Polizeitrojaner mit weissem Bildschirm

suvannapum56

Ein Hilferuf an die Experten! Beim Download von Videos erscheint urplötzlich die offenbar
weitherum bekannte Warn-Erpressungswebsite, die meinen win7/64 PC in Geiselhaft nimmt.
Nur noch weisser Bildschirm und Mauszeiger. Habe auf meinem 2. PC eifrig gegoogelt und den Trojaner-Board.de-Rettungsanker entdeckt. Dank einem unglaublich klar und verständlich geschriebenen Beitrag im Forum von Leo /aharonov, habe ich als Neuling Mut gekriegt, das Hilfethema anzupacken und den frst64 scan durchzuführen, dessen Länge einem ja schon mulmig stimmt. Hier ist er:


Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2013 02
Ran by SYSTEM on 21-06-2013 17:45:05
Running from K:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1436224 2010-11-30] (Microsoft Corporation)
HKLM\...\Run: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [462400 2011-02-12] (Acronis)
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6548112 2000-01-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()
HKLM-x32\...\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1263512 2012-11-01] ()
HKLM-x32\...\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot [295072 2012-12-17] (RealNetworks, Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [adm_tray.exe] C:\Program Files (x86)\Acronis\DriveMonitor\adm_tray.exe [470120 2011-02-24] ()
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Steganos HotKeys] "C:\Program Files (x86)\Steganos Safe 14\SteganosHotKeyService.exe" [103424 2013-05-16] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE14 File Redirection Starter] "C:\Program Files (x86)\Steganos Safe 14\fredirstarter.exe" [17408 2013-05-16] (Steganos Software GmbH)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKU\Alfred\...\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.)
HKU\Alfred\...\Run: [SAFE14 Browser Monitor] "C:\Program Files (x86)\Steganos Safe 14\SteganosBrowserMonitor.exe" [73216 2013-05-16] (Steganos Software GmbH)
HKU\Alfred\...\Winlogon: [Shell] explorer.exe,C:\Users\Alfred\AppData\Roaming\skype.dat [94208 2011-11-17] () <==== ATTENTION
HKU\Default\...\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [x]
HKU\Default User\...\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [x]
Startup: C:\Users\Alfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HP SimpleSave Monitor.lnk
ShortcutTarget: HP SimpleSave Monitor.lnk -> (No File)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

==================== Services (Whitelisted) =================

S2 BackupService; C:\Users\Alfred\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe [83512 2010-07-01] (ArcSoft, Inc.)
S2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [12784 2010-11-11] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [282616 2010-11-11] (Microsoft Corporation)
S2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
S2 VMLiteService; C:\VXP\VMLiteService.exe [426600 2010-08-21] (VMLite, Inc.)

