| |
| |||||||
Log-Analyse und Auswertung: Partitionen selbständig zu "Volume ohne Bezeichnung" umbenanntWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
14.08.2013, 17:13
| #1 |
| |  Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt Hi, ich habe an meinem Rechner identische Ordner miteinander verglichen und dabei kurz auch Systemdateien über die Ordnereinstellungen anzeigen lassen. Ich habe dann nichts weiter gemacht und die Systemdateien auch sofort wieder ausblenden lassen. Allerdings waren dann plötzlich im Windows Explorer alle meine Partitionen folgendermaßen umbenannt: - die Windows (C) Partition: Lokaler Datenträger - Partition D: Lokaler Datenträger - Unbekanntes Volume 1 - Partition E: Lokaler Datenträger - Unbekanntes Volume 2 - Partition F: so ähnlich wie die anderen, habe spontan dort gleich den Namen wieder umbenannt und weiß es daher nicht mehr sicher Alles funktioniert weiterhin, eine defekte Festplatte schließe ich eigentlich aus, da es zwei verschiedene Festplatten betrifft und nicht beide gleichzeitig kaputt gehen werden. Außerdem tritt das Problem nur bei einem Windows Benutzerkonto auf, bei dem anderen werden die Partitionen nach wie vor richtig angezeigt. Auffällig ist der zeitliche Zusammenhang mit dem oben beschriebenen Anzeigen von Systemdateien. Ich habe daraufhin Antivir rüberlaufen lassen, dieser hat vier Funde gemacht: - EXP/ASF.GetCodec.Gen - EXP/JS.Expack.EB - TR/Rogue.7944516 - ADWARE/SpeedingUpMyPC.C Ich habe diese wie von Antivir empfohlen erstmal in Quarantäne verschoben. Geändert hat das aber nichts. Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 13. August 2013 19:31
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : Lise-PC
Versionsinformationen:
BUILD.DAT : 13.0.0.3885 54851 Bytes 01.08.2013 08:55:00
AVSCAN.EXE : 13.6.0.1722 634936 Bytes 18.07.2013 06:01:50
AVSCANRC.DLL : 13.6.0.1550 62520 Bytes 18.07.2013 06:02:29
LUKE.DLL : 13.6.0.1550 65080 Bytes 18.07.2013 06:02:13
AVSCPLR.DLL : 13.6.0.1712 92216 Bytes 18.07.2013 06:01:50
AVREG.DLL : 13.6.0.1550 247864 Bytes 18.07.2013 06:01:46
avlode.dll : 13.6.2.1704 449592 Bytes 18.07.2013 06:01:45
avlode.rdf : 13.0.1.22 26240 Bytes 13.08.2013 17:25:05
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:38:25
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 11:41:10
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 06:02:23
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 06:02:23
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 06:39:01
VBASE005.VDF : 7.11.91.177 2048 Bytes 23.07.2013 06:39:01
VBASE006.VDF : 7.11.91.178 2048 Bytes 23.07.2013 06:39:01
VBASE007.VDF : 7.11.91.179 2048 Bytes 23.07.2013 06:39:01
VBASE008.VDF : 7.11.91.180 2048 Bytes 23.07.2013 06:39:01
VBASE009.VDF : 7.11.91.181 2048 Bytes 23.07.2013 06:39:01
VBASE010.VDF : 7.11.91.182 2048 Bytes 23.07.2013 06:39:01
VBASE011.VDF : 7.11.91.183 2048 Bytes 23.07.2013 06:39:01
VBASE012.VDF : 7.11.91.184 2048 Bytes 23.07.2013 06:39:01
VBASE013.VDF : 7.11.92.32 156160 Bytes 24.07.2013 06:39:01
VBASE014.VDF : 7.11.92.147 168960 Bytes 25.07.2013 06:39:01
VBASE015.VDF : 7.11.93.93 419328 Bytes 28.07.2013 06:39:01
VBASE016.VDF : 7.11.93.170 1403392 Bytes 29.07.2013 06:39:01
VBASE017.VDF : 7.11.94.31 222208 Bytes 31.07.2013 06:39:01
VBASE018.VDF : 7.11.94.141 273408 Bytes 03.08.2013 17:24:27
VBASE019.VDF : 7.11.94.203 200192 Bytes 04.08.2013 17:24:28
VBASE020.VDF : 7.11.95.8 1925632 Bytes 05.08.2013 17:24:36
VBASE021.VDF : 7.11.95.81 203776 Bytes 06.08.2013 17:24:37
VBASE022.VDF : 7.11.95.175 148480 Bytes 07.08.2013 17:24:37
VBASE023.VDF : 7.11.95.248 1224192 Bytes 09.08.2013 17:24:42
VBASE024.VDF : 7.11.96.43 861184 Bytes 10.08.2013 17:24:46
VBASE025.VDF : 7.11.96.83 197632 Bytes 11.08.2013 17:24:47
VBASE026.VDF : 7.11.96.151 285696 Bytes 13.08.2013 17:24:48
VBASE027.VDF : 7.11.96.152 2048 Bytes 13.08.2013 17:24:48
VBASE028.VDF : 7.11.96.153 2048 Bytes 13.08.2013 17:24:48
VBASE029.VDF : 7.11.96.154 2048 Bytes 13.08.2013 17:24:48
VBASE030.VDF : 7.11.96.155 2048 Bytes 13.08.2013 17:24:48
VBASE031.VDF : 7.11.96.176 41472 Bytes 13.08.2013 17:24:49
Engineversion : 8.2.12.104
AEVDF.DLL : 8.1.3.4 102774 Bytes 18.07.2013 06:01:38
AESCRIPT.DLL : 8.1.4.140 504190 Bytes 13.08.2013 17:25:02
AESCN.DLL : 8.1.10.4 131446 Bytes 26.03.2013 20:14:59
AESBX.DLL : 8.2.16.20 1241464 Bytes 13.08.2013 17:25:04
AERDL.DLL : 8.2.0.128 688504 Bytes 18.07.2013 06:01:38
AEPACK.DLL : 8.3.2.24 749945 Bytes 18.07.2013 06:01:37
AEOFFICE.DLL : 8.1.2.76 205181 Bytes 13.08.2013 17:25:01
AEHEUR.DLL : 8.1.4.538 6099322 Bytes 13.08.2013 17:25:00
AEHELP.DLL : 8.1.27.4 266617 Bytes 18.07.2013 06:01:30
AEGEN.DLL : 8.1.7.12 442743 Bytes 13.08.2013 17:24:50
AEEXP.DLL : 8.4.1.46 287095 Bytes 13.08.2013 17:25:04
AEEMU.DLL : 8.1.3.2 393587 Bytes 29.11.2012 10:25:29
AECORE.DLL : 8.1.31.6 201081 Bytes 18.07.2013 06:01:30
AEBB.DLL : 8.1.1.4 53619 Bytes 29.11.2012 10:25:29
AVWINLL.DLL : 13.6.0.1550 23608 Bytes 18.07.2013 06:01:53
AVPREF.DLL : 13.6.0.1550 48184 Bytes 18.07.2013 06:01:45
AVREP.DLL : 13.6.0.1550 175672 Bytes 18.07.2013 06:01:46
AVARKT.DLL : 13.6.0.1626 258104 Bytes 18.07.2013 06:01:41
AVEVTLOG.DLL : 13.6.0.1550 164920 Bytes 18.07.2013 06:01:43
SQLITE3.DLL : 3.7.0.1 394824 Bytes 18.07.2013 06:02:21
AVSMTP.DLL : 13.6.0.1550 59960 Bytes 18.07.2013 06:01:50
NETNT.DLL : 13.6.0.1550 13368 Bytes 18.07.2013 06:02:14
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 18.07.2013 06:02:34
RCTEXT.DLL : 13.6.0.1624 67128 Bytes 18.07.2013 06:02:34
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: D:\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, E:, F:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Dienstag, 13. August 2013 19:31
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'E:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'F:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Versteckter Treiber
[HINWEIS] Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.
Versteckter Treiber
[HINWEIS] Eine Speicherveränderung wurde entdeckt, die möglicherweise zur versteckten Dateizugriffen missbraucht werden könnte.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '100' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '154' Modul(e) wurden durchsucht
Durchsuche Prozess 'CTAudSvc.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '102' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'schedul2.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhotoshopElementsFileAgent.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '222' Modul(e) wurden durchsucht
Durchsuche Prozess 'afcdpsrv.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'FABS.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'Gs-Server.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlservr.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlbrowser.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'sqlwriter.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'syncagentsrv.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVCpl64.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'schedhlp.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'DTLite.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvernoteClipper.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'RunDll32.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'CtHelper.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'RIMBBLaunchAgent.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'DivXUpdate.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'ReaderAppHelper.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrueImageMonitor.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'TibMounterMonitor.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPNetworkCommunicator.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '126' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '93' Modul(e) wurden durchsucht
Durchsuche Prozess 'wuauclt.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '125' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '126' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '10793' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
C:\Users\Lise\AppData\Local\Temp\InstallShare21820\OptimizerPro.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/SpeedingUpMyPC.C
C:\Users\Lise\AppData\Local\Temp\InstallShare27896\gutscheinfilter_q.exe
[FUND] Ist das Trojanische Pferd TR/Rogue.7944516
C:\Users\Hans\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5W4YDS0K\ccms[1].htm
[FUND] Enthält Erkennungsmuster des Exploits EXP/JS.Expack.EB
Beginne mit der Suche in 'D:\'
Beginne mit der Suche in 'E:\'
Beginne mit der Suche in 'F:\' <Lokaler Datenträger F>
F:\Shared\Musik\Downloads\hier ist ein mensch.mp3
[FUND] Enthält Erkennungsmuster des Exploits EXP/ASF.GetCodec.Gen
Beginne mit der Desinfektion:
F:\Shared\Musik\Downloads\hier ist ein mensch.mp3
[FUND] Enthält Erkennungsmuster des Exploits EXP/ASF.GetCodec.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5a550085.qua' verschoben!
