01/2014 01:18:49 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde nicht erfolgreich abgeschlossen, da eine Schattenkopie nicht erstellt werden konnte. Löschen Sie auf dem zu sichernden Laufwerk nicht benötigte Dateien, um Speicherplatz freizugeben, und wiederholen Sie den Vorgang.

Error: (05/01/2014 01:07:55 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde nicht erfolgreich abgeschlossen, da eine Schattenkopie nicht erstellt werden konnte. Löschen Sie auf dem zu sichernden Laufwerk nicht benötigte Dateien, um Speicherplatz freizugeben, und wiederholen Sie den Vorgang.

Error: (05/01/2014 00:57:59 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.


System errors:
=============
Error: (05/05/2014 07:47:41 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden aufgrund eines E/A-Fehlers auf Volume "C:" abgebrochen.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.

Error: (05/05/2014 07:47:07 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.


Microsoft Office Sessions:
=========================
Error: (05/05/2014 07:47:44 PM) (Source: System Restore)(User: )
Description: 0x80042308

Error: (05/05/2014 07:47:44 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80042308

Error: (05/05/2014 05:27:33 PM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (05/02/2014 06:46:54 AM) (Source: Application Error)(User: )
Description: svchost.exe_stisvc6.1.7600.163854a5bc3c1wiaservc.dll6.1.7601.175144ce7ca0f400000150000000000047a6b96801cf65c1862e960bC:\Windows\system32\svchost.exec:\windows\system32\wiaservc.dllc83bc486-d1b4-11e3-9a66-001d723f50d0

Error: (05/01/2014 06:04:18 PM) (Source: System Restore)(User: )
Description: 0x80042308

Error: (05/01/2014 06:04:18 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80042308

Error: (05/01/2014 03:45:31 PM) (Source: Windows Backup)(User: )
Description: Bei der Erstellung einer Schattenkopie ist eine Zeitüberschreitung aufgetreten. Wiederholen Sie diesen Vorgang. (0x81000101)

Error: (05/01/2014 01:18:49 PM) (Source: Windows Backup)(User: )
Description: Es konnte keine Schattenkopie erstellt werden. Weitere Informationen finden Sie in den Anwendungsereignisprotokollen "VSS" und "SPP". (0x81000019)

Error: (05/01/2014 01:07:55 PM) (Source: Windows Backup)(User: )
Description: Es konnte keine Schattenkopie erstellt werden. Weitere Informationen finden Sie in den Anwendungsereignisprotokollen "VSS" und "SPP". (0x81000019)

Error: (05/01/2014 00:57:59 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000


CodeIntegrity Errors:
===================================
  Date: 2014-04-06 15:40:02.885
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-06 15:40:02.885
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-06 15:40:02.885
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-06 15:40:02.854
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-06 15:40:02.854
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-06 15:40:02.854
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-02 19:50:35.901
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-02 19:50:35.901
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-02 19:50:35.901
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-04-02 19:50:35.838
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 47%
Total physical RAM: 4090.88 MB
Available physical RAM: 2142.65 MB
Total Pagefile: 8179.93 MB
Available Pagefile: 5870.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:117.33 GB) (Free:40.19 GB) NTFS
Drive d: () (Fixed) (Total:180.66 GB) (Free:143.9 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 6A2D4670)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=117 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=181 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber 06.05.2014 16:35
Öffne mal bitte Malwarebytes, Reiter Logs. Bitte das Log mit dem Dropper-Fund posten.

s1uu 06.05.2014 18:48
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 29.04.2014
Scan Time: 21:50:59
Logfile: text.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.04.29.07
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: s1u

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 279330
Time Elapsed: 18 min, 38 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.CrossRider.A, C:\Users\s1u\AppData\Local\Google\Chrome\User Data\default\extensions\kfakeonomonapccoamcmdgpoaicnpnoo, Quarantined, [75a6fb35c6b549ed84a93b2e976be31d],

Files: 1
PUP.Optional.OpenCandy, C:\Users\s1u\Desktop\PhotoScape_V3-6-5.exe, Quarantined, [6cafdc545724c670d64123358c789f61],

Physical Sectors: 0
(No malicious items detected)


(end)
also das kann ich mir jetzt ehrlich gesagt auch nicht erklären! Also dass des ein anderer virus ist



http://img5.fotos-hochladen.net/uplo...kq61nocdv3.jpg

schrauber 07.05.2014 13:18
Ich sehe genau das in den logs was auch im MBAM log steht, nur en bissl Adware.

