| |
| |||||||
Log-Analyse und Auswertung: Mail mit Anhang Payment_20130611.zip (Trojaner)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
09.11.2013, 18:06
| #1 |
| |  Mail mit Anhang Payment_20130611.zip (Trojaner) FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Gabriele (administrator) on GABRIELESPC on 09-11-2013 17:59:06
Running from C:\Users\Gabriele\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Condusiv Technologies) C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\windows\SysWOW64\irstrtsv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe
() C:\Program Files (x86)\Amazon Browser Bar\ToolbarUpdaterService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenu8.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\InstallServices64.exe
(IObit) C:\Program Files (x86)\IObit\Start Menu 8\StartMenu_Hook.exe
(Intel Corporation) C:\windows\system32\igfxext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Flux Software LLC) C:\Users\Gabriele\AppData\Local\FluxSoftware\Flux\flux.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
() C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Users\Gabriele\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(Microsoft Corporation) C:\windows\WinStore\WSHost.exe
(Microsoft Corporation) C:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16683_none_62280e15510f8e79\TiWorker.exe
(Microsoft Corporation) C:\windows\system32\msiexec.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191312 2012-08-07] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2862448 2012-08-06] (ELAN Microelectronics Corp.)
HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Spotify] - C:\Users\Gabriele\AppData\Roaming\Spotify\spotify.exe [4752384 2013-10-15] (Spotify Ltd)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Gabriele\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1140736 2013-10-15] (Spotify Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-09-04] (Samsung)
HKCU\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKCU\...\Run: [f.lux] - C:\Users\Gabriele\AppData\Local\FluxSoftware\Flux\flux.exe [1016712 2013-10-16] (Flux Software LLC)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-09-30] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2013-10-10] (Cisco Systems, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p07_serp_ie_de_display?ie=UTF8&tagbase=bds-p07&tbrId=v1_abb-channel-7_ef719f2d652243b28a674f33690033f8_30_46_20131108_DE_ie_sp_IS0
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=sc&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
SearchScopes: HKLM - {216F2AAB-AC60-4908-BAF9-3DA6499FC0FE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {216F2AAB-AC60-4908-BAF9-3DA6499FC0FE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
SearchScopes: HKCU - DefaultScope {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} URL = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p07_serp_ie_de_display?ie=UTF8&tagbase=bds-p07&tag=bds-p07-serp-de-ie-21&tbrId=v1_abb-channel-7_ef719f2d652243b28a674f33690033f8_30_46_20131108_DE_ie_ds_IS0&query={searchTerms}
SearchScopes: HKCU - {216F2AAB-AC60-4908-BAF9-3DA6499FC0FE} URL =
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899&type=default&q={searchTerms}
SearchScopes: HKCU - {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} URL = hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p07_serp_ie_de_display?ie=UTF8&tagbase=bds-p07&tag=bds-p07-serp-de-ie-21&tbrId=v1_abb-channel-7_ef719f2d652243b28a674f33690033f8_30_46_20131108_DE_ie_ds_IS0&query={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: AlxHelper Class - {F443A627-5009-4323-9C1D-7FD598D0D712} - C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll (Amazon.com)
BHO-x32: BonanzaDeals - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals)
Toolbar: HKLM-x32 - Amazon Browser Bar - {EA582743-9076-4178-9AA6-7393FDF4D5CE} - C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll (Amazon.com)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\o7n7hkur.default
FF user.js: detected! => C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\o7n7hkur.default\user.js
FF NewTab: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p07_serp_ff_de_display?ie=UTF8&tagbase=bds-p07&tbrId=v1_abb-channel-7_ef719f2d652243b28a674f33690033f8_30_46_20131108_DE_ff_nt_IS0
FF SearchEngineOrder.1: Amazon
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\o7n7hkur.default\searchplugins\amazon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\dosearches.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: metacrawler.com - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\o7n7hkur.default\Extensions\ffxtlbr@metacrawler.com
FF Extension: abb - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\o7n7hkur.default\Extensions\abb@amazon.com.xpi
FF Extension: Adblock Plus - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\o7n7hkur.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.dosearches.com/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=sc&from=cor&uid=HitachiXHTS545050A7E380_TE85113RJ60TYRJ60TYRX&ts=1383947899
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (BonanzaDeals) - C:\Users\Gabriele\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj\3.5.0.0_0
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-09-30] (Avira Operations GmbH & Co. KG)
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-11-08] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-11-08] (BonanzaDeals)
R2 CVPND; C:\Program Files (x86)\Cisco\VPNClient\cvpnd.exe [1529856 2011-03-04] (Cisco Systems, Inc.)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593976 2012-08-26] (Samsung Electronics CO., LTD.)
R2 ExpressCache; C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe [102224 2012-08-17] (Condusiv Technologies)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
R2 irstrtsv; C:\windows\SysWOW64\irstrtsv.exe [193576 2012-08-22] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-09-06] (Microsoft Corporation)
R2 StartMenuService; C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe [75584 2013-09-29] (IObit)