C:\Users\Hans\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5W4YDS0K\ccms[1].htm
[FUND] Enthält Erkennungsmuster des Exploits EXP/JS.Expack.EB
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '42da2f2d.qua' verschoben!
C:\Users\Lise\AppData\Local\Temp\InstallShare27896\gutscheinfilter_q.exe
[FUND] Ist das Trojanische Pferd TR/Rogue.7944516
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '108c75d7.qua' verschoben!
C:\Users\Lise\AppData\Local\Temp\InstallShare21820\OptimizerPro.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/SpeedingUpMyPC.C
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '76bb3a10.qua' verschoben!
Ende des Suchlaufs: Dienstag, 13. August 2013 23:06
Benötigte Zeit: 3:31:00 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
80195 Verzeichnisse wurden überprüft
3179796 Dateien wurden geprüft
4 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
4 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
3179792 Dateien ohne Befall
36858 Archive wurden durchsucht
0 Warnungen
6 Hinweise
1091302 Objekte wurden beim Rootkitscan durchsucht
2 Versteckte Objekte wurden gefunden
Danke für eure Hilfe! |
|
14.08.2013, 17:20
| #2 |
| /// the machine /// TB-Ausbilder    | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
14.08.2013, 17:46
| #3 |
| | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt Alles klar, hier die Logs:
__________________FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-08-2013 01
Ran by Lise (administrator) on 14-08-2013 18:26:44
Running from F:\Lise\Stuff\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\sched.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Adobe Systems Incorporated) D:\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
() D:\GoodSync\Gs-Server.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(DT Soft Ltd) D:\Daemon Tools Lite\DTLite.exe
(Dropbox, Inc.) C:\Users\Lise\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) D:\Evernote\EvernoteClipper.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CtHelper.exe
(Apple Inc.) D:\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Sony Corporation) D:\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Acronis) D:\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CtHelper.exe
(Apple Inc.) D:\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Sony Corporation) D:\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Acronis) D:\Acronis\TrueImageHome\TrueImageMonitor.exe
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avgnt.exe
(Dropbox, Inc.) C:\Users\Hans\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) D:\Evernote\EvernoteClipper.exe
(Microsoft Corporation) C:\Windows\system32\consent.exe
(Mozilla Corporation) D:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) D:\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Microsoft Corporation) C:\Windows\sysWow64\SearchProtocolHost.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11663976 2010-12-09] (Realtek Semiconductor)
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [403888 2012-08-23] (Acronis)
HKCU\...\Run: [ASRockXTU] - [x]
HKCU\...\Run: [zASRockInstantBoot] - [x]
HKCU\...\Run: [DAEMON Tools Lite] - D:\Daemon Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
MountPoints2: {268aa90f-be74-11e0-a1a2-002522a9fc5c} - F:\autorun.exe
HKLM-x32\...\Run: [AsioThk32Reg] - REGSVR32.EXE /S CTASIO.DLL [x]
HKLM-x32\...\Run: [CTHelper] - C:\Windows\\SysWOW64\CTHELPER.EXE [19456 2010-03-18] (Creative Technology Ltd)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-09-08] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes\iTunesHelper.exe [421160 2010-09-24] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-09-01] (Research In Motion Limited)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [TrayServer] - D:\Magix Video deluxe MX Plus\TrayServer_de.exe [90112 2008-08-07] (MAGIX AG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263512 2012-11-30] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [898952 2012-11-08] (Sony Corporation)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - D:\Acronis\TrueImageHome\TrueImageMonitor.exe [6049096 2012-08-23] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] - C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [943856 2012-07-24] (Acronis)
HKLM-x32\...\Run: [avgnt] - D:\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-18] (Avira Operations GmbH & Co. KG)
Startup: C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Lise\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> D:\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
Startup: C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8100 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8100 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8100\bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CloudStation.lnk
ShortcutTarget: CloudStation.lnk -> C:\Users\Lise\AppData\Local\CloudStation\bin\cloud.exe (No File)
Startup: C:\Users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Lise\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> D:\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog9 01 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 01 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 02 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 03 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 04 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 05 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 06 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 07 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 08 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 19 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194
FireFox:
========
FF ProfilePath: C:\Users\Lise\AppData\Roaming\Mozilla\Firefox\Profiles\qyj6ozs5.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - D:\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - D:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - D:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Lise\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: zotero - C:\Users\Lise\AppData\Roaming\Mozilla\Firefox\Profiles\qyj6ozs5.default\Extensions\zotero@chnm.gmu.edu.xpi
FF Extension: No Name - C:\Users\Lise\AppData\Roaming\Mozilla\Firefox\Profiles\qyj6ozs5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF StartMenuInternet: FIREFOX.EXE - D:\Mozilla Firefox\firefox.exe
Chrome:
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RIM Handheld Application Loader) - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\Lise\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (DivX VOD Helper Plug-in) - D:\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Microsoft Office 2010) - D:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - D:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (Google Drive) - C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 AdobeActiveFileMonitor8.0; D:\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [169312 2009-10-09] (Adobe Systems Incorporated)
R2 AntiVirSchedulerService; D:\Avira\AntiVir Desktop\sched.exe [84024 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; D:\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-18] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; D:\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 GsServer; D:\GoodSync\Gs-Server.exe [5966480 2013-07-11] ()
R2 MSSQL$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4466688 2007-11-08] (Microsoft Corporation)
S3 wampapache; "F:\Hans\wamp\bin\apache\apache2.2.22\bin\httpd.exe" -k runservice [x]
S3 wampmysqld; F:\Hans\wamp\bin\mysql\mysql5.5.24\bin\mysqld.exe wampmysqld [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-07-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-07-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-06] (Avira Operations GmbH & Co. KG)
R3 ctgame; C:\Windows\System32\DRIVERS\ctgame.sys [26328 2010-03-18] (Creative Technology Ltd.)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] ()
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74752 2011-07-25] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2011-08-03] ()
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [1093256 2013-04-05] (Acronis)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [166024 2013-04-05] (Acronis)
U3 axdb00wk; C:\Windows\System32\Drivers\axdb00wk.sys [0 ] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-14 18:11 - 2013-08-14 18:12 - 00029702 _____ C:\Users\Lise\Desktop\Report Antivir 13-08-edit.txt
2013-08-13 23:07 - 2013-08-13 23:07 - 00029716 _____ C:\Users\Lise\Desktop\Report Antivir 13-08.txt
2013-08-13 19:29 - 2013-08-13 19:29 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Avira
2013-08-13 19:25 - 2013-08-13 19:25 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-13 19:22 - 2013-08-13 19:23 - 00000000 ____D C:\ProgramData\Avira
2013-08-13 19:22 - 2013-07-18 08:02 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-13 19:22 - 2013-07-18 08:02 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-13 19:22 - 2013-03-06 16:13 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-13 16:58 - 2013-08-13 18:37 - 00000000 ____D C:\Users\Lise\AppData\Roaming\GoodSync
2013-08-13 16:58 - 2013-08-13 16:58 - 00000000 ____D C:\ProgramData\GoodSync
2013-08-13 14:59 - 2013-08-13 18:57 - 00000000 ____D C:\Users\Hans\AppData\Roaming\FreeFileSync
2013-08-13 10:12 - 2013-08-13 10:12 - 00000000 ____D C:\Users\Hans\AppData\Local\HP
2013-08-13 09:40 - 2013-08-14 17:59 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Skype
2013-08-13 09:40 - 2013-08-13 09:40 - 00002517 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-13 09:40 - 2013-08-13 09:40 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-13 09:40 - 2013-08-13 09:40 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 18:19 - 2013-08-12 18:19 - 00001787 _____ C:\Users\Lise\Desktop\BatchRun.ffs_batch
2013-08-12 17:58 - 2013-08-12 18:19 - 00000000 ____D C:\Users\Lise\AppData\Roaming\FreeFileSync
2013-08-12 17:56 - 2013-08-12 17:57 - 06399776 _____ C:\Users\Lise\Downloads\FreeFileSync_5.20_Windows_Setup.exe
