GVU Trojaner - Windows 8

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2013
Ran by SYSTEM on 14-07-2013 14:16:39
Running from E:\
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SONYAPO  [1214608 2012-10-10] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] - "C:\Program Files (x86)\Bluetooth Suite\BtTray.exe" [766080 2012-11-05] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] - "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [127616 2012-11-05] (Atheros Communications)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2930488 2012-10-23] (Synaptics Incorporated)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [271872 2012-07-26] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [642216 2012-10-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [mcui_exe] - "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1534504 2013-01-14] (McAfee, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [68776 2012-08-17] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-07-27] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] - "C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe" --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4 [156000 2012-10-04] (Intel Corporation)
HKLM-x32\...\Run: [mcpltui_exe] - "C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe" /platui [299648 2012-07-24] (McAfee, Inc.)
HKU\Matth_000\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHVE.EXE /EPT "EPLTarget\P0000000000000000" /M "Epson Stylus Office BX635FWD" [241280 2013-05-06] (SEIKO EPSON CORPORATION)
HKU\Matth_000\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\MATTH_~1\AppData\Local\Temp\rcnbiddoajwycixfw.exe [52224 2013-07-14] (NVIDIA Corporation) <===== ATTENTION
HKU\Matth_000\...\Winlogon: [Shell] cmd.exe [404992 2012-07-26] (Microsoft Corporation) <==== ATTENTION 
HKU\Matth_000\...\Command Processor: "C:\Users\MATTH_~1\AppData\Local\Temp\rcnbiddoajwycixfw.exe" <===== ATTENTION!
Startup: C:\ProgramData\Start Menu\Programs\Startup\McAfee Parental Controls.lnk
ShortcutTarget: McAfee Parental Controls.lnk -> C:\Program Files\McAfeeEx\MOCP\core\OcpTray.exe (McAfee, Inc.)
Startup: C:\Users\Matth_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)

==================== Services (Whitelisted) =================

S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231040 2012-11-05] (Qualcomm Atheros Commnucations)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [332080 2012-01-26] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [384048 2013-02-25] (McAfee, Inc.)
S2 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [220856 2012-07-24] (McAfee, Inc.)
S2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [220856 2012-07-24] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McSchedulerSvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [220856 2012-07-24] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
S2 mfeicfcoreocp; C:\Program Files\McAfeeEx\MOCP\core\mfeicfcore.exe [2769552 2013-05-09] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [623784 2012-10-17] (Sony Corporation)
S2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1900728 2013-06-09] (Microsoft Corporation)
S2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-07-27] (Sony Corporation)
S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
S3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1265824 2012-10-23] (Sony Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
S2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-11-05] (Atheros)