==================== Drivers (Whitelisted) ====================

S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-06] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-06] ()
S1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [188928 2010-10-24] (Microsoft Corporation)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [72064 2010-10-24] (Microsoft Corporation)
S1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2012-07-24] (Softwareentwicklung Remus - ArchiCrypt - )
S1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2012-07-24] (Softwareentwicklung Remus - ArchiCrypt - )
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-06-21] ()
S1 VBoxDrv; C:\Windows\System32\drivers\VBoxDrv.sys [204328 2010-08-11] (VMLite, Inc.)
S3 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp.sys [146216 2010-08-11] (VMLite, Inc.)
S3 VBoxNetFlt; C:\Windows\System32\DRIVERS\VBoxNetFlt.sys [165800 2010-08-11] (VMLite, Inc.)
S1 vmlitedrv; C:\Windows\System32\drivers\vmlitedrv.sys [14952 2010-08-03] (VMLite, Inc.)
S3 vmlitestor; C:\Windows\System32\DRIVERS\vmlitestor.sys [177768 2010-08-11] (VMLite, Inc.)
S3 VMLiteUSB; C:\Windows\System32\Drivers\VMLiteUSB.sys [150120 2010-08-11] (VMLite, Inc.)
S1 VMLiteUSBMon; C:\Windows\System32\drivers\vmliteusbmon.sys [135272 2010-08-18] (VMLite, Inc.)
S3 ALSysIO; \??\C:\Users\Alfred\AppData\Local\Temp\ALSysIO64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-21 17:44 - 2013-06-21 17:44 - 00000000 ____D C:\FRST
2013-06-21 14:23 - 2013-06-21 14:27 - 00006512 ____A C:\Windows\IE10_main.log
2013-06-21 14:15 - 2013-06-21 16:15 - 00000004 ____A C:\Users\Alfred\AppData\Roaming\skype.ini
2013-06-21 11:01 - 2013-06-21 11:01 - 00000000 ____D C:\Users\Alfred\Desktop\VIDEOS BACKUP VON Y AUF T oder TT
2013-06-21 06:55 - 2013-06-21 06:58 - 00000000 ____D C:\Users\Alfred\Documents\WALTI PAUL
2013-06-20 10:40 - 2013-06-20 10:40 - 00000000 ____D C:\Users\Alfred\Documents\Id Isaraporn
2013-06-20 08:47 - 2013-06-20 20:46 - 00000322 ____A C:\Windows\Tasks\WebReg HP Deskjet D4300 series.job
2013-06-20 08:44 - 2013-06-20 08:44 - 00000000 ____D C:\ProgramData\Hewlett-Packard
2013-06-20 08:37 - 2013-06-20 08:37 - 00002173 ____A C:\Users\Public\Desktop\HP Photosmart Essential 3.5.lnk
2013-06-20 08:37 - 2013-06-20 08:37 - 00001195 ____A C:\Users\Public\Desktop\Shop für HP Zubehör.lnk
2013-06-20 08:37 - 2013-06-20 08:37 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-06-20 08:36 - 2013-06-20 08:44 - 00176156 ____A C:\Windows\hphins27.dat
2013-06-20 08:36 - 2009-10-08 02:56 - 00000349 ____N C:\Windows\hphmdl27.dat
2013-06-20 08:23 - 2013-06-20 08:25 - 132666488 ____A C:\Users\Alfred\Downloads\DJ_SF_03_D4300_NonNet_Full_Win_WW_130_140.exe
2013-06-20 06:52 - 2013-06-20 06:52 - 03812764 ____A C:\Users\Alfred\Documents\Lia2013.potm
2013-06-17 19:13 - 2013-06-17 19:13 - 14711864 ____A (Abelssoft ) C:\Users\Alfred\Downloads\checkdrive.exe
2013-06-16 19:25 - 2013-06-16 19:25 - 00001353 ____A C:\Users\Alfred\Desktop\1.DIVERSES AKTUELL - Verknüpfung.lnk
2013-06-16 08:17 - 2013-06-21 16:14 - 00001635 ____A C:\Windows\setupact.log
2013-06-16 08:17 - 2013-06-16 08:17 - 00000000 ____A C:\Windows\setuperr.log
2013-06-15 20:27 - 2013-06-21 15:48 - 00000380 ____A C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Alfred.job
2013-06-15 20:27 - 2013-06-19 19:34 - 00000374 ____A C:\Windows\Tasks\ReclaimerUpdateFiles_Alfred.job
2013-06-15 20:27 - 2013-06-18 22:39 - 00000370 ____A C:\Windows\Tasks\ReclaimerUpdateXML_Alfred.job
2013-06-12 22:49 - 2013-05-17 05:05 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 22:49 - 2013-05-17 04:27 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 22:49 - 2013-05-17 04:09 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 22:49 - 2013-05-17 04:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 22:49 - 2013-05-17 04:02 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 22:49 - 2013-05-17 04:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-12 22:49 - 2013-05-17 04:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-12 22:49 - 2013-05-17 03:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 22:49 - 2013-05-17 03:56 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-12 22:49 - 2013-05-17 03:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-12 22:49 - 2013-05-17 03:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 22:49 - 2013-05-17 03:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 22:49 - 2013-05-17 03:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 22:49 - 2013-05-17 03:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 22:49 - 2013-05-17 03:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-12 22:49 - 2013-05-17 03:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 22:49 - 2013-05-17 00:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-12 22:49 - 2013-05-16 23:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 22:49 - 2013-05-16 23:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 22:49 - 2013-05-16 23:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 22:49 - 2013-05-16 23:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-12 22:49 - 2013-05-16 23:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-12 22:49 - 2013-05-16 23:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-12 22:49 - 2013-05-16 23:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 22:49 - 2013-05-16 23:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 22:49 - 2013-05-16 23:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-12 22:49 - 2013-05-16 23:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-12 22:49 - 2013-05-16 23:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 22:49 - 2013-05-16 23:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-12 22:49 - 2013-05-16 23:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-12 22:49 - 2013-05-16 23:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-12 22:49 - 2013-05-16 23:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-12 11:06 - 2013-05-13 06:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 11:06 - 2013-05-13 06:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 11:06 - 2013-05-13 06:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 11:06 - 2013-05-13 06:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 11:06 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 11:06 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 11:06 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 11:06 - 2013-05-13 04:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 11:06 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 11:06 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 11:06 - 2013-05-10 06:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 11:06 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 11:06 - 2013-05-08 07:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 11:06 - 2013-04-26 06:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 11:06 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-11 05:50 - 2013-06-11 05:50 - 00001329 ____A C:\Users\Alfred\Desktop\aerofly Flug Simulator 2013 - Verknüpfung.lnk