R2 Updater Service for AMZN; C:\Program Files (x86)\Amazon Browser Bar\ToolbarUpdaterService.exe [222368 2013-03-21] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132600 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-09-30] (Avira Operations GmbH & Co. KG)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 CVPNDRVA; C:\windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-09-25] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-09-25] (Windows (R) Win 7 DDK provider)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23376 2012-08-17] (Condusiv Technologies)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [103248 2012-08-17] (Condusiv Technologies)
R3 irstrtdv; C:\Windows\System32\drivers\irstrtdv.sys [43800 2012-08-22] (Intel Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-08-22] (Intel Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2012-09-03] (Windows (R) 2003 DDK 3790 provider)
S3 vpnva; C:\Windows\system32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-09 17:59 - 2013-11-09 17:59 - 00000000 ____D C:\FRST
2013-11-09 17:57 - 2013-11-09 17:57 - 01957098 _____ (Farbar) C:\Users\Gabriele\Downloads\FRST64.exe
2013-11-09 10:27 - 2013-11-09 10:27 - 00000000 ___SH C:\DkHyperbootSync
2013-11-08 23:16 - 2013-11-08 23:16 - 00702696 _____ C:\Users\Gabriele\Downloads\ZipExtractorSetup(2).exe
2013-11-08 23:00 - 2013-11-08 23:08 - 00004552 _____ C:\Users\Gabriele\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2013-11-08 22:57 - 2013-11-08 22:57 - 00702696 _____ C:\Users\Gabriele\Downloads\ZipExtractorSetup(1).exe
2013-11-08 22:47 - 2013-11-08 22:47 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Amazon Browser Bar
2013-11-08 22:46 - 2013-11-08 22:46 - 00000000 ____D C:\Program Files (x86)\Amazon Browser Bar
2013-11-08 22:46 - 2013-11-08 22:45 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.5884.dll
2013-11-08 22:41 - 2013-11-09 13:46 - 00000954 _____ C:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-11-08 22:41 - 2013-11-09 13:42 - 00000342 _____ C:\windows\Tasks\MetaCrawler.job
2013-11-08 22:41 - 2013-11-09 09:47 - 00000950 _____ C:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-11-08 22:41 - 2013-11-08 23:24 - 00002680 _____ C:\windows\System32\Tasks\DigitalSite
2013-11-08 22:41 - 2013-11-08 23:24 - 00000342 _____ C:\windows\Tasks\DigitalSite.job
2013-11-08 22:41 - 2013-11-08 22:41 - 00003926 _____ C:\windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-11-08 22:41 - 2013-11-08 22:41 - 00003690 _____ C:\windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-11-08 22:41 - 2013-11-08 22:41 - 00003392 _____ C:\windows\System32\Tasks\BonanzaDealsUpdate
2013-11-08 22:41 - 2013-11-08 22:41 - 00002680 _____ C:\windows\System32\Tasks\MetaCrawler
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\MetaCrawler
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\DigitalSite
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Google
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Local\BonanzaDealsLive
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-11-08 22:40 - 2013-11-08 22:41 - 00000000 ____D C:\Program Files (x86)\metaCrawler
2013-11-08 22:38 - 2013-11-08 22:38 - 00702696 _____ C:\Users\Gabriele\Downloads\ZipExtractorSetup.exe
2013-11-06 19:39 - 2013-10-10 22:29 - 00112496 ____R (Cisco Systems, Inc.) C:\windows\system32\Drivers\acsock64.sys
2013-11-06 14:41 - 2013-11-06 14:41 - 00000000 ___HD C:\Users\Gabriele\AppData\Roaming\01FA08E6
2013-11-06 09:39 - 2013-11-06 09:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-05 21:44 - 2013-11-05 21:46 - 00000000 ____D C:\Users\Gabriele\Documents\Programme
2013-11-03 10:38 - 2013-11-03 10:44 - 00007601 _____ C:\Users\Gabriele\AppData\Local\resmon.resmoncfg
2013-11-02 11:30 - 2013-11-05 22:32 - 00000000 ____D C:\Users\Gabriele\Documents\Ausland
2013-11-02 11:28 - 2013-11-05 22:32 - 00000000 ____D C:\Users\Gabriele\Documents\Bewerbungen BA-Studium
2013-10-30 16:41 - 2013-11-05 21:21 - 00000000 ____D C:\Users\Gabriele\Documents\Bewerbungsunterlagen während Master
2013-10-29 13:36 - 2013-10-29 13:36 - 00000000 ____D C:\Users\Gabriele\AppData\Local\PDF24
2013-10-28 21:41 - 2013-10-30 09:18 - 00000000 ____D C:\Users\Gabriele\Documents\Zahlungsverkehr
2013-10-25 18:47 - 2013-11-08 23:50 - 00000000 ____D C:\Users\Gabriele\Documents\Sontiges
2013-10-25 18:21 - 2013-10-25 18:22 - 00290344 _____ C:\windows\Minidump\102513-28187-01.dmp
2013-10-22 06:48 - 2013-10-22 06:48 - 00003166 _____ C:\windows\System32\Tasks\StartMenuAutoupdate
2013-10-21 20:19 - 2013-10-21 20:19 - 00597224 _____ C:\Users\Gabriele\Downloads\flux-setup-v3.9.exe
2013-10-21 20:19 - 2013-10-21 20:19 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux
2013-10-21 20:19 - 2013-10-21 20:19 - 00000000 ____D C:\Users\Gabriele\AppData\Local\FluxSoftware
2013-10-20 14:13 - 2013-10-20 14:13 - 00000000 ____D C:\Users\Gabriele\restore
2013-10-20 14:11 - 2013-10-20 20:06 - 00000000 ____D C:\ProgramData\hps
2013-10-20 14:11 - 2013-10-20 18:58 - 00000000 ____D C:\ProgramData\tmp
2013-10-17 12:57 - 2013-10-17 12:57 - 00301157 _____ C:\Users\Gabriele\Downloads\download
2013-10-17 12:38 - 2013-10-25 18:21 - 00000000 ____D C:\windows\Minidump
2013-10-17 12:37 - 2013-10-25 18:21 - 2055627581 _____ C:\windows\MEMORY.DMP
2013-10-17 10:14 - 2013-10-17 10:14 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Avira
2013-10-17 10:09 - 2013-10-17 10:09 - 00000000 ____D C:\ProgramData\APN
2013-10-17 10:08 - 2013-10-17 10:08 - 00002086 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-10-17 10:08 - 2013-10-17 10:08 - 00000000 ____D C:\ProgramData\Avira
2013-10-17 10:08 - 2013-10-17 10:08 - 00000000 ____D C:\Program Files (x86)\Avira
2013-10-17 10:08 - 2013-09-30 10:01 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-10-17 10:08 - 2013-09-30 10:01 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-10-17 10:08 - 2013-09-30 10:01 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-10-17 10:08 - 2013-09-30 10:01 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-10-17 09:57 - 2013-10-17 10:04 - 122946048 _____ C:\Users\Gabriele\Downloads\avira14_free_antivirus_de.exe
2013-10-16 21:53 - 2013-10-16 21:53 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-16 21:53 - 2013-10-16 21:53 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-16 21:53 - 2013-10-16 21:53 - 00000000 ____D C:\Users\Default\AppData\Roaming\Genie9
2013-10-16 21:53 - 2013-10-16 21:53 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Genie9
2013-10-16 21:24 - 2013-11-03 09:58 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Genie9
2013-10-16 21:22 - 2013-10-16 21:23 - 11991288 _____ (Genie9) C:\Users\Gabriele\Downloads\GenieTimeline4FreeGerman_2013.exe
2013-10-16 21:13 - 2013-10-16 21:13 - 00000000 ____D C:\ProgramData\Intel.sav
