| |
| |||||||
Log-Analyse und Auswertung: Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.09.2013, 20:03
| #1 |
| |  Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer Hallo werte Helfer und Helferinnen, wie Ihr gleich bemerken werdet, bin ich was Viren und Schutz anbelangt ein Laie. Und eigentlich viel zu alt für diesen S... .Avira Free Antivir hat auf meinem Rechner TR/Xcrypt.Xpack.8884 gefunden. Mein Rechner wird geringfügig geschäftlich genutzt. Der Rechner erscheint mir langsamer, rechnet immer wieder an irgendwas herum und der Internet-Traffic scheint auch zäher zu sein. Das scheint mir aber schon etwas länger der Fall zu sein. Vielleich 4-6 Wochen. Ich hatte aber keine Befallsmeldungen und der Virenscanner ist immer up to date. Mglw. bilde ich mir das auch nur ein. Ich gebe es zu: Ich sorge mich gerade jetzt um die Schäden, die durch den Befall verursacht werden können. Was macht dieses Programm? Ausspähen von Kontakten, Beschädigung von Dateien, Massenmails verschicken? Über Google habe ich das Forum hier und einen Beitrag mit einem ähnlich klingenden Viren/Trojanernamen gefunden. Den Tread empfand ich als sehr anschaulich. Hilft aber mglw. nichts, denn ähnlich ist nicht gleich. Und die Logfiles sind für mich Böhmische Dörfer. Von daher könnte die Situation bei mir wieder völlig anders liegen. Wie gesagt, ich habe von der Materie keine Ahnung. Ist Avira Free Antivir in der Lage das Problem vollständig zu bereinigen. Ich hatte jedoch beim lesen des Treads den Eindruck, dass dies eher weniger der Fall sei. Zunächst hatte ich eine Systemwiederherstellung zu einem früheren Zeitpunkt durchgeführt und dann noch einmal Antivir drüberlaufen lassen. Antivir meldete TR/Xcrypt.Xpack.8884. Ich habe den Virus/Trojaner in Quarantäne verschoben. Code:
ATTFilter Exportierte Ereignisse:
04.09.2013 07:53 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\Bernd xxxxxxxxx\AppData\Local\Temp\blsoqpvwlc.pre'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.8884' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5592675e.qua'
verschoben!
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:12 on 04/09/2013 (Bernd xxxxxxxxx)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 03
Ran by Bernd xxxxxxxxx (administrator) on BERNDxxxxxxxxx on 04-09-2013 18:13:56
Running from C:\Users\Bernd xxxxxxxxx\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(ZF Electronics GmbH) C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(ZF Electronics GmbH) C:\Program Files (x86)\Cherry\CDI\cdi.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\StartAutorun.exe
(UASSOFT.COM) C:\Program Files (x86)\Trust\GXT14 Mouse\RapooV1Process.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-07-27] (NVIDIA Corporation)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
MountPoints2: N - N:\HTC_Sync_Manager_PC.exe
MountPoints2: {637a6bee-c781-11e2-972b-bcaec523b6bf} - N:\HTC_Sync_Manager_PC.exe
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648264 2013-04-30] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [trustGTX14] - C:\Program Files (x86)\Trust\GXT14 Mouse\POINTERGHOST.exe [4832256 2009-05-11] ()
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [CherryKeyMan] - C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe [254004 2010-09-28] (ZF Electronics GmbH)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
AppInit_DLLs: C:\PROGRA~1\NVIDIA~1\NVSTRE~1\rxinput.dll [653600 2013-07-27] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\NVIDIA~1\NVSTRE~1\rxinput.dll [593696 2013-07-27] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
SearchScopes: HKCU - {0B8D26BE-58A1-482C-90BC-C62A0E16A503} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=39b18a8d-1614-4b2a-abdd-71fce6ed1871&apn_sauid=0EF40D91-9A6C-4F86-BEB6-1AA4F3A135DB
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 172.16.0.1
FireFox:
========
FF ProfilePath: C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default
FF user.js: detected! => C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\user.js
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=24A400242CE6FFE4&affID=120692&tsp=4944
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\searchplugins\delta.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Delta Toolbar - C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\ffxtlbr@delta.com
FF Extension: No Name - C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\towj3uha.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-03] (Avira Operations GmbH & Co. KG)
R3 Cherry Device Interface; C:\Program Files (x86)\Cherry\CDI\cdi.exe [577582 2010-08-25] (ZF Electronics GmbH)
R2 KmGameMouseServiceV1; C:\Program Files (x86)\Trust\GXT14 Mouse\GameMouseServiceApp.exe [354304 2009-05-11] (UASSOFT.COM)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14984480 2013-07-27] (NVIDIA Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-25] (Avira Operations GmbH & Co. KG)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39712 2013-05-14] (NVIDIA Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-04 18:12 - 2013-09-04 18:12 - 00000492 _____ C:\Users\Bernd xxxxxxxxx\Desktop\defogger_disable.log
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 _____ C:\Users\Bernd xxxxxxxxx\defogger_reenable
2013-09-04 08:34 - 2013-09-04 08:34 - 00377856 _____ C:\Users\Bernd xxxxxxxxx\Desktop\gmer_2.1.19163.exe
2013-09-04 08:33 - 2013-09-04 08:34 - 01950416 _____ (Farbar) C:\Users\Bernd xxxxxxxxx\Desktop\FRST64.exe
2013-09-04 08:32 - 2013-09-04 08:32 - 00050477 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Defogger.exe