2013-08-12 16:17 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-08-12 16:17 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-08-12 16:17 - 2013-05-08 08:39 - 01910632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-12 16:17 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-12 16:17 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-12 16:17 - 2013-04-12 16:45 - 01656680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2013-08-12 16:17 - 2013-04-10 08:01 - 00983400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-08-12 16:17 - 2013-04-10 08:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2013-08-12 16:17 - 2013-03-19 07:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-08-12 16:17 - 2013-03-19 07:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2013-08-12 16:17 - 2013-02-27 08:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2013-08-12 16:17 - 2013-02-27 07:52 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-08-12 16:17 - 2013-02-27 07:52 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-08-12 16:17 - 2013-02-27 07:48 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-08-12 16:17 - 2013-02-27 07:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2013-08-12 16:17 - 2013-02-27 06:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-08-12 16:17 - 2013-02-27 06:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-08-12 16:17 - 2013-02-27 06:49 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-08-12 16:17 - 2013-02-15 08:08 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-08-12 16:17 - 2013-02-15 08:06 - 03717632 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-12 16:17 - 2013-02-15 08:02 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-08-12 16:17 - 2013-02-15 06:37 - 03217408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-12 16:17 - 2013-02-15 06:34 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-08-12 16:17 - 2013-02-15 05:25 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-08-12 16:17 - 2011-02-03 13:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-08-12 16:16 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-08-12 16:16 - 2013-05-13 07:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-12 16:16 - 2013-05-13 07:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-12 16:16 - 2013-05-13 07:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-12 16:16 - 2013-05-13 07:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-08-12 16:16 - 2013-05-13 06:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-12 16:16 - 2013-05-13 06:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-12 16:16 - 2013-05-13 06:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-12 16:16 - 2013-05-13 05:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-08-12 16:16 - 2013-05-13 05:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-08-12 16:16 - 2013-05-13 05:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-08-12 16:16 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-08-12 16:16 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-08-12 16:16 - 2013-04-26 07:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-08-12 16:16 - 2013-04-26 06:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-08-12 16:16 - 2013-04-17 09:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-08-12 16:16 - 2013-04-17 08:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-08-12 16:16 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-08-12 16:16 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-08-12 16:16 - 2013-03-19 08:04 - 05550424 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-12 16:16 - 2013-03-19 07:46 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-08-12 16:16 - 2013-03-19 07:04 - 03968856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-12 16:16 - 2013-03-19 07:04 - 03913560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-12 16:16 - 2013-03-19 06:47 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-08-12 16:16 - 2013-03-19 05:06 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-08-12 16:16 - 2013-01-24 08:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2013-08-12 16:14 - 2013-04-26 01:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-08-12 16:14 - 2013-04-01 00:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-12 15:37 - 2013-08-12 15:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-12 15:37 - 2013-08-12 15:37 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-12 15:37 - 2013-08-12 15:37 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-12 15:37 - 2013-08-12 15:37 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-12 15:37 - 2013-08-12 15:37 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-12 15:37 - 2013-08-12 15:37 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-12 15:37 - 2013-08-12 15:37 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-12 15:37 - 2013-08-12 15:37 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-12 15:37 - 2013-08-12 15:37 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-12 15:37 - 2013-08-12 15:37 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-12 15:33 - 2013-08-12 15:40 - 00009228 _____ C:\Windows\IE10_main.log
2013-08-12 11:36 - 2013-08-14 17:46 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-12 11:36 - 2013-08-12 11:47 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-17 00:03 - 2013-07-17 00:03 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Sony Corporation
2013-07-17 00:03 - 2013-07-17 00:03 - 00000000 ____D C:\ProgramData\kinoma
==================== One Month Modified Files and Folders =======
2013-08-14 18:26 - 2013-08-14 18:26 - 00000000 ____D C:\FRST
2013-08-14 18:12 - 2013-08-14 18:11 - 00029702 _____ C:\Users\Lise\Desktop\Report Antivir 13-08-edit.txt
2013-08-14 17:59 - 2013-08-13 09:40 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Skype
2013-08-14 17:46 - 2013-08-12 11:36 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-14 17:42 - 2012-11-29 09:39 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-14 17:40 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-14 17:40 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-14 17:39 - 2012-11-19 23:26 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Dropbox
2013-08-14 17:39 - 2011-04-12 09:43 - 00754220 _____ C:\Windows\system32\perfh007.dat
2013-08-14 17:39 - 2011-04-12 09:43 - 00172192 _____ C:\Windows\system32\perfc007.dat
2013-08-14 17:39 - 2009-07-14 07:13 - 01762696 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-14 17:36 - 2012-11-29 09:39 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-14 17:36 - 2011-08-03 18:57 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Dropbox
2013-08-14 17:33 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-14 17:33 - 2009-07-14 06:51 - 00021740 _____ C:\Windows\setupact.log
2013-08-14 17:32 - 2011-08-02 17:43 - 01384620 _____ C:\Windows\WindowsUpdate.log
2013-08-14 17:32 - 2010-11-21 05:47 - 00439350 _____ C:\Windows\PFRO.log
2013-08-13 23:07 - 2013-08-13 23:07 - 00029716 _____ C:\Users\Lise\Desktop\Report Antivir 13-08.txt
2013-08-13 21:09 - 2011-09-12 12:33 - 00000000 ____D C:\Users\Lise\AppData\Roaming\vlc
2013-08-13 19:29 - 2013-08-13 19:29 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Avira
2013-08-13 19:25 - 2013-08-13 19:25 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-13 19:23 - 2013-08-13 19:22 - 00000000 ____D C:\ProgramData\Avira
2013-08-13 18:57 - 2013-08-13 14:59 - 00000000 ____D C:\Users\Hans\AppData\Roaming\FreeFileSync
2013-08-13 18:45 - 2012-10-10 20:44 - 00000000 ____D C:\Users\Lise\AppData\Local\CloudStation
2013-08-13 18:45 - 2011-08-07 10:57 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Synology
2013-08-13 18:45 - 2011-08-02 17:42 - 00000000 ___RD C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-13 18:37 - 2013-08-13 16:58 - 00000000 ____D C:\Users\Lise\AppData\Roaming\GoodSync
2013-08-13 16:58 - 2013-08-13 16:58 - 00000000 ____D C:\ProgramData\GoodSync
2013-08-13 15:09 - 2011-08-02 17:42 - 00000000 ___RD C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-08-13 10:12 - 2013-08-13 10:12 - 00000000 ____D C:\Users\Hans\AppData\Local\HP
2013-08-13 09:40 - 2013-08-13 09:40 - 00002517 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-13 09:40 - 2013-08-13 09:40 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-13 09:40 - 2013-08-13 09:40 - 00000000 ____D C:\ProgramData\Skype
2013-08-13 04:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-13 03:32 - 2013-03-14 04:00 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-13 03:32 - 2013-03-14 04:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-08-13 03:32 - 2009-07-14 06:45 - 00568416 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-13 03:31 - 2011-04-12 09:55 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-13 03:31 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-13 03:31 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-13 03:07 - 2012-07-15 13:41 - 00000039 _____ C:\Windows\vbaddin.ini
2013-08-13 03:07 - 2011-08-04 11:01 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-12 18:19 - 2013-08-12 18:19 - 00001787 _____ C:\Users\Lise\Desktop\BatchRun.ffs_batch
2013-08-12 18:19 - 2013-08-12 17:58 - 00000000 ____D C:\Users\Lise\AppData\Roaming\FreeFileSync
2013-08-12 18:12 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-12 17:57 - 2013-08-12 17:56 - 06399776 _____ C:\Users\Lise\Downloads\FreeFileSync_5.20_Windows_Setup.exe
2013-08-12 15:48 - 2011-08-02 17:42 - 00001413 _____ C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-12 15:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-12 15:40 - 2013-08-12 15:33 - 00009228 _____ C:\Windows\IE10_main.log
2013-08-12 15:37 - 2013-08-12 15:37 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-12 15:37 - 2013-08-12 15:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-12 15:37 - 2013-08-12 15:37 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-12 15:37 - 2013-08-12 15:37 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-12 15:37 - 2013-08-12 15:37 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-12 15:37 - 2013-08-12 15:37 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-12 15:37 - 2013-08-12 15:37 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-12 15:37 - 2013-08-12 15:37 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-12 15:37 - 2013-08-12 15:37 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-12 15:37 - 2013-08-12 15:37 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-12 15:37 - 2013-08-12 15:37 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-12 11:47 - 2013-08-12 11:36 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-12 11:47 - 2012-08-16 15:06 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-12 11:47 - 2011-08-11 16:40 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-12 11:36 - 2011-08-03 10:21 - 00000000 ____D C:\Users\Lise\AppData\Local\Adobe
2013-08-12 10:39 - 2011-08-03 18:57 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-08-11 11:37 - 2012-11-29 09:39 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-08-11 11:37 - 2012-11-29 09:39 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-08-11 11:37 - 2012-11-19 23:29 - 00001017 _____ C:\Users\Hans\Desktop\Dropbox.lnk
2013-07-18 08:02 - 2013-08-13 19:22 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-18 08:02 - 2013-08-13 19:22 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-17 00:03 - 2013-07-17 00:03 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Sony Corporation
2013-07-17 00:03 - 2013-07-17 00:03 - 00000000 ____D C:\ProgramData\kinoma
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-12 17:02
==================== End Of Log ============================
--- --- --- --- --- --- Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-08-2013 01
Ran by Lise at 2013-08-14 18:27:49
Running from F:\Lise\Stuff\Downloads
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
7-Zip 4.65 (x64 edition) (Version: 4.65.00.0)
AC3Filter (remove only) (x32)
Adobe AIR (x32 Version: 1.0.4990)
Adobe AIR (x32 Version: 1.0.8.4990)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Photoshop Elements 8.0 (x32 Version: 8.0)
Adobe Premiere Elements 7.0 (x32 Version: 7.0)
Adobe Premiere Elements 7.0 (x32 Version: 7.0.0.3)
Adobe Premiere Elements 7.0 Templates (x32 Version: 7.0.0)
Adobe Reader XI - Deutsch (x32 Version: 11.0.00)
AMR to MP3 Converter 1.4 (x32)
Any Video Converter 5 5.0.4 (x32)
Apple Application Support (x32 Version: 1.3.2)
Apple Mobile Device Support (Version: 3.2.0.47)
Apple Software Update (x32 Version: 2.1.3.127)
Asmedia ASM104x USB 3.0 Host Controller Driver (x32 Version: 1.4.7.0)
ASRock eXtreme Tuner v0.1.61 (x32)
ASRock InstantBoot v1.26 (x32)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.35)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
BlackBerry Desktop Software 6.1 (x32 Version: 6.1.0.36)
Bonjour (Version: 2.0.3.0)
Canon CanoScan Toolbox 5.0 (x32)
Canon Inkjet Printer Driver Add-On Module
CanoScan LiDE 70
CDBurnerXP (x32 Version: 4.4.2.3442)
COFIB E.M.E. (x32)
Creative Software AutoUpdate (x32 Version: 1.40)
Creative-Audiokonsole (x32 Version: 1.33)