2013-10-16 21:13 - 2013-10-16 21:13 - 00000000 ____D C:\Program Files\Common Files\Intel
2013-10-16 21:07 - 2013-10-16 21:07 - 00000000 ____D C:\ProgramData\Package Cache
2013-10-16 21:05 - 2013-10-16 21:06 - 92759704 _____ (Intel(R) Corporation) C:\Users\Gabriele\Downloads\wireless_16.1.5_e64.exe
2013-10-16 21:03 - 2013-10-16 21:03 - 00001144 _____ C:\Users\Public\Desktop\dm-Fotowelt.lnk
2013-10-16 20:40 - 2013-10-16 20:40 - 01600048 _____ C:\Users\Gabriele\Downloads\setup_dm_Fotowelt.exe
2013-10-16 20:40 - 2013-10-16 20:40 - 00000000 ____D C:\Program Files (x86)\dm
2013-10-15 20:30 - 2013-06-21 01:07 - 00188232 _____ (MCCI Corporation) C:\windows\system32\Drivers\ssadmdm.sys
2013-10-15 20:30 - 2013-06-21 01:07 - 00169288 _____ (MCCI Corporation) C:\windows\system32\Drivers\ssadbus.sys
2013-10-15 20:30 - 2013-06-21 01:07 - 00021320 _____ (MCCI Corporation) C:\windows\system32\Drivers\ssadmdfl.sys
2013-10-15 20:30 - 2013-06-21 01:07 - 00017736 _____ (MCCI Corporation) C:\windows\system32\Drivers\ssadwhnt.sys
2013-10-15 20:30 - 2013-06-21 01:07 - 00017736 _____ (MCCI Corporation) C:\windows\system32\Drivers\ssadwh.sys
2013-10-15 20:30 - 2013-06-21 01:07 - 00017224 _____ (MCCI Corporation) C:\windows\system32\Drivers\ssadcmnt.sys
2013-10-15 20:30 - 2013-06-21 01:07 - 00017224 _____ (MCCI Corporation) C:\windows\system32\Drivers\ssadcm.sys
2013-10-15 20:27 - 2013-10-15 20:27 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-10-15 20:25 - 2013-10-15 20:25 - 00002016 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2013-10-15 20:25 - 2013-10-15 20:25 - 00002006 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2013-10-15 20:25 - 2013-10-15 20:25 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-10-15 20:25 - 2013-10-15 20:25 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-10-15 20:25 - 2013-10-15 20:25 - 00000000 ____D C:\Users\Gabriele\Documents\samsung
2013-10-15 20:25 - 2013-10-15 20:25 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Samsung
2013-10-15 20:17 - 2013-07-18 13:33 - 04659712 _____ (Dmitry Streblechenko) C:\windows\SysWOW64\Redemption.dll
2013-10-15 20:17 - 2013-07-18 13:32 - 00821824 _____ (Devguru Co., Ltd.) C:\windows\SysWOW64\dgderapi.dll
2013-10-15 20:12 - 2013-10-15 20:14 - 70111336 _____ (Samsung Electronics Co., Ltd. ) C:\Users\Gabriele\Downloads\KiesSetup_2.6.0.13091.exe
2013-10-15 08:16 - 2013-10-15 08:16 - 00421880 _____ C:\windows\system32\FNTCACHE.DAT
2013-10-14 21:51 - 2013-10-14 21:51 - 02338824 _____ C:\Users\Gabriele\Downloads\hppiw(1).exe
2013-10-14 21:48 - 2013-10-14 21:48 - 02338824 _____ C:\Users\Gabriele\Downloads\hppiw.exe
2013-10-14 21:04 - 2013-10-14 21:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\HP
2013-10-14 21:04 - 2013-10-14 21:04 - 00000000 ____D C:\ProgramData\WEBREG
2013-10-14 21:03 - 2013-10-02 02:38 - 00694232 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-10-14 21:03 - 2013-10-02 02:38 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-14 20:19 - 2009-04-16 11:47 - 00136704 _____ (Hewlett-Packard Company) C:\windows\system32\hpf3l70w.dll
2013-10-14 20:18 - 2013-11-03 10:01 - 00000000 ____D C:\Program Files (x86)\HP
2013-10-14 20:17 - 2013-11-03 10:01 - 00005081 _____ C:\ProgramData\hpzinstall.log
2013-10-14 20:17 - 2013-10-14 21:23 - 00246640 _____ C:\windows\hpoins46.dat
2013-10-14 20:17 - 2012-10-15 04:38 - 00000464 ____N C:\windows\hpomdl46.dat
2013-10-14 20:16 - 2013-10-14 21:49 - 00000000 ____D C:\ProgramData\HP
2013-10-14 20:16 - 2012-09-25 08:52 - 00151968 _____ (Windows (R) Win 7 DDK provider) C:\windows\system32\Drivers\Dot4.sys
2013-10-14 20:16 - 2012-09-25 08:52 - 00049056 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Dot4usb.sys
2013-10-14 20:16 - 2012-09-25 08:52 - 00027040 _____ (Windows (R) Win 7 DDK provider) C:\windows\system32\Drivers\Dot4Prt.sys
2013-10-14 20:15 - 2012-09-25 08:52 - 03867040 _____ C:\windows\system32\PortChanger.exe
2013-10-14 20:15 - 2009-04-16 12:53 - 00642360 _____ (Hewlett-Packard) C:\windows\system32\hpzids40.dll
2013-10-14 20:15 - 2009-04-01 07:21 - 00881664 _____ (Hewlett-Packard) C:\windows\system32\hposwia_d02d.dll
2013-10-14 20:15 - 2009-04-01 07:21 - 00749056 _____ (Hewlett-Packard Co.) C:\windows\system32\hpost_d02d.dll
2013-10-14 20:15 - 2009-04-01 07:21 - 00516096 _____ (Hewlett-Packard Co.) C:\windows\system32\hposc_d02a.dll
2013-10-14 20:15 - 2008-10-29 01:27 - 00551424 _____ (Hewlett-Packard) C:\windows\system32\hppldcoi.dll
2013-10-14 19:24 - 2013-10-14 19:56 - 229421600 _____ C:\Users\Gabriele\Downloads\DJ_AIO_06_F4500_140_408.exe
2013-10-14 18:50 - 2013-08-02 07:28 - 19758080 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-10-14 18:50 - 2013-08-02 07:28 - 10116608 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
2013-10-14 18:50 - 2013-08-02 06:08 - 17561088 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-10-14 18:50 - 2013-08-02 06:08 - 08858112 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
2013-10-14 18:50 - 2013-08-01 11:41 - 02233688 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-10-14 18:50 - 2013-07-06 01:15 - 00652288 _____ (Microsoft Corporation) C:\windows\system32\comctl32.dll
2013-10-14 18:50 - 2013-07-04 03:13 - 00541696 _____ (Microsoft Corporation) C:\windows\SysWOW64\comctl32.dll
2013-10-14 18:50 - 2013-04-10 00:17 - 01125888 _____ (Microsoft Corporation) C:\windows\system32\msctf.dll
2013-10-14 18:50 - 2013-04-09 23:29 - 00893952 _____ (Microsoft Corporation) C:\windows\SysWOW64\msctf.dll
2013-10-14 18:49 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-10-14 18:49 - 2013-08-10 06:21 - 00448512 _____ (Microsoft Corporation) C:\windows\system32\SettingSync.dll
2013-10-14 18:49 - 2013-08-10 06:21 - 00128512 _____ (Microsoft Corporation) C:\windows\system32\SettingSyncInfo.dll
2013-10-14 18:49 - 2013-08-10 04:58 - 00356352 _____ (Microsoft Corporation) C:\windows\SysWOW64\SettingSync.dll
2013-10-14 18:49 - 2013-08-03 07:40 - 01374208 _____ (Microsoft Corporation) C:\windows\system32\wdc.dll
2013-10-14 18:49 - 2013-08-03 07:40 - 00566784 _____ (Microsoft Corporation) C:\windows\system32\wvc.dll
2013-10-14 18:49 - 2013-08-03 07:40 - 00462336 _____ (Microsoft Corporation) C:\windows\system32\sysmon.ocx
2013-10-14 18:49 - 2013-08-03 06:14 - 00399360 _____ (Microsoft Corporation) C:\windows\SysWOW64\sysmon.ocx
2013-10-14 18:49 - 2013-08-03 06:13 - 01245696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdc.dll