2013-09-04 08:24 - 2013-09-04 08:24 - 00000762 _____ C:\Users\Bernd xxxxxxxxx\Desktop\EreignisseAVIRA20130903.txt
2013-09-03 23:13 - 2013-09-03 23:13 - 00002718 _____ C:\Users\BERNDK~1\AppData\Local\recently-used.xbel
2013-09-03 22:51 - 2013-09-03 22:51 - 00144384 _____ C:\Users\Bernd xxxxxxxxx\Downloads\standard
2013-09-03 22:32 - 2013-09-03 23:17 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Scribus
2013-09-03 22:13 - 2013-09-03 22:13 - 00000866 _____ C:\Users\Public\Desktop\Scribus 1.4.3.lnk
2013-09-03 22:13 - 2013-09-03 22:13 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-03 22:12 - 2013-09-03 22:13 - 00000000 ____D C:\Program Files\Scribus 1.4.3
2013-09-03 22:11 - 2013-09-04 08:45 - 00021415 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Trojaner_Board.odt
2013-09-03 21:49 - 2013-09-03 21:54 - 83962495 _____ (The Scribus Team) C:\Users\Bernd xxxxxxxxx\Downloads\scribus-1.4.3-windows-x64.exe
2013-08-17 13:03 - 2013-08-17 13:03 - 494271956 _____ C:\Windows\MEMORY.DMP
2013-08-17 13:03 - 2013-08-17 13:03 - 00262144 _____ C:\Windows\Minidump\081713-15506-01.dmp
2013-08-17 13:03 - 2013-08-17 13:03 - 00000000 ____D C:\Windows\Minidump
2013-08-17 12:49 - 2013-08-17 12:49 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 12:48 - 2013-08-17 12:48 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk
2013-08-17 12:48 - 2013-08-17 12:48 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-17 12:47 - 2013-08-17 12:47 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\Desktop\OpenOffice 4.0.0 (de) Installation Files
2013-08-17 12:43 - 2013-08-17 12:45 - 162401424 _____ C:\Users\Bernd xxxxxxxxx\Downloads\Apache_OpenOffice_4.0.0_Win_x86_install_de.exe
2013-08-17 12:42 - 2013-08-17 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 21:26 - 2013-08-15 21:26 - 00066419 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Ernährungstagebuch.ods
2013-08-15 20:19 - 2013-08-15 20:19 - 00006656 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Birken19.xls
2013-08-14 23:02 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 23:02 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 23:02 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 23:02 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 23:02 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 23:02 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 23:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 23:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 23:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 23:02 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 23:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 23:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 23:02 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 23:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 23:00 - 2013-08-14 23:01 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 18:17 - 2013-08-15 09:59 - 00036705 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Bericht Kestler 130813 2.odt
2013-08-14 13:57 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 13:57 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 13:57 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 13:57 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 13:57 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 13:57 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 13:57 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 13:57 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 13:57 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 13:57 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 13:57 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 13:57 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 13:57 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 13:57 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 13:57 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 13:57 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 13:57 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 13:57 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 13:57 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 13:57 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 13:57 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 13:00 - 2013-08-14 16:43 - 00032080 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Bericht Kestler 130813.odt
2013-08-06 21:31 - 2013-08-07 18:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-05 15:02 - 2013-08-05 15:02 - 00015115 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Würstel 050813.ods
2013-08-05 14:59 - 2013-08-05 14:59 - 00007168 _____ C:\Users\Bernd xxxxxxxxx\Desktop\050813.xls
==================== One Month Modified Files and Folders =======
2013-09-04 18:13 - 2013-09-04 18:13 - 00000000 ____D C:\FRST
2013-09-04 18:12 - 2013-09-04 18:12 - 00000492 _____ C:\Users\Bernd xxxxxxxxx\Desktop\defogger_disable.log
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 _____ C:\Users\Bernd xxxxxxxxx\defogger_reenable
2013-09-04 18:12 - 2013-05-25 21:26 - 00000000 ____D C:\Users\Bernd xxxxxxxxx
2013-09-04 18:12 - 2009-07-14 19:58 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-04 18:12 - 2009-07-14 19:58 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-04 18:12 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-04 18:11 - 2013-05-25 21:15 - 01990291 _____ C:\Windows\WindowsUpdate.log