Crystal Reports Basic for Visual Studio 2008 (x32 Version: 10.5.0.0)
Crystal Reports Basic German Language Pack for Visual Studio 2008 (x32 Version: 10.5.0.0)
Crystal Reports Basic Runtime for Visual Studio 2008 (x64) (Version: 10.5.0.0)
Crystal Reports Basic Runtime German Language Pack for Visual Studio 2008 (x64) (Version: 10.5.0.0)
Crystal Reports for Visual Studio (x32 Version: 12.51.0.240)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Diagram Designer (x32)
DirSync UNICODE 2.93 (x32)
DivX-Setup (x32 Version: 2.6.1.22)
Dotfuscator Software Services - Community Edition - DEU (x32 Version: 5.0.2300.0)
Dotfuscator Software Services - Community Edition (x32 Version: 5.0.2500.0)
Dropbox (HKCU Version: 2.0.22)
EAGLE 6.4.0 (x32 Version: 6.4.0)
EASEUS Partition Master 9.1.1 Home Edition (x32)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
Evernote v. 4.5.10 (x32 Version: 4.5.10.7472)
FileZilla Client 3.6.0.2 (x32 Version: 3.6.0.2)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.27.0)
Fotogalerie (x32 Version: 16.4.3505.0912)
FreeFileSync 5.20 (x32 Version: 5.20)
FujiDirekt (x32)
gnuplot 4.6.0 (x32 Version: 4.6.0)
GoodSync (Version: 9.5.4.4)
Google Chrome (x32 Version: 28.0.1500.95)
Google Update Helper (x32 Version: 1.3.21.153)
Hotfix für Microsoft Team Foundation Server 2010-Objektmodell - DEU (KB2736182) (x32 Version: 1)
Hotfix für Microsoft Team Foundation Server 2010-Objektmodell - DEU (KB2813041) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Professional - DEU (KB2529927) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Professional - DEU (KB2548139) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Professional - DEU (KB2549864) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Professional - DEU (KB2635973) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Professional - DEU (KB2736182) (x32 Version: 1)
Hotfix für Microsoft Visual Studio 2010 Professional - DEU (KB2813041) (x32 Version: 1)
HP Officejet Pro 8100 - Grundlegende Software für das Gerät (Version: 24.0.342.0)
HP Officejet Pro 8100 Hilfe (x32 Version: 140.0.2.2)
HP Update (x32 Version: 5.003.000.004)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2291)
iTunes (Version: 10.0.1.22)
Java 7 Update 13 (x32 Version: 7.0.130)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 6 Update 20 (64-bit) (Version: 6.0.200)
Java(TM) 6 Update 29 (x32 Version: 6.0.290)
Light Image Resizer 4.3.2.2 (x32 Version: 4.3.2.2)
MAGIX Screenshare (x32 Version: 4.3.6.1987)
MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6)
MAGIX Video deluxe MX Plus Download-Version (x32 Version: 11.0.0.38)
MATLAB R2011a Student Version (x32 Version: 7.12)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (x32 Version: 12.0.4518.1014)
Microsoft .NET Compact Framework 2.0 SP2 (x32 Version: 2.0.7045)
Microsoft .NET Compact Framework 3.5 (x32 Version: 3.5.7283)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 2 - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU (x32 Version: 2.0.50331.0)
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (x32 Version: 2.0.50217.0)
Microsoft ASP.NET MVC 2 (x32 Version: 2.0.50217.0)
Microsoft Device Emulator (64 Bit) Version 3.0 - DEU (Version: 9.0.21022)
Microsoft Document Explorer 2008 (x32 Version: 9.0.21022)
Microsoft Document Explorer 2008 (x32)
Microsoft Document Explorer 2008 Language Pack - DEU (x32 Version: 9.0.21022)
Microsoft Document Explorer 2008 Language Pack - DEU (x32)
Microsoft Help Viewer 1.1 (Version: 1.1.40219)
Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office 2010 Language Pack Service Pack 1 (SP1) (x32)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Visio 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Visio MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Visual Web Developer 2007 (x32 Version: 12.0.4518.1066)
Microsoft Office Visual Web Developer MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Research Vcc 2.3.00729.0 (x32 Version: 2.3.00729.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Silverlight 3 SDK - Deutsch (x32 Version: 3.0.40818.0)
Microsoft Silverlight 4 SDK - Deutsch (x32 Version: 4.0.50826.0)
Microsoft SQL Server 2005 (x32)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS) (x32 Version: 9.4.5000.00)
Microsoft SQL Server 2008 R2 Management Objects (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2 Management Objects (x64) (Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2 Transact-SQL-Sprachdienst (x32 Version: 10.50.1752.9)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework (x32 Version: 10.50.1750.9)
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Projekt (x32 Version: 10.50.1750.9)
Microsoft SQL Server Compact 3.5 Design Tools DEU (x32 Version: 3.5.5386.0)
Microsoft SQL Server Compact 3.5 for Devices DEU (x32 Version: 3.5.5386.0)
Microsoft SQL Server Compact 3.5 SP2 DEU (x32 Version: 3.5.8080.0)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Database Publishing Wizard 1.2 (x32 Version: 1.2.0.0)
Microsoft SQL Server Database Publishing Wizard 1.4 (x32 Version: 10.1.2512.8)
Microsoft SQL Server Native Client (Version: 9.00.5000.00)
Microsoft SQL Server System CLR Types (x32 Version: 10.50.1750.9)
Microsoft SQL Server System CLR Types (x64) (Version: 10.50.1750.9)
Microsoft SQL Server VSS Writer (Version: 9.00.5000.00)
Microsoft Sync Framework Runtime v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Framework SDK v1.0 SP1 de (x32 Version: 1.0.3010.0)
Microsoft Sync Framework Services v1.0 SP1 (x64) de (Version: 1.0.3010.0)
Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) de (Version: 2.0.3010.0)
Microsoft Team Foundation Server 2010 Object Model - DEU (Version: 10.0.40219)
Microsoft Team Foundation Server 2010-Objektmodell - DEU (Version: 10.0.40219)
Microsoft Visio 2010 Service Pack 1 (SP1) (x32)
Microsoft Visio Professional 2010 (x32 Version: 14.0.6029.1000)
Microsoft Visual C++ Compilers 2010 Standard - enu - x64 (Version: 10.0.40219)
Microsoft Visual C++ Compilers 2010 Standard - enu - x86 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (x32 Version: 9.0.30729.4974)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Designtime - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x64 Runtime - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual F# 2.0 Runtime (x32 Version: 10.0.40219)
Microsoft Visual F# 2.0 Runtime Language Pack - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0)
Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack (x32 Version: 8.0.50727.42)
Microsoft Visual Studio 2005 Tools for Office Runtime Language Pack (x32)
Microsoft Visual Studio 2008 Remote Debugger - DEU
Microsoft Visual Studio 2008 Remote Debugger - DEU (Version: 9.0.21022)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 Office Developer Tools (x64) (Version: 10.0.40219)
Microsoft Visual Studio 2010 Office Developer Tools (x64) Language Pack - DEU (Version: 10.0.40219)
Microsoft Visual Studio 2010 Professional - DEU (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 Professional - DEU (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 Service Pack 1 (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 SharePoint Developer Tools (x32 Version: 10.0.40219)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.31007)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.31010)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.40308)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.31007)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (Version: 10.0.31007)
Microsoft Visual Studio Macro Tools - DEU Language Pack (x32 Version: 9.0.30729)
Microsoft Visual Studio Macro Tools (x32 Version: 9.0.30729)
Microsoft Visual Studio Web Authoring Component (x32 Version: 12.0.4518.1066)
Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools (Version: 3.5.21022)
Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries (Version: 6.1.5288.17011)
Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense (Version: 6.1.5288.17011)
Microsoft Windows SDK for Visual Studio 2008 Tools (Version: 6.1.5288.17011)
Microsoft Windows SDK for Visual Studio 2008 Win32 Tools (Version: 6.1.5288.17011)
Movie Maker (x32 Version: 16.4.3505.0912)
MozBackup 1.5.1 (x32)
Mozilla Firefox 20.0 (x86 de) (HKCU Version: 20.0)
Mozilla Firefox 4.0.1 (x86 de) (x32 Version: 4.0.1)
Mozilla Thunderbird (5.0) (x32 Version: 5.0 (de))
Mozilla Thunderbird 17.0.5 (x86 de) (HKCU Version: 17.0.5)
Mp3tag v2.48 (x32 Version: v2.48)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
ock App Charger v1.0.4
OpenAL (x32)
PDFCreator (x32 Version: 1.2.2)
pdfsam (HKCU Version: 2.2.1)
Photo Gallery (x32 Version: 16.4.3505.0912)
Pixum Fotobuch (x32)
QuickTime (x32 Version: 7.68.75.0)
Reader for PC (x32 Version: 2.0.01.11080)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6265)
scilab-5.4.0 (64-bit)
Secure Download Manager (x32 Version: 3.0.5)
Sicherheitsupdate für Microsoft Visual Studio 2010 Professional - DEU (KB2645410) (x32 Version: 1)
Skype™ 6.7 (x32 Version: 6.7.102)
Spelling Dictionaries Support For Adobe Reader 9 (x32 Version: 9.0.0)
SUPER © v2012.build.52 (July 7, 2012) Version v2012.build.52 (x32 Version: v2012.build.52)
Synology Assistant (remove only) (x32)
TextPad 5 (x32 Version: 5.4.2)
Tools für Microsoft SQL Server 2005 Express Edition (x32 Version: 9.4.5000.00)
Total Commander 64-bit (Remove or Repair) (Version: 8.01)
True Image 2013 (x32 Version: 16.0.5551)
True Image 2013 Plus Pack (x32 Version: 16.0.5551)
Unity Web Player (HKCU Version: )
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (x32 Version: 9.00.5000.00)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
Visual Studio .NET Prerequisites - English (Version: 9.0.21022)
Visual Studio 2005 Tools for Office Second Edition Runtime (x32)
Visual Studio 2010 Prerequisites - English (Version: 10.0.40219)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (x32 Version: 4.0.8080.0)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.21022)
Visual Studio Tools for the Office system 3.0 Runtime (x32)
Visual Studio Tools for the Office system 3.0 Runtime Language Pack - DEU (x32 Version: 9.0.21022)
Visual Studio-Tools für Office System 3.0 Runtime Language Pack - DEU (x32)
VLC media player 1.0.5 (x32 Version: 1.0.5)
WampServer 2.2 (x32)
WCF RIA Services V1.0 SP1 (x32 Version: 4.1.60114.0)
Web Deployment Tool (Version: 1.1.0618)
Windows 7 USB/DVD Download Tool (x32 Version: 1.0.30)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
Windows Live Essentials (x32 Version: 16.4.3505.0912)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3505.0912)
Windows Live Photo Common (x32 Version: 16.4.3505.0912)
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
Windows Live SOXE (x32 Version: 16.4.3505.0912)
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
Windows Live UX Platform (x32 Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)
Windows Mobile 5.0 SDK R2 for Pocket PC (x32 Version: 5.00.1700.5.14343.06)
Windows Mobile 5.0 SDK R2 for Smartphone (x32 Version: 5.00.1700.5.14343.06)
WinMerge 2.14.0 (x32 Version: 2.14.0)
WinSCP 4.3.8 (x32 Version: 4.3.8)
Xming 6.9.0.31 (x32 Version: 6.9.0.31)
Zotero Standalone 3.0.11.1 (x86 en-US) (x32 Version: 3.0.11.1)
Zotero Standalone 3.0.14 (x86 en-US) (HKCU Version: 3.0.14)
==================== Restore Points =========================
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-04-05 10:53 - 00001480 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {2A03BBD0-E43E-483C-91D7-F53C64193FA5} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {55E0DF7F-1694-42CA-A00A-BEDBC6024CD1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.)