==================== Drivers (Whitelisted) ====================

S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-10-22] (Advanced Micro Devices)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-11-05] (Qualcomm Atheros)
S3 BTATH_VDP; C:\Windows\system32\drivers\btath_vdp.sys [427416 2012-11-05] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69168 2013-02-19] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
S3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44344 2012-10-23] (Synaptics Incorporated)
S3 SOWS; C:\Windows\System32\drivers\sows.sys [24280 2012-06-11] (Sony Corporation)
S3 mfeapfk01; No ImagePath
S3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-14 14:16 - 2013-07-14 14:16 - 00000000 ____D C:\FRST
2013-07-14 13:26 - 2013-07-14 13:26 - 00000000 __SHD C:\found.000
2013-07-14 11:36 - 2013-07-14 11:36 - 01084715 _____ C:\ProgramData\2433f433
2013-07-14 11:36 - 2013-07-14 11:36 - 01084712 _____ C:\Users\Matth_000\AppData\Local\2433f433
2013-07-14 11:36 - 2013-07-14 11:36 - 01084711 _____ C:\Users\Matth_000\AppData\Roaming\2433f433
2013-07-12 14:39 - 2013-07-12 14:39 - 00449184 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-10 20:05 - 2013-06-01 10:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 20:05 - 2013-06-01 10:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2013-07-10 20:05 - 2013-05-31 00:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-07-10 20:05 - 2013-04-11 23:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 20:05 - 2013-04-11 23:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-07-10 20:04 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 20:04 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 20:04 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 20:04 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 20:04 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 20:04 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 20:04 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 20:04 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 20:04 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-10 20:04 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-10 20:04 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-10 20:04 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-10 20:04 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-10 20:04 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-10 20:04 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-10 20:04 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-10 20:04 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-10 20:04 - 2013-05-04 07:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-10 20:04 - 2013-05-04 05:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-04 19:02 - 2013-07-04 19:02 - 00000000 _____ C:\Users\Matth_000\Desktop\Neues Textdokument.txt
2013-07-03 10:44 - 2013-07-03 10:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 13:10 - 2013-07-02 13:10 - 00294444 _____ C:\Users\Matth_000\Desktop\Schichtplan 2013.xlsx
2013-06-30 17:58 - 2013-06-30 18:01 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\PerformerSoft
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\SpeedAnalysis2
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\PlusWinks
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\File Scout
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\Babylon
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\ProgramData\Babylon
2013-06-30 17:58 - 2012-12-19 14:53 - 00019632 _____ (PerformerSoft LLC) C:\Windows\System32\roboot64.exe
2013-06-30 17:57 - 2013-06-30 17:57 - 00596288 _____ () C:\Users\Matth_000\Downloads\CodecPerformerSetup.exe
2013-06-30 17:57 - 2013-06-30 17:57 - 00596288 _____ () C:\Users\Matth_000\Downloads\CodecPerformerSetup(2).exe
2013-06-30 17:57 - 2013-06-30 17:57 - 00596288 _____ () C:\Users\Matth_000\Downloads\CodecPerformerSetup(1).exe