2013-06-10 16:44 - 2013-06-10 16:44 - 35049768 ____A (IPACS ) C:\Users\Alfred\Downloads\aerofly-fs-update-win-v1000911.exe
2013-06-10 16:14 - 2013-06-10 16:16 - 00000000 ____D C:\Users\Alfred\Documents\aerofly Flug Simulator 2013
2013-06-10 16:13 - 2013-06-10 16:13 - 00001259 ____A C:\Users\Public\Desktop\aerofly Flug Simulator 2013.lnk
2013-06-10 16:06 - 2013-06-10 16:46 - 00000000 ____D C:\Program Files (x86)\aerofly Flug Simulator 2013
2013-06-08 21:53 - 2013-06-08 21:53 - 00001789 ____A C:\Users\Alfred\Documents\iTunes.lnk
2013-06-08 21:53 - 2013-06-08 21:53 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-08 21:53 - 2013-06-08 21:53 - 00000000 ____D C:\Program Files\iTunes
2013-06-08 21:53 - 2013-06-08 21:53 - 00000000 ____D C:\Program Files\iPod
2013-06-08 21:53 - 2013-06-08 21:53 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-06-07 12:54 - 2013-06-07 12:54 - 00000000 ____D C:\Users\Alfred\Documents\aerofly FS
2013-06-05 11:49 - 2013-06-05 11:49 - 00000603 ____A C:\Users\Alfred\Documents\fleurop mahnung.txt
2013-06-05 10:04 - 2013-06-05 11:48 - 00000000 ____D C:\Users\Alfred\Documents\Florian
2013-06-04 22:40 - 2013-06-04 22:40 - 00302375 ____A C:\Users\Alfred\Downloads\13_bar5_fs9.zip
2013-06-04 22:38 - 2013-06-04 22:39 - 03597186 ____A C:\Users\Alfred\Downloads\48_addon_largoet.zip
2013-06-04 07:59 - 2013-06-04 07:59 - 00001245 ____A C:\Users\Alfred\Desktop\PASSWÖRTER ex gamerPC - Verknüpfung.lnk
2013-05-30 09:07 - 2013-05-30 09:07 - 00142743 ____A C:\Users\Alfred\Downloads\stealthy-2.5-fx.zip
2013-05-30 08:29 - 2013-05-30 08:29 - 00001194 ____A C:\Users\Alfred\Documents\burkafrauen.txt
2013-05-29 21:23 - 2013-05-30 08:13 - 00000000 ____D C:\Users\Alfred\Documents\CAMPER VAN
2013-05-29 20:16 - 2013-05-29 20:18 - 05779825 ____A C:\Users\Alfred\Downloads\LFLU_LFHE_X2.zip
2013-05-27 16:16 - 2013-05-27 16:16 - 00001045 ____A C:\Users\Public\Desktop\Steganos Safe.lnk
2013-05-27 16:16 - 2013-05-27 16:16 - 00000000 ____D C:\Users\Alfred\Desktop\Steganos Updates
2013-05-26 16:43 - 2013-05-26 16:43 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-05-26 16:43 - 2013-05-26 16:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-05-26 09:48 - 2013-05-26 09:48 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-05-25 19:54 - 2013-06-05 10:07 - 00000000 ____D C:\Users\Alfred\Documents\DAILYTALK
2013-05-25 19:54 - 2013-05-25 19:55 - 00000000 ____D C:\Users\Alfred\Documents\ZATTOO
2013-05-25 19:31 - 2011-05-13 13:16 - 00493056 ____A ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2013-05-25 19:31 - 2011-03-25 21:42 - 00338432 ____A C:\Windows\SysWOW64\sqlite36_engine.dll
2013-05-25 19:29 - 2013-05-25 19:29 - 00618048 ____A (www.download-sponsor.de) C:\Users\Alfred\Downloads\tor-browser-2.3.25-8_de-Downloader.exe
2013-05-25 18:17 - 2013-05-25 18:17 - 02690664 ____A (Steganos Software GmbH) C:\Users\Alfred\Downloads\sosde_netzwelt.exe
2013-05-25 17:57 - 2013-05-25 17:57 - 06990832 ____A C:\Users\Alfred\Downloads\HSS-2.25-install-anchorfree-232-expatshield.exe
2013-05-25 10:09 - 2013-05-25 10:09 - 00000828 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-05-25 10:08 - 2013-05-25 10:08 - 04346816 ____A (Piriform Ltd) C:\Users\Alfred\Downloads\ccsetup401.exe
2013-05-25 09:45 - 2013-05-25 09:47 - 00000000 ____D C:\Users\Alfred\AppData\Roaming\Steganos VPN
2013-05-25 09:44 - 2013-05-25 18:18 - 14034768 ____A (Steganos Software GmbH) C:\Users\Alfred\Downloads\sosint.exe
2013-05-25 09:43 - 2013-05-25 09:43 - 02690664 ____A (Steganos Software GmbH) C:\Users\Alfred\Downloads\sosint103.exe
2013-05-25 09:11 - 2013-05-25 09:11 - 00052628 ____A C:\Users\Alfred\Documents\SecureSwiss VPN & Proxy Account kaufen VPN Bestellung.htm
2013-05-25 09:11 - 2013-05-25 09:11 - 00000000 ____D C:\Users\Alfred\Documents\SecureSwiss VPN & Proxy Account kaufen VPN Bestellung-Dateien
2013-05-25 09:04 - 2013-05-25 09:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-05-23 11:35 - 2013-05-23 11:35 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-05-23 11:35 - 2013-05-23 11:35 - 00000000 ____D C:\Program Files\Realtek
2013-05-23 11:34 - 2000-01-01 01:00 - 08363864 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioRealtek.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 07163744 ____A (Dolby Laboratories) C:\Windows\System32\R4EEP64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 05096448 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RCoRes64.dat
2013-05-23 11:34 - 2000-01-01 01:00 - 04065296 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\Drivers\RTKVHD64.sys
2013-05-23 11:34 - 2000-01-01 01:00 - 03615888 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkAPO64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 02674320 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtPgEx64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 02605400 ____A (Waves Audio Ltd.) C:\Windows\System32\WavesGUILib.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 02533952 ____A (Fortemedia Corporation) C:\Windows\System32\FMAPO64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 02131288 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioEQ.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 01756264 ____A (DTS) C:\Windows\System32\DTSS2SpeakerDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 01568360 ____A (DTS) C:\Windows\System32\DTSS2HeadphoneDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 01560168 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RTSnMg64.cpl