Task: {6696682A-59A1-4E45-8D10-4099F6D7F78A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {74FEC44C-EDE0-4BC3-B3BC-97400522FFD8} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {8228167A-9DD0-4EEC-9247-87DE563B7E7B} - System32\Tasks\hpUrlLauncher.exe_{FCD48259-2E98-423D-B488-2BCAF5FAD5F5} => C:\Program Files\HP\HP Officejet Pro 8100\Bin\utils\hpUrlLauncher.exe [2011-05-26] (Hewlett-Packard Co.)
Task: {C6689AC3-C2A6-4F4B-A97A-5F54DBCE7AF0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-12] (Adobe Systems Incorporated)
Task: {E43DC29F-3FB8-431C-B62D-2A984E33B7C1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.)
Task: {FC34EA5F-CFC2-43DB-B78A-42562410AD28} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-21] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/14/2013 06:22:47 PM) (Source: Windows Search Service) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. 0xc0041801 (0xc0041801)
Error: (08/14/2013 06:22:47 PM) (Source: Windows Search Service) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=2350} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. 0xc0041801 (0xc0041801)
Error: (08/14/2013 05:34:43 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/14/2013 00:41:25 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 13011
Error: (08/14/2013 00:41:25 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 13011
Error: (08/14/2013 00:41:25 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/14/2013 00:41:24 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 12012
Error: (08/14/2013 00:41:24 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 12012
Error: (08/14/2013 00:41:24 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/14/2013 00:41:23 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10998
System errors:
=============
Error: (08/14/2013 05:40:56 PM) (Source: VDS Basic Provider) (User: )
Description: Unerwarteter Fehler. Fehlercode: 490@01010004
Error: (08/14/2013 04:59:22 PM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (08/13/2013 11:13:12 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR4 gefunden.
Error: (08/13/2013 11:13:11 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR4 gefunden.
Error: (08/13/2013 11:13:10 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR4 gefunden.
Error: (08/13/2013 11:13:10 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR4 gefunden.
Error: (08/13/2013 02:58:54 PM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (08/13/2013 02:58:24 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Google Update-Dienst (gupdate)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/13/2013 03:30:53 AM) (Source: DCOM) (User: )
Description: {1EF75F33-893B-4E8F-9655-C3D602BA4897}
Error: (08/12/2013 03:33:05 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Microsoft Office Sessions:
=========================
Error: (03/04/2013 10:33:54 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 252174 seconds with 34800 seconds of active time. This session ended with a crash.
Error: (03/01/2013 00:30:31 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 93882 seconds with 180 seconds of active time. This session ended with a crash.
Error: (02/22/2013 10:34:34 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 64299 seconds with 9060 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2012-08-15 09:59:13.002
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Lise\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-15 09:59:12.998
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Lise\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-15 09:59:12.723
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-08-15 09:59:12.721
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 35%
Total physical RAM: 7911.6 MB
Available physical RAM: 5090.73 MB
Total Pagefile: 15821.39 MB
Available Pagefile: 12792.06 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:68.25 GB) (Free:8.78 GB) NTFS (Disk=1 Partition=2)
Drive d: () (Fixed) (Total:29.3 GB) (Free:15.17 GB) NTFS (Disk=1 Partition=3)
Drive e: () (Fixed) (Total:368.1 GB) (Free:280.07 GB) NTFS (Disk=1 Partition=4)
Drive f: (Lokaler Datenträger F) (Fixed) (Total:931.51 GB) (Free:505.35 GB) NTFS (Disk=0 Partition=1)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 0008C49A)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 3CC427D2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=68 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=368 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
15.08.2013, 08:11
| #4 | |
| /// the machine /// TB-Ausbilder | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt Also du kannst auf alle Platten und Partitionen zugreifen? Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.08.2013, 08:42
| #5 |
| | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt Ja, ich kann auf alle Platten und Partitionen ohne Einschränkungen zugreifen. Nur die Namen der Partitionen sind halt so komisch. Hier das Combofix Logfile: Combofix Logfile: Code:
ATTFilter ComboFix 13-08-14.02 - Lise 15.08.2013 9:18.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.7912.5934 [GMT 2:00]
ausgeführt von:: c:\users\Lise\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.dat
c:\windows\SysWow64\html
c:\windows\SysWow64\html\calendar.html
c:\windows\SysWow64\html\calendarbottom.html
c:\windows\SysWow64\html\calendartop.html
c:\windows\SysWow64\html\crystalexportdialog.htm
c:\windows\SysWow64\html\crystalprinthost.html
c:\windows\SysWow64\images
c:\windows\SysWow64\images\toolbar\calendar.gif
c:\windows\SysWow64\images\toolbar\crlogo.gif
c:\windows\SysWow64\images\toolbar\export.gif
c:\windows\SysWow64\images\toolbar\export_over.gif
c:\windows\SysWow64\images\toolbar\exportd.gif
c:\windows\SysWow64\images\toolbar\First.gif
c:\windows\SysWow64\images\toolbar\first_over.gif
c:\windows\SysWow64\images\toolbar\Firstd.gif
c:\windows\SysWow64\images\toolbar\gotopage.gif
c:\windows\SysWow64\images\toolbar\gotopage_over.gif
c:\windows\SysWow64\images\toolbar\gotopaged.gif
c:\windows\SysWow64\images\toolbar\grouptree.gif
c:\windows\SysWow64\images\toolbar\grouptree_over.gif
c:\windows\SysWow64\images\toolbar\grouptreed.gif
c:\windows\SysWow64\images\toolbar\grouptreepressed.gif
c:\windows\SysWow64\images\toolbar\Last.gif
c:\windows\SysWow64\images\toolbar\last_over.gif
c:\windows\SysWow64\images\toolbar\Lastd.gif
c:\windows\SysWow64\images\toolbar\Next.gif
c:\windows\SysWow64\images\toolbar\next_over.gif
c:\windows\SysWow64\images\toolbar\Nextd.gif
c:\windows\SysWow64\images\toolbar\Prev.gif
c:\windows\SysWow64\images\toolbar\prev_over.gif
c:\windows\SysWow64\images\toolbar\Prevd.gif
c:\windows\SysWow64\images\toolbar\print.gif
c:\windows\SysWow64\images\toolbar\print_over.gif
c:\windows\SysWow64\images\toolbar\printd.gif
c:\windows\SysWow64\images\toolbar\Refresh.gif
c:\windows\SysWow64\images\toolbar\refresh_over.gif
c:\windows\SysWow64\images\toolbar\refreshd.gif
c:\windows\SysWow64\images\toolbar\Search.gif
c:\windows\SysWow64\images\toolbar\search_over.gif
c:\windows\SysWow64\images\toolbar\searchd.gif
c:\windows\SysWow64\images\toolbar\up.gif
c:\windows\SysWow64\images\toolbar\up_over.gif
c:\windows\SysWow64\images\toolbar\upd.gif
c:\windows\SysWow64\images\tree\begindots.gif
c:\windows\SysWow64\images\tree\beginminus.gif
c:\windows\SysWow64\images\tree\beginplus.gif
c:\windows\SysWow64\images\tree\blank.gif
c:\windows\SysWow64\images\tree\blankdots.gif
c:\windows\SysWow64\images\tree\dots.gif
c:\windows\SysWow64\images\tree\lastdots.gif
c:\windows\SysWow64\images\tree\lastminus.gif
c:\windows\SysWow64\images\tree\lastplus.gif
c:\windows\SysWow64\images\tree\Magnify.gif
c:\windows\SysWow64\images\tree\minus.gif
c:\windows\SysWow64\images\tree\minusbox.gif
c:\windows\SysWow64\images\tree\plus.gif
c:\windows\SysWow64\images\tree\plusbox.gif
c:\windows\SysWow64\images\tree\singleminus.gif
c:\windows\SysWow64\images\tree\singleplus.gif
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-15 bis 2013-08-15 ))))))))))))))))))))))))))))))
.
.