2013-06-28 13:00 - 2013-06-28 13:00 - 09629432 _____ C:\Users\Matth_000\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-06-25 20:17 - 2013-06-25 20:17 - 00000165 ____H C:\Users\Matth_000\Desktop\~$Rest.xlsx
2013-06-25 20:17 - 2013-06-25 20:17 - 00000165 ____H C:\Users\Matth_000\Desktop\~$Go for Kane.xlsx
2013-06-21 14:57 - 2013-06-21 19:25 - 00000000 ____D C:\Users\Matth_000\Desktop\Zoll - Kühnhackl + Hodgson + Kreider
2013-06-21 14:56 - 2013-06-23 20:31 - 00000000 ____D C:\Users\Matth_000\Desktop\Zoll - Latta 2x + Goc - Sharks
2013-06-18 11:55 - 2013-06-21 14:57 - 00000000 ____D C:\Users\Matth_000\Desktop\Brayden in Action
2013-06-14 20:56 - 2013-05-31 00:24 - 01257472 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-06-14 20:56 - 2013-05-31 00:08 - 00974848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-06-14 20:56 - 2013-05-24 00:01 - 01300992 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-06-14 20:56 - 2013-05-23 23:27 - 01022464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-06-14 20:56 - 2013-05-04 08:34 - 00446720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\USBHUB3.SYS
2013-06-14 20:56 - 2013-05-04 08:34 - 00284416 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\spaceport.sys
2013-06-14 20:56 - 2013-05-04 08:34 - 00213248 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\UCX01000.SYS
2013-06-14 20:56 - 2013-05-04 08:30 - 00058312 _____ (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2013-06-14 20:56 - 2013-05-04 07:59 - 13644288 _____ (Microsoft Corporation) C:\Windows\System32\Windows.UI.Xaml.dll
2013-06-14 20:56 - 2013-05-04 07:59 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2013-06-14 20:56 - 2013-05-04 07:59 - 01483776 _____ (Microsoft Corporation) C:\Windows\System32\VSSVC.exe
2013-06-14 20:56 - 2013-05-04 07:59 - 00812544 _____ (Microsoft Corporation) C:\Windows\System32\Magnify.exe
2013-06-14 20:56 - 2013-05-04 07:59 - 00760320 _____ (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2013-06-14 20:56 - 2013-05-04 07:58 - 10116096 _____ (Microsoft Corporation) C:\Windows\System32\twinui.dll
2013-06-14 20:56 - 2013-05-04 07:58 - 01332736 _____ (Microsoft Corporation) C:\Windows\System32\sysmain.dll
2013-06-14 20:56 - 2013-05-04 07:58 - 00470528 _____ (Microsoft Corporation) C:\Windows\System32\netprofmsvc.dll
2013-06-14 20:56 - 2013-05-04 07:58 - 00330240 _____ (Microsoft Corporation) C:\Windows\System32\stobject.dll
2013-06-14 20:56 - 2013-05-04 07:58 - 00328192 _____ (Microsoft Corporation) C:\Windows\System32\ubpm.dll
2013-06-14 20:56 - 2013-05-04 07:58 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\netplwiz.dll
2013-06-14 20:56 - 2013-05-04 07:58 - 00151552 _____ (Microsoft Corporation) C:\Windows\System32\netprofm.dll
2013-06-14 20:56 - 2013-05-04 07:58 - 00093696 _____ (Microsoft Corporation) C:\Windows\System32\psmsrv.dll
2013-06-14 20:56 - 2013-05-04 07:57 - 02305024 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-06-14 20:56 - 2013-05-04 07:57 - 01131520 _____ (Microsoft Corporation) C:\Windows\System32\AppXDeploymentServer.dll
2013-06-14 20:56 - 2013-05-04 07:57 - 00708096 _____ (Microsoft Corporation) C:\Windows\System32\AppXDeploymentExtensions.dll
2013-06-14 20:56 - 2013-05-04 07:57 - 00560640 _____ (Microsoft Corporation) C:\Windows\System32\mfmp4srcsnk.dll
2013-06-14 20:56 - 2013-05-04 07:57 - 00501760 _____ (Microsoft Corporation) C:\Windows\System32\DevicePairing.dll
2013-06-14 20:56 - 2013-05-04 07:57 - 00389120 _____ (Microsoft Corporation) C:\Windows\System32\BCP47Langs.dll
2013-06-14 20:56 - 2013-05-04 07:56 - 00419840 _____ (Microsoft Corporation) C:\Windows\System32\intl.cpl