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

s1uu 08.05.2014 22:04
Code:
# AdwCleaner v3.207 - Bericht erstellt am 08/05/2014 um 22:34:21
# Aktualisiert 05/05/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : s1u - S1U-PC
# Gestartet von : C:\Users\s1u\Downloads\adwcleaner(3).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16521


-\\ Mozilla Firefox v29.0 (de)

[ Datei : C:\Users\s1u\AppData\Roaming\Mozilla\Firefox\Profiles\vptphykd.default\prefs.js ]


-\\ Google Chrome v34.0.1847.131

[ Datei : C:\Users\s1u\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [35720 octets] - [22/12/2013 17:57:33]
AdwCleaner[R1].txt - [2365 octets] - [25/04/2014 21:31:26]
AdwCleaner[R2].txt - [1163 octets] - [02/05/2014 06:36:23]
AdwCleaner[R3].txt - [1283 octets] - [08/05/2014 22:27:46]
AdwCleaner[S0].txt - [35245 octets] - [22/12/2013 17:59:27]
AdwCleaner[S1].txt - [2430 octets] - [25/04/2014 21:33:59]
AdwCleaner[S2].txt - [1225 octets] - [02/05/2014 06:43:43]
AdwCleaner[S3].txt - [1205 octets] - [08/05/2014 22:34:21]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1265 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by s1u on 08.05.2014 at 22:41:17,64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully stopped: [Service] msgplusservice
Successfully deleted: [Service] msgplusservice



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{37211D63-CCE9-4780-B182-96538CFC6FED}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{8B9C4F32-044E-491C-893E-362CB8A679D5}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CBC3E05C-F841-452A-A600-E8D8BBEA63D9}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CBC3E05D-F841-452A-A600-E8D8BBEA63DA}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CF2BF214-9D1E-4803-9AEB-38552615FD40}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yuna software
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\yuna software
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.animationpackage
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\msgplusforskype.skinpack
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\messenger plus! for skype_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\messenger plus! for skype_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\plusskypeservice_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\plusskypeservice_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\messenger plus! for skype



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\messenger plus! for skype"
Successfully deleted: [Folder] "C:\Program Files (x86)\yuna software"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.05.2014 at 22:55:18,99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-05-2014
Ran by s1u (administrator) on S1U-PC on 08-05-2014 23:03:39
Running from C:\Users\s1u\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Foxit Corporation) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Thisisu) C:\Users\s1u\Downloads\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1225920 2014-04-02] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2201032 2014-04-02] (NVIDIA Corporation)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [495616 2014-03-23] (Greenshot)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [20131121] => C:\Program Files\AVAST Software\Avast\setup\emupdate\1d9812b0-7ec9-4d58-beeb-0665c0a351b1.exe /check
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3873704 2014-04-29] (AVAST Software)
HKU\S-1-5-21-758192491-693762671-1294062596-1001\...\MountPoints2: {1bddf693-60b3-11e2-9fee-001d723f50d0} - F:\splash_screen.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startzentrale.de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4D3E729883B0CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2417} URL =
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
Toolbar: HKLM-x32 - No Name - !{5018CFD2-804D-4C99-9F81-25EAEA2769DE} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} -  No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 195.234.128.7 195.234.128.16

FireFox:
========
FF ProfilePath: C:\Users\s1u\AppData\Roaming\Mozilla\Firefox\Profiles\vptphykd.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-29]