2013-10-14 18:49 - 2013-08-03 06:13 - 00437248 _____ (Microsoft Corporation) C:\windows\SysWOW64\wvc.dll
2013-10-14 18:49 - 2013-08-02 07:28 - 00222208 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-10-14 18:49 - 2013-08-02 07:26 - 02304512 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-10-14 18:49 - 2013-08-02 06:08 - 00199168 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-10-14 18:49 - 2013-08-02 06:06 - 02035712 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-10-14 18:49 - 2013-07-31 00:30 - 00386923 _____ C:\windows\system32\ApnDatabase.xml
2013-10-14 18:49 - 2013-07-25 00:10 - 00158208 _____ (Microsoft Corporation) C:\windows\SysWOW64\mbsmsapi.dll
2013-10-14 18:49 - 2013-07-25 00:06 - 00225280 _____ (Microsoft Corporation) C:\windows\system32\mbsmsapi.dll
2013-10-14 18:48 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-10-14 18:48 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-10-14 18:48 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-10-14 18:48 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-10-14 18:48 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-10-14 18:48 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-10-14 18:48 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-10-14 18:48 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-10-14 18:48 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-10-14 18:48 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-10-14 18:48 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-10-14 18:48 - 2013-04-28 23:28 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2013-10-14 18:47 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-10-14 18:47 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-10-14 18:47 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-10-14 18:47 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-10-14 18:47 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-10-14 18:47 - 2013-05-15 23:37 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2013-10-14 18:47 - 2013-05-15 23:35 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2013-10-14 18:47 - 2013-05-14 14:14 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-10-14 18:47 - 2013-05-14 10:23 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-10-14 18:47 - 2013-02-21 11:29 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-10-14 18:47 - 2013-02-21 11:29 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-10-14 18:47 - 2013-02-21 11:29 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-10-14 18:47 - 2013-02-21 11:29 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-10-14 18:47 - 2013-02-21 11:14 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-10-14 18:47 - 2013-02-21 11:14 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-10-14 18:47 - 2013-02-19 10:53 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2013-10-14 18:47 - 2012-11-08 05:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-10-14 18:47 - 2012-11-08 05:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-10-14 18:46 - 2013-08-23 06:11 - 04040192 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-10-14 18:46 - 2013-07-05 23:02 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbcir.sys
2013-10-14 18:46 - 2013-07-05 23:01 - 00210560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbvideo.sys
2013-10-14 18:46 - 2013-07-01 23:14 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbscan.sys
2013-10-14 18:46 - 2013-07-01 23:14 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbprint.sys
2013-10-14 18:46 - 2013-06-29 04:08 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hidparse.sys
2013-10-14 18:46 - 2013-06-29 04:07 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hidclass.sys
2013-10-14 18:46 - 2013-06-22 06:45 - 00785624 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Wdf01000.sys
2013-10-14 18:46 - 2013-06-22 06:45 - 00054488 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdfLdr.sys
2013-10-14 18:46 - 2013-05-27 00:17 - 00035328 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2013-10-14 18:46 - 2013-05-26 23:59 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2013-10-14 18:46 - 2013-05-25 04:15 - 00362496 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2013-10-14 18:46 - 2013-05-25 03:32 - 00300032 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2013-10-14 18:42 - 2013-07-19 23:13 - 00124112 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-14 18:42 - 2013-07-19 23:13 - 00102608 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-14 18:42 - 2013-07-02 02:41 - 00447320 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2013-10-14 18:42 - 2013-07-02 02:41 - 00337752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBXHCI.SYS
2013-10-14 18:42 - 2013-07-02 02:41 - 00213336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\UCX01000.SYS
2013-10-14 18:42 - 2013-07-01 02:42 - 00623448 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2013-10-14 18:42 - 2013-07-01 02:42 - 00498008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2013-10-14 18:42 - 2013-07-01 02:42 - 00079192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2013-10-14 18:42 - 2013-07-01 02:42 - 00021848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2013-10-14 18:42 - 2013-06-29 04:07 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2013-10-14 18:42 - 2013-06-29 04:06 - 00120832 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2013-10-14 18:33 - 2013-10-14 18:33 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\vlc
2013-10-14 18:32 - 2013-10-14 18:32 - 00001080 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-14 18:32 - 2013-10-14 18:32 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-10-14 15:29 - 2013-11-03 09:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-12 19:05 - 2013-10-12 19:05 - 24278649 _____ C:\Users\Gabriele\Downloads\vlc-2.1.0-win32.exe
2013-10-10 22:48 - 2013-10-10 22:48 - 00034192 _____ (Cisco Systems, Inc.) C:\windows\SysWOW64\vpnevents.dll
2013-10-10 22:48 - 2013-10-10 22:48 - 00011152 _____ (Cisco Systems, Inc.) C:\windows\SysWOW64\vpncategories.dll
2013-10-10 22:31 - 2013-10-10 22:31 - 00052080 _____ (Cisco Systems, Inc.) C:\windows\system32\Drivers\vpnva64-6.sys
2013-10-10 22:15 - 2013-11-06 19:38 - 00000000 ____D C:\ProgramData\Cisco
2013-10-10 22:15 - 2013-10-10 22:15 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Cisco
2013-10-10 22:14 - 2013-10-10 22:14 - 03049560 _____ (Cisco Systems, Inc.) C:\Users\Gabriele\Downloads\anyconnect-win-3.1.04066-web-deploy-k9.exe