2013-05-23 11:34 - 2000-01-01 01:00 - 01486952 ____A (DTS) C:\Windows\System32\DTSBoostDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 01361336 ____A (TOSHIBA Corporation) C:\Windows\System32\tosade.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 01345368 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioRealtek264.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 01262696 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RTCOM64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 01015640 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPOShell64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00869520 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkApi64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00836544 ____A (TOSHIBA Corporation) C:\Windows\System32\tadefxapo264.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00728680 ____A (DTS) C:\Windows\System32\DTSBassEnhancementDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00712296 ____A (DTS) C:\Windows\System32\DTSSymmetryDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00693352 ____A (DTS) C:\Windows\System32\DTSVoiceClarityDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00603984 ____A (Knowles Acoustics ) C:\Windows\System32\KAAPORT64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00537456 ____A (DTS) C:\Windows\System32\DTSU2PLFX64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00524656 ____A (DTS) C:\Windows\System32\DTSU2PGFX64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00518896 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSTSX64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00491112 ____A (DTS) C:\Windows\System32\DTSNeoPCDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00449392 ____A (DTS) C:\Windows\System32\DTSU2PREC64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00433504 ____A (Dolby Laboratories) C:\Windows\System32\R4EED64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00432744 ____A (DTS) C:\Windows\System32\DTSLimiterDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00428648 ____A (DTS) C:\Windows\System32\DTSGainCompensatorDLL64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00396632 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxVolumeSDAPO.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00375128 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEP64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00341336 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPO30.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00331880 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtlCPAPI64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00318808 ____A (Waves Audio Ltd.) C:\Windows\System32\MaxxAudioAPO20.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00310104 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RP3DHT64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00310104 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RP3DAA64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00293889 ____A C:\Windows\System32\Drivers\RTAIODAT.DAT
2013-05-23 11:34 - 2000-01-01 01:00 - 00242792 ____A (DTS) C:\Windows\System32\DTSLFXAPO64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00242792 ____A (DTS) C:\Windows\System32\DTSGFXAPO64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00241768 ____A (DTS) C:\Windows\System32\DTSGFXAPONS64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00221024 ____A (Synopsys, Inc.) C:\Windows\System32\SFNHK64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00220776 ____A (Sony Corporation) C:\Windows\System32\SFSS_APO.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00211184 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSTSH64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00204120 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEED64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00202336 ____A (Andrea Electronics Corporation) C:\Windows\System32\AERTAC64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00198896 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSHP64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00155888 ____A (SRS Labs, Inc.) C:\Windows\System32\SRSWOW64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00149608 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkCfg64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00148416 ____A (TOSHIBA Corporation) C:\Windows\System32\tadefxapo.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00141152 ____A (Dolby Laboratories) C:\Windows\System32\R4EEL64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00123744 ____A (Dolby Laboratories) C:\Windows\System32\R4EEA64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00108640 ____A (Andrea Electronics Corporation) C:\Windows\System32\AERTAR64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00105616 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RCoInstII64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00101208 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEL64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00081248 ____A (Synopsys, Inc.) C:\Windows\System32\SFCOM64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00078688 ____A (Synopsys, Inc.) C:\Windows\System32\SFAPO64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00078680 ____A (Dolby Laboratories, Inc.) C:\Windows\System32\RTEEG64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00074592 ____A (Dolby Laboratories) C:\Windows\System32\R4EEG64A.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00074064 ____A (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00065944 ____A (TOSHIBA CORPORATION.) C:\Windows\System32\tepeqapo64.dll
2013-05-23 11:34 - 2000-01-01 01:00 - 00014952 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtkCoLDR64.dll
2013-05-23 11:30 - 2000-01-01 01:00 - 01706640 ____A (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2013-05-23 11:26 - 2013-05-23 11:26 - 00000000 ____D C:\Program Files (x86)\Intel
2013-05-23 11:26 - 2000-01-01 01:00 - 00053248 ____A (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
2013-05-23 11:25 - 2013-05-23 11:25 - 00000000 ____D C:\Intel
2013-05-23 11:23 - 2013-05-23 11:34 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-05-23 11:23 - 2013-05-23 11:34 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-05-23 11:23 - 2000-01-01 01:00 - 00553576 ____A (Realtek ) C:\Windows\System32\Drivers\Rt64win7.sys
2013-05-23 11:23 - 2000-01-01 01:00 - 00107552 ____A (Realtek Semiconductor Corporation) C:\Windows\System32\RTNUninst64.dll
2013-05-23 11:23 - 2000-01-01 01:00 - 00074272 ____A C:\Windows\System32\RtNicProp64.dll
2013-05-23 09:08 - 2013-05-23 09:08 - 00649536 ____A (SlimWare Utilities, Inc.) C:\Users\Alfred\Downloads\slimcomputer-setup.exe
2013-05-23 09:08 - 2013-05-23 09:08 - 00002469 ____A C:\Users\Public\Desktop\SlimComputer.lnk
2013-05-23 09:08 - 2013-05-23 09:08 - 00000000 ____D C:\Program Files (x86)\SlimComputer
2013-05-23 09:06 - 2013-06-21 15:48 - 00016152 ____A C:\Windows\System32\Drivers\SWDUMon.sys
2013-05-23 09:06 - 2013-06-21 15:48 - 00000412 ____A C:\Windows\Tasks\SlimDrivers Startup.job
2013-05-23 09:06 - 2013-05-23 09:08 - 00000000 ____D C:\Users\Public\Documents\Downloaded Installers
2013-05-23 09:06 - 2013-05-23 09:08 - 00000000 ____D C:\Users\Alfred\AppData\Local\SlimWare Utilities Inc
2013-05-23 09:04 - 2013-05-23 09:04 - 00670016 ____A (SlimWare Utilities, Inc.) C:\Users\Alfred\Downloads\slimdrivers-29setup.exe
2013-05-23 08:55 - 2013-05-23 08:55 - 05642856 ____A (Uniblue Systems Ltd ) C:\Users\Alfred\Downloads\driverscanner.exe
2013-05-22 22:12 - 2013-05-30 08:29 - 00001194 ____A C:\Users\Alfred\Documents\x.txt