2013-09-04 18:10 - 2009-07-14 06:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-04 18:10 - 2009-07-14 06:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-04 18:09 - 2013-06-06 11:52 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\FreePDF_XP
2013-09-04 18:08 - 2013-05-25 21:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-04 18:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-04 18:08 - 2009-07-14 06:51 - 00071930 _____ C:\Windows\setupact.log
2013-09-04 08:45 - 2013-09-03 22:11 - 00021415 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Trojaner_Board.odt
2013-09-04 08:34 - 2013-09-04 08:34 - 00377856 _____ C:\Users\Bernd xxxxxxxxx\Desktop\gmer_2.1.19163.exe
2013-09-04 08:34 - 2013-09-04 08:33 - 01950416 _____ (Farbar) C:\Users\Bernd xxxxxxxxx\Desktop\FRST64.exe
2013-09-04 08:32 - 2013-09-04 08:32 - 00050477 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Defogger.exe
2013-09-04 08:24 - 2013-09-04 08:24 - 00000762 _____ C:\Users\Bernd xxxxxxxxx\Desktop\EreignisseAVIRA20130903.txt
2013-09-04 08:20 - 2013-05-28 12:37 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 23:17 - 2013-09-03 22:32 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Scribus
2013-09-03 23:17 - 2013-06-25 22:38 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\.gimp-2.8
2013-09-03 23:13 - 2013-09-03 23:13 - 00002718 _____ C:\Users\BERNDK~1\AppData\Local\recently-used.xbel
2013-09-03 23:13 - 2013-07-19 18:49 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\gtk-2.0
2013-09-03 22:51 - 2013-09-03 22:51 - 00144384 _____ C:\Users\Bernd xxxxxxxxx\Downloads\standard
2013-09-03 22:13 - 2013-09-03 22:13 - 00000866 _____ C:\Users\Public\Desktop\Scribus 1.4.3.lnk
2013-09-03 22:13 - 2013-09-03 22:13 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-03 22:13 - 2013-09-03 22:12 - 00000000 ____D C:\Program Files\Scribus 1.4.3
2013-09-03 21:54 - 2013-09-03 21:49 - 83962495 _____ (The Scribus Team) C:\Users\Bernd xxxxxxxxx\Downloads\scribus-1.4.3-windows-x64.exe
2013-09-03 21:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-03 12:12 - 2013-05-27 22:31 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-03 12:12 - 2013-05-25 21:46 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-03 12:12 - 2013-05-25 21:46 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-03 12:09 - 2013-06-19 08:59 - 00000000 ___RD C:\Users\Bernd xxxxxxxxx\Dropbox
2013-09-03 12:09 - 2013-06-19 08:58 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-09-03 12:09 - 2013-06-19 08:58 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Dropbox
2013-09-03 12:09 - 2013-05-27 13:32 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\MyPhoneExplorer
2013-09-03 12:09 - 2013-05-26 10:02 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Thunderbird
2013-09-03 12:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-31 17:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-28 15:18 - 2013-05-25 21:47 - 00000000 ____D C:\Users\BERNDK~1\AppData\Local\DoNotTrackPlus
2013-08-17 13:20 - 2013-05-26 10:55 - 00064024 _____ C:\Users\BERNDK~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-17 13:03 - 2013-08-17 13:03 - 494271956 _____ C:\Windows\MEMORY.DMP
2013-08-17 13:03 - 2013-08-17 13:03 - 00262144 _____ C:\Windows\Minidump\081713-15506-01.dmp
2013-08-17 13:03 - 2013-08-17 13:03 - 00000000 ____D C:\Windows\Minidump
2013-08-17 13:03 - 2013-05-25 23:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 13:03 - 2009-07-14 06:45 - 00294712 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-17 12:49 - 2013-08-17 12:49 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\OpenOffice
2013-08-17 12:48 - 2013-08-17 12:48 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.0.lnk
2013-08-17 12:48 - 2013-08-17 12:48 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-08-17 12:47 - 2013-08-17 12:47 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\Desktop\OpenOffice 4.0.0 (de) Installation Files
2013-08-17 12:47 - 2013-05-25 21:26 - 00000000 ___RD C:\Users\Bernd xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-17 12:47 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-17 12:45 - 2013-08-17 12:43 - 162401424 _____ C:\Users\Bernd xxxxxxxxx\Downloads\Apache_OpenOffice_4.0.0_Win_x86_install_de.exe
2013-08-17 12:42 - 2013-08-17 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 08:14 - 2013-05-31 16:08 - 00000864 _____ C:\Windows\Brpfx04a.ini
2013-08-16 08:11 - 2013-06-06 12:07 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\AppData\Roaming\PC-FAX TX
2013-08-16 08:10 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-08-16 08:08 - 2013-05-27 11:38 - 00000000 ____D C:\Users\Bernd xxxxxxxxx\Documents\Fax
2013-08-16 07:17 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-15 21:26 - 2013-08-15 21:26 - 00066419 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Ernährungstagebuch.ods
2013-08-15 20:19 - 2013-08-15 20:19 - 00006656 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Birken19.xls
2013-08-15 19:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 09:59 - 2013-08-14 18:17 - 00036705 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Bericht Kestler 130813 2.odt
2013-08-14 23:01 - 2013-08-14 23:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 23:00 - 2013-05-25 22:25 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 16:43 - 2013-08-13 13:00 - 00032080 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Bericht Kestler 130813.odt
2013-08-07 18:06 - 2013-08-06 21:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-05 15:02 - 2013-08-05 15:02 - 00015115 _____ C:\Users\Bernd xxxxxxxxx\Desktop\Würstel 050813.ods