Chrome:
=======
CHR HomePage:
CHR StartupUrls: "hxxp://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\s1u\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-03]
CHR Extension: (WASP - Web Analytics Solution Profiler) - C:\Users\s1u\AppData\Local\Google\Chrome\User Data\Default\Extensions\niaoghengfohplclhbjnjheodgkejpih [2014-04-06]
CHR Extension: (Google Wallet) - C:\Users\s1u\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-03]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-04-29]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-29] (AVAST Software)
R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [239680 2014-02-19] (Foxit Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1615192 2014-04-02] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [20541216 2014-04-02] (NVIDIA Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-29] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-29] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-04-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-29] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-02-08] (DT Soft Ltd)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-08] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-21] (NVIDIA Corporation)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-08 22:55 - 2014-05-08 22:55 - 00002332 _____ () C:\Users\s1u\Desktop\JRT.txt
2014-05-08 22:41 - 2014-05-08 22:41 - 00000000 ____D () C:\Windows\ERUNT
2014-05-08 22:40 - 2014-05-08 22:40 - 01016261 _____ (Thisisu) C:\Users\s1u\Downloads\JRT.exe
2014-05-08 22:25 - 2014-05-08 22:25 - 01316991 _____ () C:\Users\s1u\Downloads\adwcleaner(3).exe
2014-05-08 18:47 - 2014-05-08 18:47 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00001303 _____ () C:\Users\Public\Desktop\Ashampoo Burning Studio FREE.lnk
2014-05-08 18:36 - 2014-05-08 18:36 - 00001268 _____ () C:\Users\Public\Desktop\250 Visitenkarten 9,99 EUR.lnk
2014-05-08 18:36 - 2014-05-08 18:36 - 00000214 _____ () C:\Users\Public\Desktop\Your Software Deals.url
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 ____D () C:\Users\s1u\AppData\Local\ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 ____D () C:\Program Files (x86)\Ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 _____ () C:\Users\Public\Desktop\dummy.txt
2014-05-08 18:35 - 2014-05-08 18:35 - 33649640 _____ (Ashampoo GmbH & Co. KG ) C:\Users\s1u\Downloads\ashampoo_burning_studio_free_1.14.5_sm.exe
2014-05-06 20:17 - 2014-05-06 20:17 - 00010881 _____ () C:\Users\s1u\Desktop\mustersatz.odt
2014-05-06 19:46 - 2014-05-06 19:46 - 00001285 _____ () C:\Users\s1u\Desktop\text.txt
2014-05-05 22:31 - 2014-05-05 22:32 - 02063872 _____ (Farbar) C:\Users\s1u\Downloads\FRST64 (1).exe
2014-05-05 18:58 - 2014-05-05 22:51 - 00035807 _____ () C:\Users\s1u\Downloads\Addition.txt
2014-05-05 18:57 - 2014-05-08 23:03 - 00012339 _____ () C:\Users\s1u\Downloads\FRST.txt
2014-05-05 18:57 - 2014-05-08 23:03 - 00000000 ____D () C:\FRST
2014-05-05 18:56 - 2014-05-05 18:56 - 02063872 _____ (Farbar) C:\Users\s1u\Downloads\FRST64.exe
2014-05-02 06:35 - 2014-05-02 06:35 - 01310621 _____ () C:\Users\s1u\Downloads\adwcleaner(2).exe
2014-05-01 20:41 - 2014-05-01 20:41 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Mozilla
2014-05-01 20:40 - 2014-05-01 20:40 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-01 20:40 - 2014-05-01 20:40 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-01 20:40 - 2014-05-01 20:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-01 20:40 - 2014-05-01 20:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-01 20:39 - 2014-05-01 20:39 - 00283376 _____ (Mozilla) C:\Users\s1u\Downloads\Firefox Setup Stub 29.0.exe
2014-05-01 12:42 - 2014-05-01 12:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune
2014-05-01 12:42 - 2014-05-01 12:42 - 00000000 ____D () C:\Program Files (x86)\HD Tune
2014-05-01 12:41 - 2014-05-01 12:41 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (3).exe
2014-05-01 12:41 - 2014-05-01 12:41 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (2).exe
2014-05-01 12:40 - 2014-05-01 12:40 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255.exe
2014-05-01 12:40 - 2014-05-01 12:40 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (1).exe
2014-04-29 21:30 - 2014-04-29 21:30 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-29 21:30 - 2014-04-29 21:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-29 21:29 - 2014-05-08 18:43 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-29 21:29 - 2014-04-29 21:29 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-29 21:29 - 2014-04-29 21:29 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-04-29 21:27 - 2014-04-29 21:27 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-29 21:25 - 2014-05-08 22:58 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-29 19:26 - 2014-04-29 19:28 - 88882192 _____ (AVAST Software) C:\Users\s1u\Downloads\avast_free_antivirus_setup_9_0_2018.exe
2014-04-29 19:21 - 2014-04-29 19:21 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-29 19:21 - 2014-04-29 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-29 19:21 - 2014-04-29 19:21 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-29 19:21 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-29 19:21 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-29 19:21 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-29 19:20 - 2014-04-29 19:20 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\s1u\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-29 19:07 - 2014-04-29 19:07 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Greenshot
2014-04-29 19:07 - 2014-04-29 19:07 - 00000000 ____D () C:\Users\s1u\AppData\Local\Greenshot