2013-06-14 20:56 - 2013-05-04 05:58 - 00621056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-06-14 20:56 - 2013-05-04 05:57 - 10788864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2013-06-14 20:56 - 2013-05-04 05:57 - 08857088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2013-06-14 20:56 - 2013-05-04 05:57 - 00303616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2013-06-14 20:56 - 2013-05-04 05:57 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2013-06-14 20:56 - 2013-05-04 05:57 - 00151040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netplwiz.dll
2013-06-14 20:56 - 2013-05-04 05:56 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-06-14 20:56 - 2013-05-04 05:51 - 00014848 _____ (Microsoft) C:\Windows\System32\rars.rs
2013-06-14 20:56 - 2013-05-04 05:47 - 00427520 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdbss.sys
2013-06-14 20:56 - 2013-05-04 05:10 - 00014848 _____ (Microsoft) C:\Windows\SysWOW64\rars.rs
2013-06-14 20:55 - 2013-05-15 03:25 - 00888320 _____ (Microsoft Corporation) C:\Windows\System32\autochk.exe
2013-06-14 20:55 - 2013-05-15 03:25 - 00542208 _____ (Microsoft Corporation) C:\Windows\System32\untfs.dll
2013-06-14 20:55 - 2013-05-15 03:24 - 00793088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2013-06-14 20:55 - 2013-05-15 03:24 - 00482816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2013-06-14 20:55 - 2013-05-04 08:58 - 00120736 _____ (Microsoft Corporation) C:\Windows\System32\AuthHost.exe
2013-06-14 20:55 - 2013-05-04 07:59 - 01619968 _____ (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2013-06-14 20:55 - 2013-05-04 07:59 - 00251904 _____ (Microsoft Corporation) C:\Windows\System32\WUSettingsProvider.dll
2013-06-14 20:55 - 2013-05-04 07:59 - 00141824 _____ (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2013-06-14 20:55 - 2013-05-04 07:59 - 00098304 _____ (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2013-06-14 20:55 - 2013-05-04 07:59 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2013-06-14 20:55 - 2013-05-04 07:58 - 00173568 _____ (Microsoft Corporation) C:\Windows\System32\storewuauth.dll
2013-06-14 20:55 - 2013-05-04 07:57 - 00179712 _____ (Microsoft Corporation) C:\Windows\System32\bisrv.dll
2013-06-14 20:55 - 2013-05-04 07:57 - 00122368 _____ (Microsoft Corporation) C:\Windows\System32\biwinrt.dll
2013-06-14 20:55 - 2013-05-04 07:57 - 00017408 _____ (Microsoft Corporation) C:\Windows\System32\muifontsetup.dll
2013-06-14 20:55 - 2013-05-04 05:58 - 00758784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Magnify.exe
2013-06-14 20:55 - 2013-05-04 05:58 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-06-14 20:55 - 2013-05-04 05:58 - 00083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-06-14 20:55 - 2013-05-04 05:58 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-06-14 20:55 - 2013-05-04 05:57 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netprofm.dll
2013-06-14 20:55 - 2013-05-04 05:57 - 00018432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\npmproxy.dll
2013-06-14 20:55 - 2013-05-04 05:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\muifontsetup.dll
2013-06-14 20:55 - 2013-05-04 05:56 - 00449536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairing.dll
2013-06-14 20:55 - 2013-05-04 05:56 - 00411136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2013-06-14 20:55 - 2013-05-04 05:56 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BCP47Langs.dll
2013-06-14 20:55 - 2013-05-04 05:56 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\biwinrt.dll
2013-06-14 20:55 - 2013-05-04 05:55 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\intl.cpl
2013-06-14 20:55 - 2013-05-04 05:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidclass.sys
2013-06-14 20:55 - 2013-05-04 05:48 - 00027648 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidusb.sys
2013-06-14 20:55 - 2013-05-02 23:04 - 00386646 _____ C:\Windows\System32\ApnDatabase.xml
2013-06-14 14:28 - 2013-06-20 13:09 - 00008535 _____ C:\Users\Matth_000\Desktop\Go for Kane.xlsx