2013-08-15 07:22 . 2013-08-15 07:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-15 07:22 . 2013-08-15 07:22 -------- d-----w- c:\users\Hans\AppData\Local\temp
2013-08-15 01:00 . 2013-08-15 01:02 -------- d-----w- c:\windows\system32\MRT
2013-08-14 16:26 . 2013-08-14 16:26 -------- d-----w- C:\FRST
2013-08-13 17:29 . 2013-08-13 17:29 -------- d-----w- c:\users\Lise\AppData\Roaming\Avira
2013-08-13 17:25 . 2013-08-13 17:25 83672 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-08-13 17:22 . 2013-08-13 17:23 -------- d-----w- c:\programdata\Avira
2013-08-13 17:22 . 2013-07-18 06:02 130016 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-08-13 17:22 . 2013-07-18 06:02 100712 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-08-13 17:22 . 2013-03-06 14:13 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-08-13 14:58 . 2013-08-13 14:58 -------- d-----w- c:\programdata\GoodSync
2013-08-13 14:58 . 2013-08-13 16:37 -------- d-----w- c:\users\Lise\AppData\Roaming\GoodSync
2013-08-13 13:10 . 2013-07-15 01:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0147BCAA-B0CC-446B-B26E-7E9D742E1393}\mpengine.dll
2013-08-13 12:59 . 2013-08-13 16:57 -------- d-----w- c:\users\Hans\AppData\Roaming\FreeFileSync
2013-08-13 08:12 . 2013-08-13 08:12 -------- d-----w- c:\users\Hans\AppData\Local\HP
2013-08-13 08:11 . 2013-08-13 08:11 -------- d-----w- c:\users\Hans\AppData\Local\ElevatedDiagnostics
2013-08-13 07:40 . 2013-08-15 01:00 -------- d-----w- c:\users\Hans\AppData\Roaming\Skype
2013-08-13 07:40 . 2013-08-13 07:40 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-08-13 07:40 . 2013-08-13 07:40 -------- d-----r- c:\program files (x86)\Skype
2013-08-13 07:40 . 2013-08-13 07:40 -------- d-----w- c:\programdata\Skype
2013-08-12 15:58 . 2013-08-12 16:19 -------- d-----w- c:\users\Lise\AppData\Roaming\FreeFileSync
2013-08-12 14:16 . 2013-06-05 03:34 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-08-12 14:14 . 2013-04-25 23:30 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll
2013-08-12 14:14 . 2013-03-31 22:52 1887232 ----a-w- c:\windows\system32\d3d11.dll
2013-07-16 22:03 . 2013-07-16 22:03 -------- d-----w- c:\users\Hans\AppData\Roaming\Sony Corporation
2013-07-16 22:03 . 2013-07-16 22:03 -------- d-----w- c:\programdata\kinoma
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-15 01:00 . 2013-01-11 08:44 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-08-13 01:15 . 2012-07-29 12:41 2391520 ----a-w- c:\programdata\Microsoft\VisualStudio\10.0\1031\ResourceCache.dll
2013-08-12 09:47 . 2012-08-16 13:06 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-12 09:47 . 2011-08-11 14:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-11 09:20 . 2012-07-17 13:37 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-07-09 04:45 . 2013-08-14 15:17 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2006-05-03 10:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Lise\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Lise\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Lise\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\daemon tools lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AsioThk32Reg"="CTASIO.DLL" [2010-03-18 47104]
"CTHelper"="CTHELPER.EXE" [2010-03-18 19456]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="d:\itunes\iTunesHelper.exe" [2010-09-24 421160]
"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-09-01 90448]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]
"TrayServer"="d:\magix video deluxe mx plus\TrayServer_de.exe" [2008-08-07 90112]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2012-11-30 1263512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Reader Application Helper"="d:\sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2012-11-08 898952]
"TrueImageMonitor.exe"="d:\acronis\TrueImageHome\TrueImageMonitor.exe" [2012-08-23 6049096]
"AcronisTibMounterMonitor"="c:\program files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe" [2012-07-24 943856]
"avgnt"="d:\avira\AntiVir Desktop\avgnt.exe" [2013-07-18 345144]
.
c:\users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Lise\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
EvernoteClipper.lnk - d:\evernote\EvernoteClipper.exe [2012-10-26 1017184]
.
c:\users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Lise\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
EvernoteClipper.lnk - d:\evernote\EvernoteClipper.exe [2012-10-26 1017184]
Tintenwarnungen überwachen - HP Officejet Pro 8100 (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Officejet Pro 8100\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN1981T1ZC05MX;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.SYS;c:\windows\SYSNATIVE\drivers\COMMONFX.SYS [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.SYS;c:\windows\SYSNATIVE\drivers\CTAUDFX.SYS [x]
R3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\System32\drivers\CTERFXFX.SYS;c:\windows\SYSNATIVE\drivers\CTERFXFX.SYS [x]
R3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.SYS;c:\windows\SYSNATIVE\drivers\CTERFXFX.SYS [x]
R3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.SYS;c:\windows\SYSNATIVE\drivers\CTSBLFX.SYS [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;d:\avira\AntiVir Desktop\AVWEBGRD.EXE;d:\avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S0 tib_mounter;Acronis TIB Mounter;c:\windows\system32\DRIVERS\tib_mounter.sys;c:\windows\SYSNATIVE\DRIVERS\tib_mounter.sys [x]
S0 vididr;Acronis Virtual Disk;c:\windows\system32\DRIVERS\vididr.sys;c:\windows\SYSNATIVE\DRIVERS\vididr.sys [x]
S0 vidsflt;Acronis Disk Storage Filter;c:\windows\system32\DRIVERS\vidsflt.sys;c:\windows\SYSNATIVE\DRIVERS\vidsflt.sys [x]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AsrAppCharger.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;d:\adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe;d:\adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [x]
S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S2 AntiVirSchedulerService;Avira Planer;d:\avira\AntiVir Desktop\sched.exe;d:\avira\AntiVir Desktop\sched.exe [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S2 GsServer;GoodSync Server;d:\goodsync\Gs-Server.exe;d:\goodsync\Gs-Server.exe [x]
S2 syncagentsrv;Acronis Sync Agent Service;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\System32\drivers\COMMONFX.SYS;c:\windows\SYSNATIVE\drivers\COMMONFX.SYS [x]
S3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\System32\drivers\CTAUDFX.SYS;c:\windows\SYSNATIVE\drivers\CTAUDFX.SYS [x]
S3 ctgame;Game Port;c:\windows\system32\DRIVERS\ctgame.sys;c:\windows\SYSNATIVE\DRIVERS\ctgame.sys [x]
S3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\System32\drivers\CTSBLFX.SYS;c:\windows\SYSNATIVE\drivers\CTSBLFX.SYS [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-12 08:52 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-16 09:47]
.
2013-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29 07:39]
.
2013-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29 07:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncError]
@="{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED}"
[HKEY_CLASSES_ROOT\CLSID\{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED}]
2012-08-23 01:51 2741024 ----a-w- d:\acronis\TrueImageHome\tishell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncInProgress]
@="{00F848DC-B1D4-4892-9C25-CAADC86A215D}"
[HKEY_CLASSES_ROOT\CLSID\{00F848DC-B1D4-4892-9C25-CAADC86A215D}]
2012-08-23 01:51 2741024 ----a-w- d:\acronis\TrueImageHome\tishell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncOk]
@="{71573297-552E-46fc-BE3D-3DFAF88D47B7}"
[HKEY_CLASSES_ROOT\CLSID\{71573297-552E-46fc-BE3D-3DFAF88D47B7}]
2012-08-23 01:51 2741024 ----a-w- d:\acronis\TrueImageHome\tishell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Lise\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Lise\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Lise\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Lise\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-12-09 11663976]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-10-10 171040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-10-10 399392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-10-10 441888]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2012-08-23 403888]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Evernote 4.0 - d:\evernote\EvernoteIE.dll/204
IE: Nach Microsoft E&xel exportieren - d:\micros~1\Office12\EXCEL.EXE/3000
LSP: d:\avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.1.1 193.189.244.202 193.189.244.194
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
FF - ProfilePath - c:\users\Lise\AppData\Roaming\Mozilla\Firefox\Profiles\qyj6ozs5.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-ASRockXTU - (no file)
Wow6432Node-HKCU-Run-zASRockInstantBoot - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CloudStation.lnk - c:\users\Lise\AppData\Local\CloudStation\bin\cloud.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-DirSync - d:\dirsync\uninstall.exe
AddRemove-WampServer 2_is1 - f:\Hans\wamp\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
@Denied: (A) (Everyone)
"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
"Key"="ActionsPane"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-15 09:24:18
ComboFix-quarantined-files.txt 2013-08-15 07:24
.
Vor Suchlauf: 8.547.012.608 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 12.882.251.776 Bytes frei
.
- - End Of File - - 5F98936E7D7372E252231BA5289B1B35
--- --- ---
0792F22BCC85CFD3B28324561FFFCABB
Ich habe mal ein Bild angefügt, wie das im Explorer bei mir aussieht.  |
|
15.08.2013, 14:22
| #6 |
| /// the machine /// TB-Ausbilder | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte. Versuch mal in der Datenträgerverwaltung Namen zu vergeben. Werden diese dann beibehalten?
__________________ --> Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt |
|
15.08.2013, 15:08
| #7 |
| | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt malware-log: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.15.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 Lise :: Lise-PC [Administrator] 15.08.2013 15:30:15 mbam-log-2013-08-15 (15-30-15).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 253735 Laufzeit: 3 Minute(n), 4 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\Lise\Downloads\FreeFileSync_5.20_Windows_Setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 15/08/2013 um 15:39:38 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Lise - Lise-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Lise\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\ProgramData\DeviceVM
Ordner Gelöscht : C:\Users\Lise\AppData\Roaming\DeviceVM
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16660
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v4.0.1 (de)
Datei : C:\Users\Lise\AppData\Roaming\Mozilla\Firefox\Profiles\qyj6ozs5.default\prefs.js
[OK] Die Datei ist sauber.
Datei : C:\Users\Hans\AppData\Roaming\Mozilla\Firefox\Profiles\g7uw94sb.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Google Chrome v28.0.1500.95
Datei : C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
Datei : C:\Users\Hans\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [1458 octets] - [15/08/2013 15:39:38]
########## EOF - C:\AdwCleaner[S1].txt - [1518 octets] ##########
JRT-log: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.4.6 (08.15.2013:1)
OS: Windows 7 Professional x64
Ran by Lise on 15.08.2013 at 15:47:31,10
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\powerpack
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_smartdraw_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_smartdraw_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_fuer_smartdraw_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_fuer_smartdraw_RASMANCS
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.08.2013 at 15:51:24,14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-08-2013 01
Ran by Lise (administrator) on 15-08-2013 15:53:19
Running from F:\Lise\Stuff\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\sched.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Adobe Systems Incorporated) D:\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
() D:\GoodSync\Gs-Server.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(DT Soft Ltd) D:\Daemon Tools Lite\DTLite.exe
(Dropbox, Inc.) C:\Users\Lise\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) D:\Evernote\EvernoteClipper.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CtHelper.exe
(Apple Inc.) D:\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Sony Corporation) D:\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Acronis) D:\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Avira Operations GmbH & Co. KG) D:\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11663976 2010-12-09] (Realtek Semiconductor)
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [403888 2012-08-23] (Acronis)
HKCU\...\Run: [DAEMON Tools Lite] - D:\Daemon Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKLM-x32\...\Run: [AsioThk32Reg] - REGSVR32.EXE /S CTASIO.DLL [x]
HKLM-x32\...\Run: [CTHelper] - C:\Windows\\SysWOW64\CTHELPER.EXE [19456 2010-03-18] (Creative Technology Ltd)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-09-08] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes\iTunesHelper.exe [421160 2010-09-24] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-09-01] (Research In Motion Limited)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [TrayServer] - D:\Magix Video deluxe MX Plus\TrayServer_de.exe [90112 2008-08-07] (MAGIX AG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263512 2012-11-30] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [898952 2012-11-08] (Sony Corporation)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - D:\Acronis\TrueImageHome\TrueImageMonitor.exe [6049096 2012-08-23] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] - C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [943856 2012-07-24] (Acronis)
HKLM-x32\...\Run: [avgnt] - D:\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-18] (Avira Operations GmbH & Co. KG)
HKU\Hans\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20681584 2013-07-25] (Skype Technologies S.A.)