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Greenshot
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\Program Files\Greenshot
2014-04-29 18:59 - 2014-04-29 18:59 - 01311563 _____ (Greenshot ) C:\Users\s1u\Downloads\Greenshot-INSTALLER-1.1.8.35.exe
2014-04-25 21:32 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-04-25 21:30 - 2014-04-25 21:31 - 01365865 _____ () C:\Users\s1u\Downloads\AdwCleaner(1).exe
2014-04-25 21:24 - 2014-04-25 21:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-25 21:23 - 2014-04-30 17:43 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-25 19:01 - 2013-12-21 11:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-25 19:01 - 2013-12-21 10:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-25 18:58 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-25 18:58 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-25 18:58 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-25 18:58 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-25 18:58 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-25 18:58 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-25 18:58 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-25 18:58 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-25 18:58 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-25 18:58 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-25 18:58 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-25 18:58 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-25 18:58 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-25 18:58 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-25 18:58 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-25 18:58 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-25 18:58 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-25 18:58 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-25 18:58 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-25 18:58 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-25 18:58 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-25 18:58 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-25 18:58 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-25 18:58 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-25 18:58 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-25 18:58 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-25 18:58 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-25 18:58 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-25 18:58 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-25 18:58 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-25 18:58 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-25 18:58 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-25 18:58 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-25 18:58 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-25 18:58 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-25 18:58 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-25 18:58 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-25 18:58 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-25 18:58 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-25 18:58 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-25 18:58 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-04-25 18:58 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-04-25 18:58 - 2013-12-25 01:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-04-25 18:58 - 2013-12-25 00:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-04-25 18:58 - 2013-12-06 04:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-04-25 18:58 - 2013-12-06 04:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-04-25 18:58 - 2013-12-06 04:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-04-25 18:58 - 2013-12-06 04:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-04-25 18:58 - 2013-11-26 10:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-04-25 18:58 - 2013-11-23 00:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-25 18:57 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-25 18:57 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-25 18:57 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-25 18:57 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-25 18:57 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-25 18:57 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-25 18:57 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-25 18:57 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-04-25 18:57 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-04-25 18:57 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-04-25 18:57 - 2013-11-27 03:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-04-25 18:57 - 2013-11-27 03:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-04-25 18:53 - 2013-10-19 04:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-04-25 18:53 - 2013-10-19 03:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-04-23 19:59 - 2014-05-08 22:36 - 00003696 _____ () C:\Windows\setupact.log
2014-04-23 19:59 - 2014-04-23 19:59 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-20 11:03 - 2014-03-21 21:43 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-04-20 11:03 - 2014-03-21 21:43 - 00033568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-04-13 18:32 - 2014-04-13 18:32 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-04-13 14:11 - 2014-04-13 14:11 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-04-11 20:56 - 2014-04-11 20:56 - 04464256 _____ (Avira Operations GmbH & Co. KG) C:\Users\s1u\Downloads\avira_de_av___ws.exe