2013-08-05 14:59 - 2013-08-05 14:59 - 00007168 _____ C:\Users\Bernd xxxxxxxxx\Desktop\050813.xls
Files to move or delete:
====================
C:\Users\BERNDK~1\AppData\Local\Temp\msvbvm60.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nvStInst.exe
C:\Users\BERNDK~1\AppData\Local\Temp\swfo.exe
C:\Users\BERNDK~1\AppData\Local\Temp\vcredist_x64.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\BrC3Rgin.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\BrLogRx.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\difxapi.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\MSVCP60.DLL
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\ControlCenter\brccjpn.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\ContrlCenter\maxutil.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\ContrlCenter\pperr.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndBul.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndChn.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndCht.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndCze.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndDan.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndDut.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndEng.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndFin.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndFrc.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndFre.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndGer.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndHun.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndIta.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndJpn.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndNor.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndPol.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndPor.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndPtb.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndRom.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndRus.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndSpa.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndSvk.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndSwe.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndTrk.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BrmfcwndUsa.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon_NotUninstall\BroSNMP.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrDbgOut.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrFirmUpdateCheck.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BRHOOK.DLL
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\brif03a.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\brlm03a.dll
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BRLMW03A.DLL
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrMfcMon.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrMfcWnd.exe
C:\Users\BERNDK~1\AppData\Local\Temp\{06B9ED88-FEE0-4636-8629-879B065BCDD9}\{F9626826-162E-4EFD-9440-3F3B8317C097}\Brmfcmon\BrMfimon.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\setup.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvaudcap32v.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvaudcap64v.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvgenco32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvgenco64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVI2.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVI2UI.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVPrxy32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVPrxy64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\ReleaseHighlights.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\MS.NET\dotNetFx40_Full_setup.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\MS.NET\MSNetExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\clrzmq.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\detoured.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\libzmq.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvFBC.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvsteamsupport.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvstreamer.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvstreamsvc.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\protobuf-net.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\rxinput.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\steam_api.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\SteamLauncher\NVIDIA.SteamLauncher.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\detoured.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\libzmq.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvFBC.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvsteamsupport.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvstreamer.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvstreamsvc.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\rxinput.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\steam_api64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\7z.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\DisplayCplExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ExtensionLoader.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GalaSoft.MvvmLight.Extras.WPF4.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GalaSoft.MvvmLight.WPF4.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperience.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceControls.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceCore.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GridService.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\InstallerService.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\InstallerUIExtension.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\log4net.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.Practices.ServiceLocation.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.WindowsAPICodePack.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.WindowsAPICodePack.Shell.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Settings.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Settings.Properties.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.UpdateService.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Win32Api.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nvtmru.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\oaremote_plugin.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ShadowPlay.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Core.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Interfaces.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Linq.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.PlatformServices.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Providers.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Runtime.Remoting.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Windows.Threading.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Windows.Interactivity.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\zh-CHT\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\zh-CHS\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\tr-TR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\th-TH\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sv-SE\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sl-SI\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sk-SK\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ru-RU\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pt-PT\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pt-BR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pl-PL\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nl-NL\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nb-NO\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ko-KR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ja-JP\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\it-IT\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\hu-HU\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\he-IL\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\fr-FR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\fi-FI\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\es-MX\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\es-ES\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-US\GFExperience.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-US\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-GB\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\el-GR\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\de-DE\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\da-DK\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\cs-CZ\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ar-AE\GFExperienceControls.resources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\ComUpdatus.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\daemonu.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\easyDaemonAPIU32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\easyDaemonAPIU64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdt32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdt64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtr32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtr64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtrXP32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtrXP64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtXP32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtXP64.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\UpdateExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\WLMerger.exe
C:\Users\BERNDK~1\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Optimus\OptimusExt.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nsd5FCD.tmp\DropboxNSISTools.dll
C:\Users\BERNDK~1\AppData\Local\Temp\nsd5FCD.tmp\UAC.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\dotNetFx40LP_Full_x86_x64de.exe
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F0_Vb5db.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F10_Lffax90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F11_Lffpx7.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F12_Lffpx90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F13_Lfgif90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F14_Lfica90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F15_Lfimg90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F16_Lfkodak.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F17_Lflma90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F18_Lflmb90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F19_Lfmac90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F20_Lfmsp90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F21_Lfpcd90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F22_Lfpct90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F23_Lfpcx90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F24_Lfpng90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F25_Lfpsd90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F26_Lfras90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F27_Lftga90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F28_Lftif90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F29_Lfwfx90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F2_dao360.