==================== One Month Modified Files and Folders =======

2013-06-21 17:44 - 2013-06-21 17:44 - 00000000 ____D C:\FRST
2013-06-21 16:15 - 2013-06-21 14:15 - 00000004 ____A C:\Users\Alfred\AppData\Roaming\skype.ini
2013-06-21 16:14 - 2013-06-16 08:17 - 00001635 ____A C:\Windows\setupact.log
2013-06-21 15:55 - 2009-07-14 05:45 - 00021872 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-21 15:55 - 2009-07-14 05:45 - 00021872 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-21 15:52 - 2012-10-25 13:53 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-21 15:52 - 2011-04-12 08:43 - 00698720 ____A C:\Windows\System32\perfh007.dat
2013-06-21 15:52 - 2011-04-12 08:43 - 00148916 ____A C:\Windows\System32\perfc007.dat
2013-06-21 15:52 - 2009-07-14 06:13 - 01619012 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-21 15:51 - 2012-10-18 14:41 - 01502860 ____A C:\Windows\WindowsUpdate.log
2013-06-21 15:48 - 2013-06-15 20:27 - 00000380 ____A C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Alfred.job
2013-06-21 15:48 - 2013-05-23 09:06 - 00016152 ____A C:\Windows\System32\Drivers\SWDUMon.sys
2013-06-21 15:48 - 2013-05-23 09:06 - 00000412 ____A C:\Windows\Tasks\SlimDrivers Startup.job
2013-06-21 15:48 - 2013-04-10 03:17 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-21 15:47 - 2012-10-25 13:53 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-21 15:47 - 2009-07-14 06:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-21 15:31 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-06-21 14:43 - 2012-10-18 15:36 - 00000000 ____D C:\Windows\Panther
2013-06-21 14:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-06-21 14:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-06-21 14:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\zh-HK
2013-06-21 14:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\tr-TR
2013-06-21 14:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-06-21 14:27 - 2013-06-21 14:23 - 00006512 ____A C:\Windows\IE10_main.log
2013-06-21 13:35 - 2012-10-25 21:13 - 00000000 ____D C:\Users\Alfred\dwhelper
2013-06-21 11:01 - 2013-06-21 11:01 - 00000000 ____D C:\Users\Alfred\Desktop\VIDEOS BACKUP VON Y AUF T oder TT
2013-06-21 10:40 - 2012-10-21 14:24 - 00000000 ____D C:\Users\Alfred\AppData\Roaming\vlc
2013-06-21 06:58 - 2013-06-21 06:55 - 00000000 ____D C:\Users\Alfred\Documents\WALTI PAUL
2013-06-21 06:54 - 2013-04-23 16:56 - 00000000 ___RD C:\Users\Alfred\Desktop\PIX.VIDEO.INVENTAR.DM.PC
2013-06-20 20:46 - 2013-06-20 08:47 - 00000322 ____A C:\Windows\Tasks\WebReg HP Deskjet D4300 series.job
2013-06-20 20:46 - 2009-07-14 05:45 - 02232176 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-20 10:40 - 2013-06-20 10:40 - 00000000 ____D C:\Users\Alfred\Documents\Id Isaraporn
2013-06-20 09:30 - 2012-11-01 11:26 - 00000000 ____D C:\Users\Alfred\Documents\PG
2013-06-20 08:47 - 2012-10-19 02:23 - 00067824 ____A C:\Users\Alfred\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-20 08:44 - 2013-06-20 08:44 - 00000000 ____D C:\ProgramData\Hewlett-Packard
2013-06-20 08:44 - 2013-06-20 08:36 - 00176156 ____A C:\Windows\hphins27.dat
2013-06-20 08:44 - 2012-10-29 14:14 - 00000000 ____D C:\Users\Alfred\AppData\Roaming\HP
2013-06-20 08:44 - 2012-10-29 14:04 - 00001167 ____A C:\ProgramData\hpzinstall.log
2013-06-20 08:44 - 2012-10-29 14:04 - 00000000 ____D C:\ProgramData\HP
2013-06-20 08:37 - 2013-06-20 08:37 - 00002173 ____A C:\Users\Public\Desktop\HP Photosmart Essential 3.5.lnk
2013-06-20 08:37 - 2013-06-20 08:37 - 00001195 ____A C:\Users\Public\Desktop\Shop für HP Zubehör.lnk
2013-06-20 08:37 - 2013-06-20 08:37 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-06-20 08:37 - 2012-10-29 14:04 - 00000000 ____D C:\Program Files (x86)\HP
2013-06-20 08:25 - 2013-06-20 08:23 - 132666488 ____A C:\Users\Alfred\Downloads\DJ_SF_03_D4300_NonNet_Full_Win_WW_130_140.exe