2013-10-10 18:03 - 2013-10-10 18:04 - 00001594 _____ C:\windows\VPNInstall.MIF
2013-10-10 18:03 - 2013-10-10 18:03 - 00000000 ____D C:\Program Files\Common Files\Deterministic Networks
2013-10-10 18:03 - 2013-10-10 18:03 - 00000000 ____D C:\Program Files (x86)\Cisco Systems
2013-10-10 18:02 - 2013-10-10 18:02 - 05333322 _____ C:\Users\Gabriele\Downloads\rzinst-Cisco-VPNClient-5.0.07.0440x64.exe
2013-10-10 18:02 - 2013-10-10 18:02 - 00000594 _____ C:\windows\RRZE.LOG
2013-10-10 18:02 - 2013-10-10 18:02 - 00000000 ____D C:\windows\RRZE
2013-10-10 14:25 - 2013-10-10 14:25 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-10-10 14:24 - 2013-10-10 14:24 - 13443208 _____ (Microsoft Corporation) C:\Users\Gabriele\Downloads\proofingtools_es-es-x86.exe
2013-10-10 10:00 - 2013-10-10 10:00 - 00000000 ____D C:\ProgramData\Gibraltar
2013-10-10 08:44 - 2013-10-10 08:44 - 00000584 _____ C:\Users\Gabriele\Downloads\memorizelist.ris
2013-10-10 08:39 - 2013-10-10 08:39 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Swiss Academic Software
2013-10-10 08:38 - 2013-11-09 17:23 - 00000000 ____D C:\Users\Gabriele\Documents\Citavi 4
2013-10-10 08:38 - 2013-10-26 16:59 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Swiss Academic Software
==================== One Month Modified Files and Folders =======
2013-11-09 17:59 - 2013-11-09 17:59 - 00000000 ____D C:\FRST
2013-11-09 17:57 - 2013-11-09 17:57 - 01957098 _____ (Farbar) C:\Users\Gabriele\Downloads\FRST64.exe
2013-11-09 17:57 - 2012-08-22 07:48 - 01352077 _____ C:\windows\WindowsUpdate.log
2013-11-09 17:23 - 2013-10-10 08:38 - 00000000 ____D C:\Users\Gabriele\Documents\Citavi 4
2013-11-09 17:22 - 2013-10-03 19:53 - 00005158 _____ C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for GABRIELESPC-Gabriele GabrielesPC
2013-11-09 17:22 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru
2013-11-09 14:16 - 2012-08-22 08:42 - 00000360 _____ C:\windows\Tasks\Xerox PhotoCafe Communicator.job
2013-11-09 13:46 - 2013-11-08 22:41 - 00000954 _____ C:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-11-09 13:42 - 2013-11-08 22:41 - 00000342 _____ C:\windows\Tasks\MetaCrawler.job
2013-11-09 10:36 - 2013-10-03 19:47 - 00000000 ___RD C:\Users\Gabriele\SkyDrive
2013-11-09 10:27 - 2013-11-09 10:27 - 00000000 ___SH C:\DkHyperbootSync
2013-11-09 09:51 - 2012-08-22 23:58 - 00753134 _____ C:\windows\system32\perfh007.dat
2013-11-09 09:51 - 2012-08-22 23:58 - 00155826 _____ C:\windows\system32\perfc007.dat
2013-11-09 09:51 - 2012-07-26 08:28 - 01745416 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-09 09:49 - 2012-08-22 08:33 - 00000000 ____D C:\ProgramData\WinClon
2013-11-09 09:47 - 2013-11-08 22:41 - 00000950 _____ C:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-11-09 09:46 - 2012-08-05 22:07 - 00578448 _____ C:\windows\PFRO.log
2013-11-09 09:46 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-08 23:54 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI
2013-11-08 23:50 - 2013-10-25 18:47 - 00000000 ____D C:\Users\Gabriele\Documents\Sontiges
2013-11-08 23:24 - 2013-11-08 22:41 - 00002680 _____ C:\windows\System32\Tasks\DigitalSite
2013-11-08 23:24 - 2013-11-08 22:41 - 00000342 _____ C:\windows\Tasks\DigitalSite.job
2013-11-08 23:16 - 2013-11-08 23:16 - 00702696 _____ C:\Users\Gabriele\Downloads\ZipExtractorSetup(2).exe
2013-11-08 23:08 - 2013-11-08 23:00 - 00004552 _____ C:\Users\Gabriele\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2013-11-08 22:58 - 2013-10-02 15:40 - 00001784 _____ C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-08 22:57 - 2013-11-08 22:57 - 00702696 _____ C:\Users\Gabriele\Downloads\ZipExtractorSetup(1).exe
2013-11-08 22:47 - 2013-11-08 22:47 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Amazon Browser Bar
2013-11-08 22:46 - 2013-11-08 22:46 - 00000000 ____D C:\Program Files (x86)\Amazon Browser Bar
2013-11-08 22:45 - 2013-11-08 22:46 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.5884.dll
2013-11-08 22:41 - 2013-11-08 22:41 - 00003926 _____ C:\windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-11-08 22:41 - 2013-11-08 22:41 - 00003690 _____ C:\windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-11-08 22:41 - 2013-11-08 22:41 - 00003392 _____ C:\windows\System32\Tasks\BonanzaDealsUpdate
2013-11-08 22:41 - 2013-11-08 22:41 - 00002680 _____ C:\windows\System32\Tasks\MetaCrawler
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\MetaCrawler
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\DigitalSite
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Google
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Local\BonanzaDealsLive
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-11-08 22:41 - 2013-11-08 22:41 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-11-08 22:41 - 2013-11-08 22:40 - 00000000 ____D C:\Program Files (x86)\metaCrawler
2013-11-08 22:38 - 2013-11-08 22:38 - 00702696 _____ C:\Users\Gabriele\Downloads\ZipExtractorSetup.exe
2013-11-08 11:18 - 2013-10-02 15:37 - 00000000 ____D C:\Users\Gabriele
2013-11-07 23:15 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent
2013-11-07 09:51 - 2013-10-02 15:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-06 19:38 - 2013-10-10 22:15 - 00000000 ____D C:\ProgramData\Cisco
2013-11-06 19:38 - 2012-08-22 07:44 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-11-06 14:41 - 2013-11-06 14:41 - 00000000 ___HD C:\Users\Gabriele\AppData\Roaming\01FA08E6
2013-11-06 09:39 - 2013-11-06 09:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-05 22:32 - 2013-11-02 11:30 - 00000000 ____D C:\Users\Gabriele\Documents\Ausland
2013-11-05 22:32 - 2013-11-02 11:28 - 00000000 ____D C:\Users\Gabriele\Documents\Bewerbungen BA-Studium
2013-11-05 21:46 - 2013-11-05 21:44 - 00000000 ____D C:\Users\Gabriele\Documents\Programme
2013-11-05 21:21 - 2013-10-30 16:41 - 00000000 ____D C:\Users\Gabriele\Documents\Bewerbungsunterlagen während Master
2013-11-05 12:22 - 2012-07-26 08:21 - 00037800 _____ C:\windows\setupact.log
2013-11-03 20:46 - 2013-10-05 19:15 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Spotify
2013-11-03 15:37 - 2013-10-02 15:49 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2739015723-2927197382-1160632269-1001
2013-11-03 10:44 - 2013-11-03 10:38 - 00007601 _____ C:\Users\Gabriele\AppData\Local\resmon.resmoncfg
2013-11-03 10:10 - 2013-10-05 20:27 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Skype