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F30_Lfwmf90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F31_Lfwpg90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F32_Ltdis90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F33_Ltdlg90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F34_Ltefx90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F35_Ltfil90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F36_Ltimg90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F37_Ltkrn90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F38_Lttwn90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F39_msrepl35.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F3_Lfavi90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F40_Pcdlib32.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F42_msvbvm60.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F43_swfo.exe
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F4_Lfawd90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F5_Lfbmp90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F6_Lfcal90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F7_Lfcmp90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F860_HLDplus.EXE
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F8_Lfdic90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\F9_Lfeps90n.dll
C:\Users\BERNDK~1\AppData\Local\Temp\iw194912\iwexec.exe
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\InstMsiA.exe
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\InstMsiW.exe
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\MDAC_TYP.EXE
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\setup.exe
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\shlwapi.dll
C:\Users\BERNDK~1\AppData\Local\Temp\installtemp\wininet.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-01 02:57
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2013 03
Ran by Bernd xxxxxxxx at 2013-09-04 18:14:15
Running from C:\Users\Bernd xxxxxxxx\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
Adobe AIR (x32 Version: 3.7.0.1860)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Ask Toolbar (x32 Version: 1.15.26.0)
Avira Free Antivirus (x32 Version: 13.0.0.4052)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.6.45268)
Brother MFL-Pro Suite MFC-6890CDW (x32 Version: 1.0.1.0)
Dropbox (HKCU Version: 2.2.3)
FreePDF (Remove only) (x32)
GPL Ghostscript (Version: 9.07)
HERMA Label Designer plus 1.1 (x32 Version: 1.00.0000)
Java 7 Update 21 (64-bit) (Version: 7.0.210)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
KeyMan V4.0 Build 6 (x32 Version: 4.0.0.6)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MyPhoneExplorer (x32 Version: 1.8.4)
NVIDIA 3D Vision Controller-Treiber 320.49 (Version: 320.49)
NVIDIA 3D Vision Treiber 320.49 (Version: 320.49)
NVIDIA GeForce Experience 1.6 (Version: 1.6)
NVIDIA Grafiktreiber 320.49 (Version: 320.49)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2)
NVIDIA Install Application (Version: 2.1002.131.854)
NVIDIA PhysX (x32 Version: 9.13.0604)
NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2049)
NVIDIA Systemsteuerung 320.49 (Version: 320.49)
NVIDIA Update 7.2.17 (Version: 7.2.17)
NVIDIA Update Components (Version: 7.2.17)
NVIDIA Virtual Audio 1.2.1 (Version: 1.2.1)
OpenOffice 4.0.0 (x32 Version: 4.00.9702)
P 2.8.6 (Version: 2.8.6)
RedMon - Redirection Port Monitor
Scribus 1.4.3 (64bit) (Version: 1.4.3)
SHIELD Streaming (Version: 1.05.19)
Skype™ 6.7 (x32 Version: 6.7.102)
Trust GXT14 Mouse (x32 Version: 1.2)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
VLC media player 2.0.6 (x32 Version: 2.0.6)
==================== Restore Points =========================
17-08-2013 10:47:37 OpenOffice 4.0.0 wird installiert
24-08-2013 18:53:41 Geplanter Prüfpunkt
01-09-2013 00:57:49 Geplanter Prüfpunkt
03-09-2013 10:08:34 Wiederherstellungsvorgang
03-09-2013 20:13:18 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => start w32time task_started
Task: {28F20C52-D689-41A9-AF9C-4E35ADD42809} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-18] (Adobe Systems Incorporated)
Task: {32AFA51E-2383-4FFE-A570-D9FD91A3C03D} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-30] ()
Task: {D1A393EA-D175-450C-90CA-7FD1BC440A89} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-05-25 21:50 - 2013-06-21 14:06 - 15920536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2013-06-14 01:00 - 2013-06-14 01:00 - 00164016 _____ (Dropbox, Inc.) C:\Users\Bernd xxxxxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2013-05-25 21:32 - 2013-06-21 12:23 - 04528416 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvUI.dll
2013-05-25 21:32 - 2013-07-27 10:35 - 01180448 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\easyDaemonAPIU64.DLL
2013-05-25 21:32 - 2013-07-27 10:36 - 04864800 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\NvUpdt.dll
2013-05-25 21:32 - 2013-07-27 10:36 - 01662240 _____ (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Common\NVUPDTR.DLL
2013-05-31 16:08 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2013-05-31 16:08 - 2008-12-14 09:11 - 00163840 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BRMFCWNDGer.dll