2013-06-20 06:52 - 2013-06-20 06:52 - 03812764 ____A C:\Users\Alfred\Documents\Lia2013.potm
2013-06-19 19:34 - 2013-06-15 20:27 - 00000374 ____A C:\Windows\Tasks\ReclaimerUpdateFiles_Alfred.job
2013-06-18 22:39 - 2013-06-15 20:27 - 00000370 ____A C:\Windows\Tasks\ReclaimerUpdateXML_Alfred.job
2013-06-17 19:13 - 2013-06-17 19:13 - 14711864 ____A (Abelssoft ) C:\Users\Alfred\Downloads\checkdrive.exe
2013-06-16 19:25 - 2013-06-16 19:25 - 00001353 ____A C:\Users\Alfred\Desktop\1.DIVERSES AKTUELL - Verknüpfung.lnk
2013-06-16 19:20 - 2013-05-19 11:30 - 00000000 ____D C:\Users\Alfred\Documents\PSORIASIS
2013-06-16 08:17 - 2013-06-16 08:17 - 00000000 ____A C:\Windows\setuperr.log
2013-06-15 10:41 - 2012-11-16 12:57 - 00000000 ____D C:\Users\Alfred\Documents\AVIATION
2013-06-15 08:15 - 2012-10-27 14:40 - 00000000 ____D C:\Users\Alfred\AppData\Roaming\uTorrent
2013-06-12 22:48 - 2012-10-18 16:36 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 15:48 - 2012-10-22 07:20 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 15:48 - 2012-10-22 07:20 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 16:54 - 2009-07-14 06:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-11 05:50 - 2013-06-11 05:50 - 00001329 ____A C:\Users\Alfred\Desktop\aerofly Flug Simulator 2013 - Verknüpfung.lnk
2013-06-10 19:14 - 2012-11-08 12:12 - 00082944 __ASH C:\Users\Alfred\Thumbs.db
2013-06-10 16:46 - 2013-06-10 16:06 - 00000000 ____D C:\Program Files (x86)\aerofly Flug Simulator 2013
2013-06-10 16:44 - 2013-06-10 16:44 - 35049768 ____A (IPACS ) C:\Users\Alfred\Downloads\aerofly-fs-update-win-v1000911.exe
2013-06-10 16:16 - 2013-06-10 16:14 - 00000000 ____D C:\Users\Alfred\Documents\aerofly Flug Simulator 2013
2013-06-10 16:13 - 2013-06-10 16:13 - 00001259 ____A C:\Users\Public\Desktop\aerofly Flug Simulator 2013.lnk
2013-06-08 21:53 - 2013-06-08 21:53 - 00001789 ____A C:\Users\Alfred\Documents\iTunes.lnk
2013-06-08 21:53 - 2013-06-08 21:53 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-08 21:53 - 2013-06-08 21:53 - 00000000 ____D C:\Program Files\iTunes
2013-06-08 21:53 - 2013-06-08 21:53 - 00000000 ____D C:\Program Files\iPod
2013-06-08 21:53 - 2013-06-08 21:53 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-06-07 12:54 - 2013-06-07 12:54 - 00000000 ____D C:\Users\Alfred\Documents\aerofly FS
2013-06-07 11:49 - 2012-11-16 12:56 - 00000000 ____D C:\Users\Alfred\Documents\HUMOR KURIOSES
2013-06-07 07:56 - 2012-11-22 19:01 - 00000000 ____D C:\Users\Alfred\Documents\KONTAKTE
2013-06-05 11:49 - 2013-06-05 11:49 - 00000603 ____A C:\Users\Alfred\Documents\fleurop mahnung.txt
2013-06-05 11:48 - 2013-06-05 10:04 - 00000000 ____D C:\Users\Alfred\Documents\Florian
2013-06-05 10:07 - 2013-05-25 19:54 - 00000000 ____D C:\Users\Alfred\Documents\DAILYTALK
2013-06-04 22:40 - 2013-06-04 22:40 - 00302375 ____A C:\Users\Alfred\Downloads\13_bar5_fs9.zip
2013-06-04 22:39 - 2013-06-04 22:38 - 03597186 ____A C:\Users\Alfred\Downloads\48_addon_largoet.zip
2013-06-04 19:43 - 2012-11-01 10:06 - 00477696 __ASH C:\Users\Alfred\Documents\Thumbs.db
2013-06-04 07:59 - 2013-06-04 07:59 - 00001245 ____A C:\Users\Alfred\Desktop\PASSWÖRTER ex gamerPC - Verknüpfung.lnk
2013-06-04 07:59 - 2013-04-17 16:33 - 00000000 ____D C:\Users\Alfred\Documents\PW
2013-05-30 09:07 - 2013-05-30 09:07 - 00142743 ____A C:\Users\Alfred\Downloads\stealthy-2.5-fx.zip
2013-05-30 08:29 - 2013-05-30 08:29 - 00001194 ____A C:\Users\Alfred\Documents\burkafrauen.txt
2013-05-30 08:29 - 2013-05-22 22:12 - 00001194 ____A C:\Users\Alfred\Documents\x.txt
2013-05-30 08:20 - 2013-04-14 08:40 - 00000000 ____D C:\Users\Alfred\Documents\MEDIA
2013-05-30 08:14 - 2013-04-14 09:06 - 00000000 ____D C:\Users\Alfred\Documents\AVIATION pdfs
2013-05-30 08:13 - 2013-05-29 21:23 - 00000000 ____D C:\Users\Alfred\Documents\CAMPER VAN
2013-05-29 20:18 - 2013-05-29 20:16 - 05779825 ____A C:\Users\Alfred\Downloads\LFLU_LFHE_X2.zip