Startup: C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Lise\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> D:\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
Startup: C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8100 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8100 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8100\bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Lise\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> D:\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog9 01 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 D:\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 01 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 02 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 03 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 04 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 05 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 06 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 07 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 08 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9-x64 19 D:\Avira\AntiVir Desktop\avsda64.dll [231480] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194
FireFox:
========
FF ProfilePath: C:\Users\Lise\AppData\Roaming\Mozilla\Firefox\Profiles\qyj6ozs5.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - D:\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - D:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - D:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Lise\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: zotero - C:\Users\Lise\AppData\Roaming\Mozilla\Firefox\Profiles\qyj6ozs5.default\Extensions\zotero@chnm.gmu.edu.xpi
FF Extension: No Name - C:\Users\Lise\AppData\Roaming\Mozilla\Firefox\Profiles\qyj6ozs5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF StartMenuInternet: FIREFOX.EXE - D:\Mozilla Firefox\firefox.exe
Chrome:
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RIM Handheld Application Loader) - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office 2010) - D:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - D:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (Google Drive) - C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Lise\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 AdobeActiveFileMonitor8.0; D:\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [169312 2009-10-09] (Adobe Systems Incorporated)
R2 AntiVirSchedulerService; D:\Avira\AntiVir Desktop\sched.exe [84024 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; D:\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-18] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; D:\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-18] (Avira Operations GmbH & Co. KG)
R2 GsServer; D:\GoodSync\Gs-Server.exe [5966480 2013-07-11] ()
R2 MSSQL$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4466688 2007-11-08] (Microsoft Corporation)
S3 wampapache; "F:\Hans\wamp\bin\apache\apache2.2.22\bin\httpd.exe" -k runservice [x]
S3 wampmysqld; F:\Hans\wamp\bin\mysql\mysql5.5.24\bin\mysqld.exe wampmysqld [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-07-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-07-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-06] (Avira Operations GmbH & Co. KG)
R3 ctgame; C:\Windows\System32\DRIVERS\ctgame.sys [26328 2010-03-18] (Creative Technology Ltd.)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] ()
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74752 2011-07-25] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2011-08-03] ()
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [1093256 2013-04-05] (Acronis)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [166024 2013-04-05] (Acronis)
U3 alht90k7; C:\Windows\System32\Drivers\alht90k7.sys [0 ] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-15 15:51 - 2013-08-15 15:51 - 00001436 _____ C:\Users\Lise\Desktop\JRT.txt
2013-08-15 15:47 - 2013-08-15 15:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-15 15:39 - 2013-08-15 15:40 - 00001585 _____ C:\AdwCleaner[S1].txt
2013-08-15 15:39 - 2013-08-15 15:31 - 00666633 _____ C:\Users\Lise\Desktop\adwcleaner.exe
2013-08-15 15:31 - 2013-08-15 15:31 - 01159319 _____ (Thisisu) C:\Users\Lise\Desktop\JRT.exe
2013-08-15 15:27 - 2013-08-15 15:27 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Malwarebytes
2013-08-15 15:27 - 2013-08-15 15:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-15 15:27 - 2013-08-15 15:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-15 15:27 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-15 09:31 - 2013-08-15 09:31 - 00027351 _____ C:\Users\Lise\Desktop\ComboFix.txt
2013-08-15 09:24 - 2013-08-15 09:24 - 00027377 _____ C:\ComboFix.txt
2013-08-15 09:18 - 2013-08-15 09:24 - 00000000 ____D C:\Qoobox
2013-08-15 09:18 - 2013-08-15 09:24 - 00000000 ____D C:\ComboFix
2013-08-15 09:18 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-15 09:18 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-15 09:18 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-15 09:18 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-15 09:18 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-15 09:18 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-15 09:18 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-15 09:18 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-15 09:17 - 2013-08-15 09:23 - 00000000 ____D C:\Windows\erdnt
2013-08-15 09:15 - 2013-08-15 09:15 - 05104931 ____R (Swearware) C:\Users\Lise\Desktop\ComboFix.exe
2013-08-15 03:05 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 03:05 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 03:05 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 03:05 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 03:05 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 03:05 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 03:05 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 03:05 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 03:05 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 03:05 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 03:05 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 03:05 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 03:05 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 03:05 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 03:00 - 2013-08-15 03:02 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 18:26 - 2013-08-14 18:26 - 00000000 ____D C:\FRST
2013-08-14 18:11 - 2013-08-14 18:12 - 00029702 _____ C:\Users\Lise\Desktop\Report Antivir 13-08-edit.txt
2013-08-14 17:17 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 17:17 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 17:17 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 17:17 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 17:17 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 17:17 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 17:17 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 17:17 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 17:17 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 17:17 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 17:17 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 17:17 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 17:17 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 17:17 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 17:17 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 17:17 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 17:17 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 17:17 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 17:17 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 17:17 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 17:17 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 17:17 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 17:17 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 17:17 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 17:17 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 17:17 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 17:17 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 23:07 - 2013-08-13 23:07 - 00029716 _____ C:\Users\Lise\Desktop\Report Antivir 13-08.txt
2013-08-13 19:29 - 2013-08-13 19:29 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Avira
2013-08-13 19:25 - 2013-08-13 19:25 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-13 19:22 - 2013-08-13 19:23 - 00000000 ____D C:\ProgramData\Avira
2013-08-13 19:22 - 2013-07-18 08:02 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-13 19:22 - 2013-07-18 08:02 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-13 19:22 - 2013-03-06 16:13 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-13 16:58 - 2013-08-13 18:37 - 00000000 ____D C:\Users\Lise\AppData\Roaming\GoodSync
2013-08-13 16:58 - 2013-08-13 16:58 - 00000000 ____D C:\ProgramData\GoodSync
2013-08-13 14:59 - 2013-08-13 18:57 - 00000000 ____D C:\Users\Hans\AppData\Roaming\FreeFileSync
2013-08-13 10:12 - 2013-08-13 10:12 - 00000000 ____D C:\Users\Hans\AppData\Local\HP
2013-08-13 09:40 - 2013-08-15 03:00 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Skype
2013-08-13 09:40 - 2013-08-13 09:40 - 00002517 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-13 09:40 - 2013-08-13 09:40 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-13 09:40 - 2013-08-13 09:40 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 18:19 - 2013-08-12 18:19 - 00001787 _____ C:\Users\Lise\Desktop\BatchRun.ffs_batch
2013-08-12 17:58 - 2013-08-12 18:19 - 00000000 ____D C:\Users\Lise\AppData\Roaming\FreeFileSync
2013-08-12 16:17 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-08-12 16:17 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-08-12 16:17 - 2013-04-12 16:45 - 01656680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2013-08-12 16:17 - 2013-04-10 08:01 - 00983400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-08-12 16:17 - 2013-04-10 08:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2013-08-12 16:17 - 2013-03-19 07:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-08-12 16:17 - 2013-03-19 07:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2013-08-12 16:17 - 2013-02-27 08:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2013-08-12 16:17 - 2013-02-27 07:52 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-08-12 16:17 - 2013-02-27 07:52 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-08-12 16:17 - 2013-02-27 07:48 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-08-12 16:17 - 2013-02-27 07:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2013-08-12 16:17 - 2013-02-27 06:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-08-12 16:17 - 2013-02-27 06:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-08-12 16:17 - 2013-02-27 06:49 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-08-12 16:17 - 2013-02-15 08:08 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-08-12 16:17 - 2013-02-15 08:06 - 03717632 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-12 16:17 - 2013-02-15 08:02 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-08-12 16:17 - 2013-02-15 06:37 - 03217408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-12 16:17 - 2013-02-15 06:34 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-08-12 16:17 - 2013-02-15 05:25 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-08-12 16:17 - 2011-02-03 13:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-08-12 16:16 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-08-12 16:16 - 2013-05-13 07:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-08-12 16:16 - 2013-05-13 05:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-08-12 16:16 - 2013-05-13 05:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-08-12 16:16 - 2013-05-13 05:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-08-12 16:16 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-08-12 16:16 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-08-12 16:16 - 2013-04-26 07:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-08-12 16:16 - 2013-04-26 06:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-08-12 16:16 - 2013-04-17 09:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-08-12 16:16 - 2013-04-17 08:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-08-12 16:16 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-08-12 16:16 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-08-12 16:16 - 2013-03-19 07:46 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-08-12 16:16 - 2013-03-19 06:47 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-08-12 16:16 - 2013-03-19 05:06 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-08-12 16:16 - 2013-01-24 08:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2013-08-12 16:14 - 2013-04-26 01:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-08-12 16:14 - 2013-04-01 00:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-12 15:37 - 2013-08-12 15:37 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-12 15:37 - 2013-08-12 15:37 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-12 15:37 - 2013-08-12 15:37 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-12 15:37 - 2013-08-12 15:37 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-12 15:37 - 2013-08-12 15:37 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-12 15:37 - 2013-08-12 15:37 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-12 15:37 - 2013-08-12 15:37 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-12 15:37 - 2013-08-12 15:37 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-12 15:33 - 2013-08-12 15:40 - 00009228 _____ C:\Windows\IE10_main.log