2013-11-03 10:09 - 2013-10-02 15:38 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Packages
2013-11-03 10:04 - 2013-10-05 19:16 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Spotify
2013-11-03 10:01 - 2013-10-14 20:18 - 00000000 ____D C:\Program Files (x86)\HP
2013-11-03 10:01 - 2013-10-14 20:17 - 00005081 _____ C:\ProgramData\hpzinstall.log
2013-11-03 09:59 - 2012-08-22 07:48 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-11-03 09:58 - 2013-10-16 21:24 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Genie9
2013-11-03 09:46 - 2013-10-02 20:20 - 00000000 ____D C:\ProgramData\AVAST Software
2013-11-03 09:19 - 2013-10-14 15:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 09:18 - 2013-10-28 21:41 - 00000000 ____D C:\Users\Gabriele\Documents\Zahlungsverkehr
2013-10-29 13:36 - 2013-10-29 13:36 - 00000000 ____D C:\Users\Gabriele\AppData\Local\PDF24
2013-10-29 07:43 - 2013-10-02 15:39 - 00009337 _____ C:\Users\Gabriele\AppData\Roaming\AbsoluteReminder.xml
2013-10-27 21:36 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\NDF
2013-10-26 16:59 - 2013-10-10 08:38 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Swiss Academic Software
2013-10-25 18:22 - 2013-10-25 18:21 - 00290344 _____ C:\windows\Minidump\102513-28187-01.dmp
2013-10-25 18:21 - 2013-10-17 12:38 - 00000000 ____D C:\windows\Minidump
2013-10-25 18:21 - 2013-10-17 12:37 - 2055627581 _____ C:\windows\MEMORY.DMP
2013-10-22 07:48 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache
2013-10-22 06:48 - 2013-10-22 06:48 - 00003166 _____ C:\windows\System32\Tasks\StartMenuAutoupdate
2013-10-21 20:19 - 2013-10-21 20:19 - 00597224 _____ C:\Users\Gabriele\Downloads\flux-setup-v3.9.exe
2013-10-21 20:19 - 2013-10-21 20:19 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux
2013-10-21 20:19 - 2013-10-21 20:19 - 00000000 ____D C:\Users\Gabriele\AppData\Local\FluxSoftware
2013-10-20 20:06 - 2013-10-20 14:11 - 00000000 ____D C:\ProgramData\hps
2013-10-20 18:58 - 2013-10-20 14:11 - 00000000 ____D C:\ProgramData\tmp
2013-10-20 14:13 - 2013-10-20 14:13 - 00000000 ____D C:\Users\Gabriele\restore
2013-10-17 12:57 - 2013-10-17 12:57 - 00301157 _____ C:\Users\Gabriele\Downloads\download
2013-10-17 12:37 - 2012-08-21 08:14 - 00172893 ____N C:\windows\Minidump\101713-44515-01.dmp
2013-10-17 10:14 - 2013-10-17 10:14 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Avira
2013-10-17 10:09 - 2013-10-17 10:09 - 00000000 ____D C:\ProgramData\APN
2013-10-17 10:08 - 2013-10-17 10:08 - 00002086 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-10-17 10:08 - 2013-10-17 10:08 - 00000000 ____D C:\ProgramData\Avira
2013-10-17 10:08 - 2013-10-17 10:08 - 00000000 ____D C:\Program Files (x86)\Avira
2013-10-17 10:04 - 2013-10-17 09:57 - 122946048 _____ C:\Users\Gabriele\Downloads\avira14_free_antivirus_de.exe
2013-10-16 21:53 - 2013-10-16 21:53 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-16 21:53 - 2013-10-16 21:53 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-16 21:53 - 2013-10-16 21:53 - 00000000 ____D C:\Users\Default\AppData\Roaming\Genie9
2013-10-16 21:53 - 2013-10-16 21:53 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Genie9
2013-10-16 21:23 - 2013-10-16 21:22 - 11991288 _____ (Genie9) C:\Users\Gabriele\Downloads\GenieTimeline4FreeGerman_2013.exe
2013-10-16 21:15 - 2012-08-22 07:44 - 00000000 ____D C:\ProgramData\Intel
2013-10-16 21:14 - 2012-08-22 08:49 - 00000000 ____D C:\Users\EasySurvey
2013-10-16 21:13 - 2013-10-16 21:13 - 00000000 ____D C:\ProgramData\Intel.sav
2013-10-16 21:13 - 2013-10-16 21:13 - 00000000 ____D C:\Program Files\Common Files\Intel
2013-10-16 21:13 - 2012-08-22 07:44 - 00024244 _____ C:\windows\DPINST.LOG
2013-10-16 21:13 - 2012-08-22 07:44 - 00000000 ____D C:\Program Files (x86)\Intel
2013-10-16 21:10 - 2012-08-22 07:44 - 00000000 ____D C:\Program Files\Intel
2013-10-16 21:07 - 2013-10-16 21:07 - 00000000 ____D C:\ProgramData\Package Cache
2013-10-16 21:06 - 2013-10-16 21:05 - 92759704 _____ (Intel(R) Corporation) C:\Users\Gabriele\Downloads\wireless_16.1.5_e64.exe
2013-10-16 21:03 - 2013-10-16 21:03 - 00001144 _____ C:\Users\Public\Desktop\dm-Fotowelt.lnk
2013-10-16 20:45 - 2013-10-03 19:10 - 00000000 ____D C:\Users\Gabriele\Documents\Master Erlangen-Nürnberg
2013-10-16 20:40 - 2013-10-16 20:40 - 01600048 _____ C:\Users\Gabriele\Downloads\setup_dm_Fotowelt.exe
2013-10-16 20:40 - 2013-10-16 20:40 - 00000000 ____D C:\Program Files (x86)\dm
2013-10-15 20:27 - 2013-10-15 20:27 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-10-15 20:25 - 2013-10-15 20:25 - 00002016 _____ C:\Users\Public\Desktop\Samsung Kies (Lite).lnk
2013-10-15 20:25 - 2013-10-15 20:25 - 00002006 _____ C:\Users\Public\Desktop\Samsung Kies.lnk
2013-10-15 20:25 - 2013-10-15 20:25 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-10-15 20:25 - 2013-10-15 20:25 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-10-15 20:25 - 2013-10-15 20:25 - 00000000 ____D C:\Users\Gabriele\Documents\samsung
2013-10-15 20:25 - 2013-10-15 20:25 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Samsung
2013-10-15 20:18 - 2012-08-22 08:37 - 00000000 ____D C:\ProgramData\Samsung
2013-10-15 20:17 - 2012-08-22 07:47 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-15 20:14 - 2013-10-15 20:12 - 70111336 _____ (Samsung Electronics Co., Ltd. ) C:\Users\Gabriele\Downloads\KiesSetup_2.6.0.13091.exe
2013-10-15 20:14 - 2013-10-09 17:44 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Downloaded Installations
2013-10-15 08:16 - 2013-10-15 08:16 - 00421880 _____ C:\windows\system32\FNTCACHE.DAT
2013-10-14 21:51 - 2013-10-14 21:51 - 02338824 _____ C:\Users\Gabriele\Downloads\hppiw(1).exe
2013-10-14 21:49 - 2013-10-14 20:16 - 00000000 ____D C:\ProgramData\HP
2013-10-14 21:48 - 2013-10-14 21:48 - 02338824 _____ C:\Users\Gabriele\Downloads\hppiw.exe
2013-10-14 21:23 - 2013-10-14 20:17 - 00246640 _____ C:\windows\hpoins46.dat
2013-10-14 21:23 - 2012-07-26 06:26 - 00000127 _____ C:\windows\win.ini
2013-10-14 21:21 - 2013-10-03 19:29 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-10-14 21:04 - 2013-10-14 21:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\HP
2013-10-14 21:04 - 2013-10-14 21:04 - 00000000 ____D C:\ProgramData\WEBREG
2013-10-14 21:03 - 2013-10-02 15:41 - 00000000 ___RD C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-14 21:03 - 2013-10-02 15:41 - 00000000 ___RD C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-10-14 21:01 - 2012-07-26 09:12 - 00000000 ___RD C:\windows\ToastData