2013-05-28 14:03 - 2012-10-23 15:51 - 00000000 ____D C:\Users\Alfred\VMLites
2013-05-27 16:16 - 2013-05-27 16:16 - 00001045 ____A C:\Users\Public\Desktop\Steganos Safe.lnk
2013-05-27 16:16 - 2013-05-27 16:16 - 00000000 ____D C:\Users\Alfred\Desktop\Steganos Updates
2013-05-27 16:16 - 2012-11-25 18:17 - 00000000 ____D C:\Program Files (x86)\Steganos Safe 14
2013-05-27 09:05 - 2012-10-25 13:04 - 00000000 ___HD C:\Users\Alfred\AppData\Roaming\User Recycle Bin.{645FF040-5081-101B-9F08-00AA002F954E}
2013-05-27 09:05 - 2012-10-25 13:02 - 00000000 ____D C:\Users\Alfred\AppData\Roaming\SEDE
2013-05-27 09:05 - 2012-10-18 15:07 - 00000000 ____D C:\Users\Alfred\AppData\Local\VirtualStore
2013-05-26 16:43 - 2013-05-26 16:43 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-05-26 16:43 - 2013-05-26 16:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-05-26 12:45 - 2012-10-18 17:16 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-26 09:48 - 2013-05-26 09:48 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-05-25 19:55 - 2013-05-25 19:54 - 00000000 ____D C:\Users\Alfred\Documents\ZATTOO
2013-05-25 19:52 - 2012-10-25 13:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-05-25 19:29 - 2013-05-25 19:29 - 00618048 ____A (www.download-sponsor.de) C:\Users\Alfred\Downloads\tor-browser-2.3.25-8_de-Downloader.exe
2013-05-25 18:18 - 2013-05-25 09:44 - 14034768 ____A (Steganos Software GmbH) C:\Users\Alfred\Downloads\sosint.exe
2013-05-25 18:17 - 2013-05-25 18:17 - 02690664 ____A (Steganos Software GmbH) C:\Users\Alfred\Downloads\sosde_netzwelt.exe
2013-05-25 17:57 - 2013-05-25 17:57 - 06990832 ____A C:\Users\Alfred\Downloads\HSS-2.25-install-anchorfree-232-expatshield.exe
2013-05-25 10:09 - 2013-05-25 10:09 - 00000828 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-05-25 10:09 - 2012-10-27 16:27 - 00000000 ____D C:\Program Files\CCleaner
2013-05-25 10:08 - 2013-05-25 10:08 - 04346816 ____A (Piriform Ltd) C:\Users\Alfred\Downloads\ccsetup401.exe
2013-05-25 09:47 - 2013-05-25 09:45 - 00000000 ____D C:\Users\Alfred\AppData\Roaming\Steganos VPN
2013-05-25 09:45 - 2012-11-25 18:09 - 00000000 ____D C:\Users\Alfred\AppData\Roaming\Steganos
2013-05-25 09:43 - 2013-05-25 09:43 - 02690664 ____A (Steganos Software GmbH) C:\Users\Alfred\Downloads\sosint103.exe
2013-05-25 09:11 - 2013-05-25 09:11 - 00052628 ____A C:\Users\Alfred\Documents\SecureSwiss VPN & Proxy Account kaufen VPN Bestellung.htm
2013-05-25 09:11 - 2013-05-25 09:11 - 00000000 ____D C:\Users\Alfred\Documents\SecureSwiss VPN & Proxy Account kaufen VPN Bestellung-Dateien
2013-05-25 09:04 - 2013-05-25 09:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-05-23 11:35 - 2013-05-23 11:35 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-05-23 11:35 - 2013-05-23 11:35 - 00000000 ____D C:\Program Files\Realtek
2013-05-23 11:34 - 2013-05-23 11:23 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-05-23 11:34 - 2013-05-23 11:23 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-05-23 11:26 - 2013-05-23 11:26 - 00000000 ____D C:\Program Files (x86)\Intel
2013-05-23 11:25 - 2013-05-23 11:25 - 00000000 ____D C:\Intel
2013-05-23 09:08 - 2013-05-23 09:08 - 00649536 ____A (SlimWare Utilities, Inc.) C:\Users\Alfred\Downloads\slimcomputer-setup.exe
2013-05-23 09:08 - 2013-05-23 09:08 - 00002469 ____A C:\Users\Public\Desktop\SlimComputer.lnk
2013-05-23 09:08 - 2013-05-23 09:08 - 00000000 ____D C:\Program Files (x86)\SlimComputer
2013-05-23 09:08 - 2013-05-23 09:06 - 00000000 ____D C:\Users\Public\Documents\Downloaded Installers
2013-05-23 09:08 - 2013-05-23 09:06 - 00000000 ____D C:\Users\Alfred\AppData\Local\SlimWare Utilities Inc
2013-05-23 09:04 - 2013-05-23 09:04 - 00670016 ____A (SlimWare Utilities, Inc.) C:\Users\Alfred\Downloads\slimdrivers-29setup.exe
2013-05-23 08:55 - 2013-05-23 08:55 - 05642856 ____A (Uniblue Systems Ltd ) C:\Users\Alfred\Downloads\driverscanner.exe