2009-07-14 02:29 - 2009-07-14 03:38 - 00701952 _____ (Microsoft Corporation) C:\Windows\system32\hhctrl.ocx
2010-09-28 09:18 - 2010-09-28 09:18 - 00716852 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Cherry\KeyMan\ComLib.dll
2006-02-22 14:47 - 2006-02-22 14:47 - 00073728 ____R () C:\Program Files (x86)\Cherry\KeyMan\zlib1.dll
2006-02-22 14:47 - 2006-02-22 14:47 - 00114688 ____R () C:\Program Files (x86)\Cherry\KeyMan\libpng13.dll
2007-10-23 07:10 - 2007-10-23 07:10 - 00041019 _____ (Cherry GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\RCM00.dll
2010-08-30 14:14 - 2010-08-30 14:14 - 00106563 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\csf01.dll
2010-06-17 12:05 - 2010-06-17 12:05 - 00038400 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\volumeinterface.dll
2010-09-28 09:18 - 2010-09-28 09:18 - 00036864 _____ (ZF Electronics GmbH) C:\PROGRAM FILES (X86)\CHERRY\KEYMAN\KEYMAN_DE.DLL
2010-09-28 09:18 - 2010-09-28 09:18 - 00032768 _____ (ZF Electronics GmbH) C:\PROGRAM FILES (X86)\CHERRY\KEYMAN\COMLIB_DE.DLL
2010-08-30 14:16 - 2010-08-30 14:16 - 00028672 ____R (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\csf01_de.dll
2011-03-14 11:42 - 2011-03-14 11:42 - 00138352 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\ChyTrace00.dll
2009-04-01 08:58 - 2009-04-01 08:58 - 00106553 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\CFI.dll
2010-09-28 09:19 - 2010-09-28 09:19 - 00090175 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Cherry\KeyMan\plugins\universal.dll
2011-12-21 10:02 - 2011-12-21 10:02 - 00069695 _____ (ZF Electronics GmbH) C:\Program Files (x86)\Common Files\Cherry\Common\KbdHook00.dll
2013-05-31 16:08 - 2009-03-06 12:51 - 00770048 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccDCtl.dll
2013-05-31 16:08 - 2008-10-21 19:41 - 00159744 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccger.dll
2013-05-31 16:08 - 2008-07-22 21:24 - 05390336 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccimg.dll
2013-05-31 16:08 - 2009-05-11 13:48 - 00372736 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccFCtl.dll
2013-05-31 16:08 - 2003-06-30 00:00 - 00259584 ____N (LEAD Technologies, Inc.) C:\Program Files (x86)\Brother\ControlCenter3\LTDIS12n.dll
2013-05-31 16:08 - 2003-06-30 00:00 - 00406016 ____N (LEAD Technologies, Inc.) C:\Program Files (x86)\Brother\ControlCenter3\LTKRN12n.dll
2013-05-31 16:08 - 2005-07-05 00:00 - 00131584 ____N (LEAD Technologies, Inc.) C:\Program Files (x86)\Brother\ControlCenter3\LTFIL12n.DLL
2013-05-31 16:08 - 2008-02-05 19:17 - 00176128 ____N (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BroSNMP.dll
2013-05-25 22:14 - 2012-10-16 09:39 - 00561664 _____ (Microsoft Corporation) C:\Windows\AppPatch\AcLayers.DLL
2009-05-04 11:22 - 2007-03-29 06:17 - 00106496 _____ () C:\Program Files (x86)\Trust\GXT14 Mouse\keydll.dll
2009-05-04 11:22 - 2009-03-02 06:45 - 00042496 _____ () C:\Program Files (x86)\Trust\GXT14 Mouse\MouseHook.dll
2013-08-17 12:42 - 2013-08-17 12:42 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-06-21 05:16 - 2013-06-21 05:16 - 00575984 _____ (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
2013-06-21 05:16 - 2013-06-21 05:16 - 00361744 _____ (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvStereoApiI.dll
2013-06-21 05:16 - 2013-06-21 05:16 - 01154832 _____ (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPI.dll
==================== Alternate Data Streams (whitelisted) ==========
==================== Faulty Device Manager Devices =============
Name: Realtek PCIe GBE Family Controller
Description: Realtek PCIe GBE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8167
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/04/2013 06:09:43 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/04/2013 06:08:17 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/04/2013 06:08:17 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
Error: (09/04/2013 08:56:56 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/04/2013 08:56:46 AM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/04/2013 08:56:45 AM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
Error: (09/03/2013 02:55:36 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 23.0.1.4974 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 924
Startzeit: 01cea8a4ada73a56
Endzeit: 18
Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Berichts-ID: 1df94bab-1498-11e3-81d0-bcaec523b6bf
Error: (09/03/2013 00:10:30 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (09/03/2013 00:10:04 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/03/2013 00:10:03 PM) (Source: NvStreamSvc) (User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
System errors:
=============
Error: (09/04/2013 06:08:13 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/04/2013 08:56:42 AM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/03/2013 00:10:00 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/03/2013 09:28:09 AM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/03/2013 09:27:20 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (09/03/2013 09:04:32 AM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/02/2013 10:58:56 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (09/02/2013 10:37:34 PM) (Source: DCOM) (User: )
Description: {005A3A96-BAC4-4B0A-94EA-C0CE100EA736}
Error: (09/02/2013 09:39:20 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Error: (09/02/2013 04:51:29 PM) (Source: Ntfs) (User: )
Description: Auf dem Volume "L:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten.