2013-10-14 19:56 - 2013-10-14 19:24 - 229421600 _____ C:\Users\Gabriele\Downloads\DJ_AIO_06_F4500_140_408.exe
2013-10-14 19:49 - 2013-10-02 17:01 - 00000000 ____D C:\windows\system32\MRT
2013-10-14 19:46 - 2013-10-02 17:01 - 80541720 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-10-14 18:33 - 2013-10-14 18:33 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\vlc
2013-10-14 18:32 - 2013-10-14 18:32 - 00001080 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-14 18:32 - 2013-10-14 18:32 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-10-12 19:05 - 2013-10-12 19:05 - 24278649 _____ C:\Users\Gabriele\Downloads\vlc-2.1.0-win32.exe
2013-10-12 10:00 - 2013-10-05 19:25 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Thunderbird
2013-10-10 22:48 - 2013-10-10 22:48 - 00034192 _____ (Cisco Systems, Inc.) C:\windows\SysWOW64\vpnevents.dll
2013-10-10 22:48 - 2013-10-10 22:48 - 00011152 _____ (Cisco Systems, Inc.) C:\windows\SysWOW64\vpncategories.dll
2013-10-10 22:31 - 2013-10-10 22:31 - 00052080 _____ (Cisco Systems, Inc.) C:\windows\system32\Drivers\vpnva64-6.sys
2013-10-10 22:29 - 2013-11-06 19:39 - 00112496 ____R (Cisco Systems, Inc.) C:\windows\system32\Drivers\acsock64.sys
2013-10-10 22:15 - 2013-10-10 22:15 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Cisco
2013-10-10 22:14 - 2013-10-10 22:14 - 03049560 _____ (Cisco Systems, Inc.) C:\Users\Gabriele\Downloads\anyconnect-win-3.1.04066-web-deploy-k9.exe
2013-10-10 18:04 - 2013-10-10 18:03 - 00001594 _____ C:\windows\VPNInstall.MIF
2013-10-10 18:03 - 2013-10-10 18:03 - 00000000 ____D C:\Program Files\Common Files\Deterministic Networks
2013-10-10 18:03 - 2013-10-10 18:03 - 00000000 ____D C:\Program Files (x86)\Cisco Systems
2013-10-10 18:02 - 2013-10-10 18:02 - 05333322 _____ C:\Users\Gabriele\Downloads\rzinst-Cisco-VPNClient-5.0.07.0440x64.exe
2013-10-10 18:02 - 2013-10-10 18:02 - 00000594 _____ C:\windows\RRZE.LOG
2013-10-10 18:02 - 2013-10-10 18:02 - 00000000 ____D C:\windows\RRZE
2013-10-10 14:25 - 2013-10-10 14:25 - 00000000 ____D C:\Program Files (x86)\MSECache
2013-10-10 14:24 - 2013-10-10 14:24 - 13443208 _____ (Microsoft Corporation) C:\Users\Gabriele\Downloads\proofingtools_es-es-x86.exe
2013-10-10 10:00 - 2013-10-10 10:00 - 00000000 ____D C:\ProgramData\Gibraltar
2013-10-10 08:44 - 2013-10-10 08:44 - 00000584 _____ C:\Users\Gabriele\Downloads\memorizelist.ris
2013-10-10 08:39 - 2013-10-10 08:39 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Swiss Academic Software
Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe
C:\Users\Public\AlexaNSISPlugin.5884.dll
Some content of TEMP:
====================
C:\Users\Gabriele\AppData\Local\Temp\14855uninstall.exe
C:\Users\Gabriele\AppData\Local\Temp\2656uninstall.exe
C:\Users\Gabriele\AppData\Local\Temp\33499uninstall.exe
C:\Users\Gabriele\AppData\Local\Temp\62608uninstall.exe
C:\Users\Gabriele\AppData\Local\Temp\76615uninstall.exe
C:\Users\Gabriele\AppData\Local\Temp\84943uninstall.exe
C:\Users\Gabriele\AppData\Local\Temp\97233uninstall.exe
C:\Users\Gabriele\AppData\Local\Temp\avgnt.exe
C:\Users\Gabriele\AppData\Local\Temp\regeSVCS.dll
C:\Users\Gabriele\AppData\Local\Temp\regeSVCS64.dll
C:\Users\Gabriele\AppData\Local\Temp\Sqlite3.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-08 09:27
==================== End Of Log ============================
--- --- --- --- --- --- So ich hoffe, dass ich es nun richtig gemacht habe. Danke für die Hilfe! Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013
Ran by Gabriele at 2013-11-09 18:00:32
Running from C:\Users\Gabriele\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 7.2.8)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05)
Amazon Browser Bar (Version: 3.0.2012.0802)
Amazon Browser Settings (x32 Version: 3.0)
Avira Free Antivirus (x32 Version: 14.0.0.383)
Bonanza Deals (remove only) (x32 Version: 5.0.1.0)
BufferChm (x32 Version: 140.0.298.000)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072)
Cisco Systems VPN Client 5.0.07.0440 (Version: 5.0.7)
Citavi 4 (x32 Version: 4.2.0.11)
Copy (x32 Version: 140.0.298.000)
D3DX10 (x32 Version: 15.4.2368.0902)
Destinations (x32 Version: 140.0.253.000)
DeviceDiscovery (x32 Version: 140.0.298.000)
DJ_AIO_06_F4500_SW_MIN (x32 Version: 140.0.851.000)
dm-Fotowelt (x32 Version: 5.0.4)
dosearches Browser Protecter (x32)
E-POP (x32 Version: 1.0.1)
ETDWare PS/2-X64 11.7.2.1_WHQL (Version: 11.7.2.1)
ExpressCache (Version: 1.0.94)
f.lux (HKCU)
F4500 (x32 Version: 140.0.851.000)
Fast Flash Sleep Resume (x32 Version: 1.1.0)
Fotogalerie (x32 Version: 16.4.3503.0728)
Galerie de photos (x32 Version: 16.4.3503.0728)
Google Update Helper (x32 Version: 1.3.23.0)
Help Desk (Version: 1.0.4)
HP Deskjet F4500 All-in-One Driver Software 14.0 Rel. 6 (Version: 14.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HPPhotoGadget (x32 Version: 140.0.524.000)
Intel AppUp(SM) center (x32 Version: 3.6.1.33070.11)
Intel(R) Manageability Engine Firmware Recovery Agent (x32 Version: 1.0.0.36702)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)
Intel(R) PRO/Wireless Driver (Version: 16.01.5000.0577)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2932)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 2.5.0.0248)
Intel(R) Rapid Start Technology (x32 Version: 2.1.0.1002)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149)
Intel® PROSet/Wireless Software (x32 Version: 16.1.5)
Intel® PROSet/Wireless WiFi Software (Version: 16.01.5000.0269)
Intel® Trusted Connect Service Client (Version: 1.24.388.1)
metaCrawler (x32)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 365 Home Premium - de-de (Version: 15.0.4535.1511)
Microsoft Office Proofing Tools 2013 - Español (x32 Version: 15.0.4420.1017)
Microsoft SkyDrive (HKCU Version: 17.0.2015.0811)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Maker (x32 Version: 16.4.3503.0728)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 25.0)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1108.0727)
Network64 (Version: 140.0.306.000)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4535.1511)
Office 15 Click-to-Run Licensing Component (Version: 15.0.4535.1511)
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4535.1511)
PDF24 Creator 5.7.0 (x32)
Photo Common (x32 Version: 16.4.3503.0728)
Photo Gallery (x32 Version: 16.4.3503.0728)
Raccolta foto (x32 Version: 16.4.3503.0728)