==================== One Month Modified Files and Folders =======

2014-05-08 23:04 - 2014-05-05 18:57 - 00012339 _____ () C:\Users\s1u\Downloads\FRST.txt
2014-05-08 23:03 - 2014-05-05 18:57 - 00000000 ____D () C:\FRST
2014-05-08 22:58 - 2014-04-29 21:25 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-08 22:55 - 2014-05-08 22:55 - 00002332 _____ () C:\Users\s1u\Desktop\JRT.txt
2014-05-08 22:42 - 2013-12-03 23:26 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-08 22:42 - 2013-12-03 23:26 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-08 22:41 - 2014-05-08 22:41 - 00000000 ____D () C:\Windows\ERUNT
2014-05-08 22:40 - 2014-05-08 22:40 - 01016261 _____ (Thisisu) C:\Users\s1u\Downloads\JRT.exe
2014-05-08 22:36 - 2014-04-23 19:59 - 00003696 _____ () C:\Windows\setupact.log
2014-05-08 22:36 - 2012-10-24 12:49 - 00490928 _____ () C:\Windows\PFRO.log
2014-05-08 22:36 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-08 22:34 - 2013-12-22 17:57 - 00000000 ____D () C:\AdwCleaner
2014-05-08 22:34 - 2012-10-22 20:07 - 01574670 _____ () C:\Windows\WindowsUpdate.log
2014-05-08 22:34 - 2009-07-14 06:45 - 00009904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-08 22:34 - 2009-07-14 06:45 - 00009904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-08 22:25 - 2014-05-08 22:25 - 01316991 _____ () C:\Users\s1u\Downloads\adwcleaner(3).exe
2014-05-08 22:16 - 2012-10-22 20:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-08 18:47 - 2014-05-08 18:47 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Ashampoo
2014-05-08 18:43 - 2014-04-29 21:29 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-08 18:36 - 2014-05-08 18:36 - 00001303 _____ () C:\Users\Public\Desktop\Ashampoo Burning Studio FREE.lnk
2014-05-08 18:36 - 2014-05-08 18:36 - 00001268 _____ () C:\Users\Public\Desktop\250 Visitenkarten 9,99 EUR.lnk
2014-05-08 18:36 - 2014-05-08 18:36 - 00000214 _____ () C:\Users\Public\Desktop\Your Software Deals.url
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 ____D () C:\Users\s1u\AppData\Local\ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 ____D () C:\Program Files (x86)\Ashampoo
2014-05-08 18:36 - 2014-05-08 18:36 - 00000000 _____ () C:\Users\Public\Desktop\dummy.txt
2014-05-08 18:35 - 2014-05-08 18:35 - 33649640 _____ (Ashampoo GmbH & Co. KG ) C:\Users\s1u\Downloads\ashampoo_burning_studio_free_1.14.5_sm.exe
2014-05-08 18:21 - 2012-12-20 17:18 - 00000000 ____D () C:\Program Files\CDBurnerXP
2014-05-08 18:18 - 2012-12-20 17:18 - 00001742 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-05-08 18:18 - 2012-12-20 17:18 - 00001692 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-05-06 20:17 - 2014-05-06 20:17 - 00010881 _____ () C:\Users\s1u\Desktop\mustersatz.odt
2014-05-06 19:46 - 2014-05-06 19:46 - 00001285 _____ () C:\Users\s1u\Desktop\text.txt
2014-05-05 22:51 - 2014-05-05 18:58 - 00035807 _____ () C:\Users\s1u\Downloads\Addition.txt
2014-05-05 22:32 - 2014-05-05 22:31 - 02063872 _____ (Farbar) C:\Users\s1u\Downloads\FRST64 (1).exe
2014-05-05 18:56 - 2014-05-05 18:56 - 02063872 _____ (Farbar) C:\Users\s1u\Downloads\FRST64.exe
2014-05-02 06:35 - 2014-05-02 06:35 - 01310621 _____ () C:\Users\s1u\Downloads\adwcleaner(2).exe
2014-05-01 20:41 - 2014-05-01 20:41 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Mozilla
2014-05-01 20:40 - 2014-05-01 20:40 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-01 20:40 - 2014-05-01 20:40 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-01 20:40 - 2014-05-01 20:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-01 20:40 - 2014-05-01 20:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-01 20:39 - 2014-05-01 20:39 - 00283376 _____ (Mozilla) C:\Users\s1u\Downloads\Firefox Setup Stub 29.0.exe
2014-05-01 12:58 - 2009-07-14 19:58 - 02077766 _____ () C:\Windows\system32\perfh007.dat
2014-05-01 12:58 - 2009-07-14 19:58 - 00602488 _____ () C:\Windows\system32\perfc007.dat
2014-05-01 12:58 - 2009-07-14 07:13 - 00006248 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-01 12:42 - 2014-05-01 12:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune
2014-05-01 12:42 - 2014-05-01 12:42 - 00000000 ____D () C:\Program Files (x86)\HD Tune
2014-05-01 12:41 - 2014-05-01 12:41 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (3).exe
2014-05-01 12:41 - 2014-05-01 12:41 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (2).exe
2014-05-01 12:40 - 2014-05-01 12:40 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255.exe
2014-05-01 12:40 - 2014-05-01 12:40 - 00642632 _____ (EFD Software ) C:\Users\s1u\Downloads\hdtune_255 (1).exe