2013-08-12 11:36 - 2013-08-15 15:46 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-12 11:36 - 2013-08-12 11:47 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-17 00:03 - 2013-07-17 00:03 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Sony Corporation
2013-07-17 00:03 - 2013-07-17 00:03 - 00000000 ____D C:\ProgramData\kinoma
==================== One Month Modified Files and Folders =======
2013-08-15 15:51 - 2013-08-15 15:51 - 00001436 _____ C:\Users\Lise\Desktop\JRT.txt
2013-08-15 15:50 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-15 15:50 - 2009-07-14 06:45 - 00021808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-15 15:47 - 2013-08-15 15:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-15 15:47 - 2011-04-12 09:43 - 00754220 _____ C:\Windows\system32\perfh007.dat
2013-08-15 15:47 - 2011-04-12 09:43 - 00172192 _____ C:\Windows\system32\perfc007.dat
2013-08-15 15:47 - 2009-07-14 07:13 - 01762696 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-15 15:46 - 2013-08-12 11:36 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-15 15:43 - 2011-08-03 18:57 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Dropbox
2013-08-15 15:42 - 2012-11-29 09:39 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-15 15:42 - 2010-11-21 05:47 - 00440620 _____ C:\Windows\PFRO.log
2013-08-15 15:42 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-15 15:42 - 2009-07-14 06:51 - 00021908 _____ C:\Windows\setupact.log
2013-08-15 15:41 - 2011-08-02 17:43 - 01990269 _____ C:\Windows\WindowsUpdate.log
2013-08-15 15:40 - 2013-08-15 15:39 - 00001585 _____ C:\AdwCleaner[S1].txt
2013-08-15 15:31 - 2013-08-15 15:39 - 00666633 _____ C:\Users\Lise\Desktop\adwcleaner.exe
2013-08-15 15:31 - 2013-08-15 15:31 - 01159319 _____ (Thisisu) C:\Users\Lise\Desktop\JRT.exe
2013-08-15 15:27 - 2013-08-15 15:27 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Malwarebytes
2013-08-15 15:27 - 2013-08-15 15:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-15 15:27 - 2013-08-15 15:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-15 15:23 - 2012-11-29 09:39 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-15 09:31 - 2013-08-15 09:31 - 00027351 _____ C:\Users\Lise\Desktop\ComboFix.txt
2013-08-15 09:24 - 2013-08-15 09:24 - 00027377 _____ C:\ComboFix.txt
2013-08-15 09:24 - 2013-08-15 09:18 - 00000000 ____D C:\Qoobox
2013-08-15 09:24 - 2013-08-15 09:18 - 00000000 ____D C:\ComboFix
2013-08-15 09:24 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-15 09:23 - 2013-08-15 09:17 - 00000000 ____D C:\Windows\erdnt
2013-08-15 09:22 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-15 09:15 - 2013-08-15 09:15 - 05104931 ____R (Swearware) C:\Users\Lise\Desktop\ComboFix.exe
2013-08-15 04:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 03:05 - 2011-08-04 11:01 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 03:02 - 2013-08-15 03:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 03:00 - 2013-08-13 09:40 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Skype
2013-08-15 03:00 - 2013-01-11 10:44 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 18:26 - 2013-08-14 18:26 - 00000000 ____D C:\FRST
2013-08-14 18:12 - 2013-08-14 18:11 - 00029702 _____ C:\Users\Lise\Desktop\Report Antivir 13-08-edit.txt
2013-08-14 17:39 - 2012-11-19 23:26 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Dropbox
2013-08-13 23:07 - 2013-08-13 23:07 - 00029716 _____ C:\Users\Lise\Desktop\Report Antivir 13-08.txt
2013-08-13 21:09 - 2011-09-12 12:33 - 00000000 ____D C:\Users\Lise\AppData\Roaming\vlc
2013-08-13 19:29 - 2013-08-13 19:29 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Avira
2013-08-13 19:25 - 2013-08-13 19:25 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-13 19:23 - 2013-08-13 19:22 - 00000000 ____D C:\ProgramData\Avira
2013-08-13 18:57 - 2013-08-13 14:59 - 00000000 ____D C:\Users\Hans\AppData\Roaming\FreeFileSync
2013-08-13 18:45 - 2012-10-10 20:44 - 00000000 ____D C:\Users\Lise\AppData\Local\CloudStation
2013-08-13 18:45 - 2011-08-07 10:57 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Synology
2013-08-13 18:45 - 2011-08-02 17:42 - 00000000 ___RD C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-13 18:37 - 2013-08-13 16:58 - 00000000 ____D C:\Users\Lise\AppData\Roaming\GoodSync
2013-08-13 16:58 - 2013-08-13 16:58 - 00000000 ____D C:\ProgramData\GoodSync
2013-08-13 15:09 - 2011-08-02 17:42 - 00000000 ___RD C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-08-13 10:12 - 2013-08-13 10:12 - 00000000 ____D C:\Users\Hans\AppData\Local\HP
2013-08-13 09:40 - 2013-08-13 09:40 - 00002517 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-13 09:40 - 2013-08-13 09:40 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-13 09:40 - 2013-08-13 09:40 - 00000000 ____D C:\ProgramData\Skype
2013-08-13 03:32 - 2013-03-14 04:00 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-13 03:32 - 2013-03-14 04:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-08-13 03:32 - 2009-07-14 06:45 - 00568416 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-13 03:31 - 2011-04-12 09:55 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-13 03:31 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-13 03:31 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-13 03:07 - 2012-07-15 13:41 - 00000039 _____ C:\Windows\vbaddin.ini
2013-08-12 18:19 - 2013-08-12 18:19 - 00001787 _____ C:\Users\Lise\Desktop\BatchRun.ffs_batch
2013-08-12 18:19 - 2013-08-12 17:58 - 00000000 ____D C:\Users\Lise\AppData\Roaming\FreeFileSync
2013-08-12 18:12 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-12 15:48 - 2011-08-02 17:42 - 00001413 _____ C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-12 15:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-12 15:40 - 2013-08-12 15:33 - 00009228 _____ C:\Windows\IE10_main.log
2013-08-12 15:37 - 2013-08-12 15:37 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-12 15:37 - 2013-08-12 15:37 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-12 15:37 - 2013-08-12 15:37 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-08-12 15:37 - 2013-08-12 15:37 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-12 15:37 - 2013-08-12 15:37 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-12 15:37 - 2013-08-12 15:37 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-12 15:37 - 2013-08-12 15:37 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-12 15:37 - 2013-08-12 15:37 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-08-12 15:37 - 2013-08-12 15:37 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-12 15:37 - 2013-08-12 15:37 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-12 15:37 - 2013-08-12 15:37 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-12 11:47 - 2013-08-12 11:36 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-12 11:47 - 2012-08-16 15:06 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-12 11:47 - 2011-08-11 16:40 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-12 11:36 - 2011-08-03 10:21 - 00000000 ____D C:\Users\Lise\AppData\Local\Adobe
2013-08-12 10:39 - 2011-08-03 18:57 - 00000000 ____D C:\Users\Lise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-08-11 11:37 - 2012-11-29 09:39 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-08-11 11:37 - 2012-11-29 09:39 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-08-11 11:37 - 2012-11-19 23:29 - 00001017 _____ C:\Users\Hans\Desktop\Dropbox.lnk
2013-07-26 07:13 - 2013-08-15 03:05 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-15 03:05 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-15 03:05 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-15 03:05 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-15 03:05 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-15 03:05 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-15 03:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-15 03:05 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-15 03:05 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-15 03:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-15 03:05 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-15 03:05 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 04:39 - 2013-08-15 03:05 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-26 03:59 - 2013-08-15 03:05 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 11:25 - 2013-08-14 17:17 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-25 10:57 - 2013-08-14 17:17 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-19 03:58 - 2013-08-14 17:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-07-19 03:41 - 2013-08-14 17:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-07-18 08:02 - 2013-08-13 19:22 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-18 08:02 - 2013-08-13 19:22 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-17 00:03 - 2013-07-17 00:03 - 00000000 ____D C:\Users\Hans\AppData\Roaming\Sony Corporation
2013-07-17 00:03 - 2013-07-17 00:03 - 00000000 ____D C:\ProgramData\kinoma
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-12 17:02
==================== End Of Log ============================
--- --- --- In der Datenträgerverwaltung konnte ich die Partitionen umbenennen, die Bezeichnungen bleiben auch nach einem Neustart bestehen. Allerdings fehlen im Windows Explorer immernoch die Laufwerksbuchstaben, die Partitionen werden auch in der falschen Reihenfolge angezeigt.  |
|
15.08.2013, 18:47
| #8 |
| /// the machine /// TB-Ausbilder | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt Entgegen dem letzten Bild bitte alles anhaken. Downloade dir bitte Windows Repair (All In One) von hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.08.2013, 20:39
| #9 |
| | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt Hat leider nichts gebracht, die Laufwerksbuchstaben werden immer noch nicht angezeigt...  Okey, ich bin jetzt noch mal anders gegoogelt. Offentsichtlich habe ich ausversehen in den Ordneroptionen das Häckchen bei "Laufwerksbuchstabe anzeigen" rausgenommen.  Die Buchstaben werden jetzt wieder richtig angezeigt. Naja, ich denke mal ich bin dann jetzt aber auch wirklich sauber, oder? Sorry, für die Umstände! |
|
15.08.2013, 21:57
| #10 |
| /// the machine /// TB-Ausbilder | Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt Supi  ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Partitionen selbständig zu "Volume ohne Bezeichnung" umbenannt |
| adware/speedingupmypc.c, antivir, desktop, dllhost.exe, exp/asf.getcodec.gen, exp/js.expack.eb, explorer, externe festplatte, festplatte, helper.exe, internet, microsoft, ordner, problem, programm, prozesse, pup.optional.opencandy, registry, rundll, services.exe, svchost.exe, taskhost.exe, tr/rogue.7944516, windows, winlogon.exe, wuauclt.exe |
Linear-Darstellung