Files to move or delete:
====================
C:\Users\Alfred\AppData\Roaming\skype.dat
C:\Users\Alfred\AppData\Roaming\skype.ini

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-06-12 22:48:07
Restore point made on: 2013-06-16 15:25:58
Restore point made on: 2013-06-20 07:58:31
Restore point made on: 2013-06-21 14:23:09

==================== Memory info ===========================

Percentage of memory in use: 9%
Total physical RAM: 8119.05 MB
Available physical RAM: 7312.42 MB
Total Pagefile: 8117.25 MB
Available Pagefile: 7306.81 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:465.66 GB) (Free:132 GB) NTFS (Disk=0 Partition=2)
Drive d: (Daten2) (Fixed) (Total:232.88 GB) (Free:25.13 GB) NTFS (Disk=1 Partition=1)
Drive k: () (Removable) (Total:0.47 GB) (Free:0.47 GB) FAT (Disk=6 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: C4CD6244)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 233 GB) (Disk ID: D20CD20C)
Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================
Disk: 6 (Size: 486 MB) (Disk ID: 00A6E71C)
Partition 1: (Active) - (Size=486 MB) - (Type=06)


LastRegBack: 2013-06-13 08:19

==================== End Of Log ============================

Schon zum voraus ganz herzlichen Dank für eine gelegentliche Rückmeldung.
Beste Grüsse
Anatol