Microsoft Office Sessions:
=========================
Error: (09/04/2013 06:09:43 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files (x86)\Common Files\Cherry\Common\KbdHook64_00.DLL
Error: (09/04/2013 06:08:17 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/04/2013 06:08:17 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
Error: (09/04/2013 08:56:56 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files (x86)\Common Files\Cherry\Common\KbdHook64_00.DLL
Error: (09/04/2013 08:56:46 AM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/04/2013 08:56:45 AM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
Error: (09/03/2013 02:55:36 PM) (Source: Application Hang)(User: )
Description: firefox.exe23.0.1.497492401cea8a4ada73a5618C:\Program Files (x86)\Mozilla Firefox\firefox.exe1df94bab-1498-11e3-81d0-bcaec523b6bf
Error: (09/03/2013 00:10:30 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files (x86)\Common Files\Cherry\Common\KbdHook64_00.DLL
Error: (09/03/2013 00:10:04 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcUnregistering VAD endpoint [0]
Error: (09/03/2013 00:10:03 PM) (Source: NvStreamSvc)(User: )
Description: NvStreamSvcNvVAD endpoint registered successfully [0]
==================== Memory info ===========================
Percentage of memory in use: 23%
Total physical RAM: 8190.05 MB
Available physical RAM: 6248.94 MB
Total Pagefile: 16378.29 MB
Available Pagefile: 14335.32 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.69 GB) (Free:69.29 GB) NTFS
Drive d: (1GB-Haupt) (Fixed) (Total:931.51 GB) (Free:240.95 GB) NTFS
Drive e: (Volume) (Fixed) (Total:931.51 GB) (Free:254.46 GB) NTFS
Drive f: () (Fixed) (Total:465.75 GB) (Free:144.08 GB) NTFS
Drive l: (Volume) (Fixed) (Total:0.01 GB) (Free:0 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 0002B9CC)
Partition 1: (Active) - (Size=932 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 000B3AA0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 466 GB) (Disk ID: 00081D3C)
Partition 1: (Active) - (Size=466 GB) - (Type=42)
Partition 2: (Not Active) - (Size=9 MB) - (Type=42)
========================================================
Disk: 3 (Size: 932 GB) (Disk ID: 00004B4E)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-04 18:41:38
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2 OCZ-VERTEX3 rev.2.06 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\BERNDK~1\AppData\Local\Temp\fgldypob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[1812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075bc1465 2 bytes [BC, 75]
.text C:\Program Files (x86)\Ask.com\Updater\Updater.exe[1812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075bc14bb 2 bytes [BC, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0009dd5086ba
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0009dd5086ba (not active ControlSet)
---- EOF - GMER 2.1 ----
LG Bernd |
| Themen zu Win7 Avira Free Antivir meldet TR/Xcrypt.Xpack.8884. Rechner aber schon länger immer langsamer |
| .com, 4d36e972-e325-11ce-bfc1-08002be10318, adobe, antivir, antivirus, avira searchfree toolbar, beschädigung, browser, farbar, farbar recovery scan tool, flash player, google, homepage, installation, minidump, mozilla, plug-in, pup.optional.babsolution.a, pup.optional.babylon.a, pup.optional.opencandy, realtek, richtlinie, schutz, services.exe, software, svchost.exe, tr/crypt.xpack.8884, tr/xcrypt.xpack.8884, tr/xcrypt.xpack.8884., vcredist, viren |
Baum-Darstellung