==================== One Month Modified Files and Folders =======

2013-07-14 14:16 - 2013-07-14 14:16 - 00000000 ____D C:\FRST
2013-07-14 13:26 - 2013-07-14 13:26 - 00000000 __SHD C:\found.000
2013-07-14 13:05 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-14 13:03 - 2013-04-02 16:44 - 00000000 ____D C:\ProgramData\MOCP
2013-07-14 13:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\System32\sru
2013-07-14 12:40 - 2013-04-02 16:05 - 01440927 _____ C:\Windows\WindowsUpdate.log
2013-07-14 12:39 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\System32\oobe
2013-07-14 11:45 - 2013-05-05 15:22 - 00000000 ____D C:\users\Matth_000
2013-07-14 11:42 - 2013-05-05 17:03 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-14 11:40 - 2013-06-06 19:46 - 00000000 ____D C:\Users\Matth_000\AppData\Local\CrashDumps
2013-07-14 11:36 - 2013-07-14 11:36 - 01084715 _____ C:\ProgramData\2433f433
2013-07-14 11:36 - 2013-07-14 11:36 - 01084712 _____ C:\Users\Matth_000\AppData\Local\2433f433
2013-07-14 11:36 - 2013-07-14 11:36 - 01084711 _____ C:\Users\Matth_000\AppData\Roaming\2433f433
2013-07-13 20:16 - 2013-05-05 15:33 - 00003594 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3582001759-472828862-294730695-1001
2013-07-13 20:12 - 2013-05-31 15:59 - 00000000 ___RD C:\Users\Matth_000\Dropbox
2013-07-13 20:12 - 2013-05-31 15:54 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\Dropbox
2013-07-12 14:39 - 2013-07-12 14:39 - 00449184 _____ C:\Windows\System32\FNTCACHE.DAT
2013-07-12 14:39 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\System32\config\BBI
2013-07-11 10:48 - 2013-05-05 15:22 - 00000000 ____D C:\Users\Matth_000\AppData\Local\Packages
2013-07-11 09:42 - 2012-08-03 03:22 - 00013378 _____ C:\Windows\PFRO.log
2013-07-11 09:40 - 2012-07-26 08:52 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 21:05 - 2013-05-13 14:57 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-07-10 20:29 - 2013-05-06 09:46 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-07-10 19:52 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\System32\config\ELAM
2013-07-10 19:48 - 2013-05-05 15:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-05 07:39 - 2013-05-05 15:23 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\Sony Corporation
2013-07-04 19:02 - 2013-07-04 19:02 - 00000000 _____ C:\Users\Matth_000\Desktop\Neues Textdokument.txt
2013-07-03 10:44 - 2013-07-03 10:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 09:13 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-07-02 13:10 - 2013-07-02 13:10 - 00294444 _____ C:\Users\Matth_000\Desktop\Schichtplan 2013.xlsx
2013-07-02 11:46 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\LiveKernelReports
2013-07-01 11:22 - 2013-05-07 12:53 - 00811008 ___SH C:\Users\Matth_000\Desktop\Thumbs.db
2013-07-01 11:21 - 2013-06-09 19:41 - 00049152 ___SH C:\Users\Matth_000\Downloads\Thumbs.db
2013-06-30 18:01 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\PerformerSoft
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\SpeedAnalysis2
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\PlusWinks
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\File Scout
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\Users\Matth_000\AppData\Roaming\Babylon
2013-06-30 17:58 - 2013-06-30 17:58 - 00000000 ____D C:\ProgramData\Babylon
2013-06-30 17:57 - 2013-06-30 17:57 - 00596288 _____ () C:\Users\Matth_000\Downloads\CodecPerformerSetup.exe
2013-06-30 17:57 - 2013-06-30 17:57 - 00596288 _____ () C:\Users\Matth_000\Downloads\CodecPerformerSetup(2).exe
2013-06-30 17:57 - 2013-06-30 17:57 - 00596288 _____ () C:\Users\Matth_000\Downloads\CodecPerformerSetup(1).exe
2013-06-28 13:00 - 2013-06-28 13:00 - 09629432 _____ C:\Users\Matth_000\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-06-27 23:04 - 2013-05-07 05:43 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-27 23:04 - 2013-05-07 05:43 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-25 20:17 - 2013-06-25 20:17 - 00000165 ____H C:\Users\Matth_000\Desktop\~$Rest.xlsx
2013-06-25 20:17 - 2013-06-25 20:17 - 00000165 ____H C:\Users\Matth_000\Desktop\~$Go for Kane.xlsx
2013-06-23 20:31 - 2013-06-21 14:56 - 00000000 ____D C:\Users\Matth_000\Desktop\Zoll - Latta 2x + Goc - Sharks
2013-06-21 19:25 - 2013-06-21 14:57 - 00000000 ____D C:\Users\Matth_000\Desktop\Zoll - Kühnhackl + Hodgson + Kreider
2013-06-21 14:57 - 2013-06-18 11:55 - 00000000 ____D C:\Users\Matth_000\Desktop\Brayden in Action
2013-06-20 13:09 - 2013-06-14 14:28 - 00008535 _____ C:\Users\Matth_000\Desktop\Go for Kane.xlsx
2013-06-20 13:08 - 2013-05-17 16:03 - 00009795 _____ C:\Users\Matth_000\Desktop\Rest.xlsx
2013-06-20 13:06 - 2013-05-31 15:28 - 00008832 _____ C:\Users\Matth_000\Desktop\Verkauf.xlsx
2013-06-16 13:15 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-06-16 12:18 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData
2013-06-16 12:18 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2013-06-16 12:18 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-06-16 12:18 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-06-16 12:18 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-06-16 12:18 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\System32\Dism
2013-06-14 13:48 - 2013-04-02 16:08 - 00000000 ____D C:\Program Files (x86)\McAfee

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-19 14:27:40
Restore point made on: 2013-06-27 18:56:41
Restore point made on: 2013-07-08 11:00:57
Restore point made on: 2013-07-14 11:39:13
Restore point made on: 2013-07-14 11:42:55
Restore point made on: 2013-07-14 11:44:41
Restore point made on: 2013-07-14 11:57:38
Restore point made on: 2013-07-14 12:39:27

==================== Memory info =========================== 

Percentage of memory in use: 17%
Total physical RAM: 4043.27 MB
Available physical RAM: 3349.45 MB
Total Pagefile: 4043.27 MB
Available Pagefile: 3362.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:429.05 GB) (Free:371.1 GB) NTFS
Drive e: (USB CHAGGO) (Removable) (Total:0.94 GB) (Free:0.83 GB) FAT (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 19BB4164)

Partition: GPT Partition Type
========================================================
Disk: 1 (Size: 967 MB) (Disk ID: 0013A9DF)
Partition 1: (Active) - (Size=967 MB) - (Type=06)


LastRegBack: 2013-07-12 08:39

==================== End Of Log ============================