2014-04-30 17:43 - 2014-04-25 21:23 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-30 17:39 - 2013-01-27 14:39 - 00001606 _____ () C:\Windows\wininit.ini
2014-04-30 17:38 - 2013-10-22 20:24 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-29 22:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Registration
2014-04-29 21:30 - 2014-04-29 21:30 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-29 21:30 - 2014-04-29 21:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-29 21:29 - 2014-04-29 21:29 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-29 21:29 - 2014-04-29 21:29 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-29 21:29 - 2014-04-29 21:29 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-04-29 21:29 - 2012-10-22 21:35 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-29 21:27 - 2014-04-29 21:27 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-29 21:26 - 2012-10-22 21:26 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-29 19:28 - 2014-04-29 19:26 - 88882192 _____ (AVAST Software) C:\Users\s1u\Downloads\avast_free_antivirus_setup_9_0_2018.exe
2014-04-29 19:21 - 2014-04-29 19:21 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-29 19:21 - 2014-04-29 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-29 19:21 - 2014-04-29 19:21 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-29 19:21 - 2012-10-22 21:23 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-29 19:20 - 2014-04-29 19:20 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\s1u\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-29 19:07 - 2014-04-29 19:07 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Greenshot
2014-04-29 19:07 - 2014-04-29 19:07 - 00000000 ____D () C:\Users\s1u\AppData\Local\Greenshot
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Greenshot
2014-04-29 19:03 - 2014-04-29 19:03 - 00000000 ____D () C:\Program Files\Greenshot
2014-04-29 18:59 - 2014-04-29 18:59 - 01311563 _____ (Greenshot ) C:\Users\s1u\Downloads\Greenshot-INSTALLER-1.1.8.35.exe
2014-04-29 18:18 - 2012-10-22 20:36 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-29 18:18 - 2012-10-22 20:36 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-29 18:18 - 2012-10-22 20:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-27 10:46 - 2013-12-03 23:27 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-25 21:34 - 2012-10-22 20:28 - 00000000 ___RD () C:\Users\s1u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-25 21:31 - 2014-04-25 21:30 - 01365865 _____ () C:\Users\s1u\Downloads\AdwCleaner(1).exe
2014-04-25 21:28 - 2012-10-29 16:11 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-25 21:24 - 2014-04-25 21:24 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-25 19:22 - 2009-07-14 06:45 - 02254848 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-25 19:14 - 2013-06-25 23:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-25 19:04 - 2013-12-11 11:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-25 19:01 - 2013-12-11 12:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-04-25 19:00 - 2013-12-11 12:09 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-04-25 19:00 - 2013-12-11 12:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-04-23 19:59 - 2014-04-23 19:59 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-20 11:25 - 2013-03-21 15:03 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-04-20 11:19 - 2013-12-03 16:36 - 00000000 ____D () C:\Users\s1u\AppData\Local\NVIDIA Corporation
2014-04-20 11:18 - 2013-10-22 18:50 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-04-13 18:32 - 2014-04-13 18:32 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-04-13 14:11 - 2014-04-13 14:11 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-04-13 14:11 - 2012-11-09 17:29 - 00000000 ____D () C:\Users\s1u\AppData\Roaming\Foxit Software
2014-04-11 20:56 - 2014-04-11 20:56 - 04464256 _____ (Avira Operations GmbH & Co. KG) C:\Users\s1u\Downloads\avira_de_av___ws.exe

Some content of TEMP:
====================
C:\Users\s1u\AppData\Local\Temp\avgnt.exe
C:\Users\s1u\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\s1u\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-01 18:01

==================== End Of Log ============================
--- --- ---


Okay. - Und was is dieses Festplattenthema mit jedesmal F1 Drücken?

schrauber 09.05.2014 16:14
Festplatte verabschiedet sich sehr warscheinlich.

SeaTools for Windows - Download - Filepony
Damit mal die PLatte checken.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:43 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131