Realtek Ethernet Controller Driver (x32 Version: 8.2.612.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6699)
Recovery (x32 Version: 6.0.5.0)
S Agent (Version: 1.0.7)
Samsung Kies (x32 Version: 2.6.0.13091_9)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.27.0)
Scan (x32 Version: 140.0.253.000)
Settings (x32 Version: 2.0.0)
Skype™ 6.7 (x32 Version: 6.7.102)
Spotify (HKCU Version: 0.9.4.185.g7545a404)
Start Menu 8 (x32 Version: 1.3.0.0)
Status (x32 Version: 140.0.342.000)
Support Center (Version: 2.0.7)
Support Center FAQ (x32 Version: 1.0.0)
SW Update (x32 Version: 2.0.14)
Toolbox (x32 Version: 140.0.596.000)
TrayApp (x32 Version: 140.0.297.000)
User Guide (x32 Version: 1.1.00)
VLC media player 2.1.0 (x32 Version: 2.1.0)
WebReg (x32 Version: 140.0.297.017)
Windows Driver Package - Samsung Electronics Co. Ltd. (RadioHIDMini) HIDClass (07/27/2012 20.57.1.735) (Version: 07/27/2012 20.57.1.735)
Windows Live (x32 Version: 16.4.3503.0728)
Windows Live Communications Platform (x32 Version: 16.4.3503.0728)
Windows Live Essentials (x32 Version: 16.4.3503.0728)
Windows Live Installer (x32 Version: 16.4.3503.0728)
Windows Live Photo Common (x32 Version: 16.4.3503.0728)
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728)
Windows Live SOXE (x32 Version: 16.4.3503.0728)
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728)
Windows Live UX Platform (x32 Version: 16.4.3503.0728)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728)
Xerox PhotoCafe (x32 Version: 1.0.0.6162)
==================== Restore Points =========================
09-11-2013 11:23:14 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {04B9B038-B43D-404B-832E-4D3D27714F9E} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2012-09-20] (Microsoft Corporation)
Task: {1AB95F62-3442-46F3-AF84-79495477F154} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-09-06] (Microsoft Corporation)
Task: {1C03137C-5D83-4D9D-80CF-048225A125A2} - System32\Tasks\DigitalSite => C:\Users\Gabriele\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe
Task: {2DB5C5B0-9BCF-4FA7-924A-A9E6BC2323A8} - System32\Tasks\BonanzaDealsUpdate => C:\Program
Task: {42A6D567-CA55-4000-BB74-DE2C4AA724B5} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2013-10-10] (Microsoft Corporation)
Task: {45628C5C-7708-4284-A28B-0589B30FC69A} - System32\Tasks\FFSRConfigurer => C:\Program Files (x86)\Samsung\Fast Flash Sleep Resume\FFSRConfigurer.exe [2012-08-10] (Samsung)
Task: {474A91C6-C005-4ADD-B8A2-030753576A39} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-14] (Intel Corporation)
Task: {4863E183-1D23-4DDD-8F22-7F037B00C39A} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {592AA795-DA54-41A7-B7E1-B84D39702A8B} - System32\Tasks\StartMenuAutoupdate => C:\Program Files (x86)\IObit\Start Menu 8\AutoUpdate.exe [2013-09-29] (IObit)
Task: {5B340A6D-2137-4E96-A604-2738827ECE81} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-11-08] (BonanzaDeals)
Task: {642A161F-5FE3-42A8-9193-30A22D4A6AC1} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2012-08-23] (SEC)
Task: {69739787-A141-45AD-BB92-BCE314D17EBE} - System32\Tasks\SWUpdateAgent => C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2012-08-22] (Samsung Electronics CO., LTD.)
Task: {733DAC2A-3B79-419B-86DF-06E9370B3FF2} - System32\Tasks\WLANStartup => C:\Program Files (x86)\Samsung\Easy Settings\WLANStartup.exe
Task: {77F5E948-C3DD-47EE-BDA5-0245B24C0F29} - System32\Tasks\Xerox PhotoCafe Communicator => C:\ProgramData\Xerox PhotoCafe\MessageCheck.exe [2011-10-26] ()
Task: {7A50E03D-B280-482A-B077-F680299163A0} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-11-08] (BonanzaDeals)
Task: {7AC893F1-843B-4892-9113-997600B7C3B0} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2012-08-17] (Samsung Electronics CO., LTD.)
Task: {8A20FFDA-957A-4884-A2BD-7E8DD56191D1} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-14] (Intel Corporation)
Task: {9D13993F-021E-4D12-BC0D-C767B0843D6B} - System32\Tasks\Microsoft Office 15 Sync Maintenance for GABRIELESPC-Gabriele GabrielesPC => C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE [2013-10-10] (Microsoft Corporation)
Task: {AAD0CE96-F769-4C53-96C5-A595FD1526F4} - System32\Tasks\MetaCrawler => C:\Users\Gabriele\AppData\Roaming\MetaCrawler\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: {BC2306E5-F4D0-4138-9E92-2012112A4ABE} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2012-08-26] (Samsung Electronics CO., LTD.)
Task: C:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\windows\Tasks\DigitalSite.job => C:\Users\Gabriele\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe
Task: C:\windows\Tasks\MetaCrawler.job => C:\Users\Gabriele\AppData\Roaming\MetaCrawler\UpdateProc\UpdateTask.exe
Task: C:\windows\Tasks\Xerox PhotoCafe Communicator.job => C:\ProgramData\Xerox PhotoCafe\MessageCheck.exe
==================== Loaded Modules (whitelisted) =============
2012-07-30 07:41 - 2012-07-25 04:08 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-10-10 22:48 - 2013-10-10 22:48 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2013-10-17 10:08 - 2013-09-30 10:01 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-03-04 11:49 - 2011-03-04 11:49 - 00202752 _____ () C:\Program Files (x86)\Cisco\VPNClient\vpnapi.dll
2013-10-22 06:48 - 2013-09-29 18:05 - 00348992 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madExcept_.bpl
2013-10-22 06:48 - 2013-09-29 18:05 - 00183616 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madBasic_.bpl
2013-10-22 06:48 - 2013-09-29 18:05 - 00051008 _____ () C:\Program Files (x86)\IObit\Start Menu 8\madDisAsm_.bpl
2012-08-26 10:48 - 2012-08-26 10:48 - 00028280 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll
2012-08-26 10:48 - 2012-08-26 10:48 - 01015416 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll
2012-08-26 10:48 - 2012-08-26 10:48 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll
2012-08-26 10:48 - 2012-08-26 10:48 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll
2012-08-26 10:48 - 2012-08-26 10:48 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
2012-08-26 10:48 - 2012-08-26 10:48 - 00026232 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll
2012-08-26 10:48 - 2012-08-26 10:48 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll
2012-08-26 10:48 - 2012-08-26 10:48 - 00029816 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll
2012-08-26 10:48 - 2012-08-26 10:48 - 00091768 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll
2013-10-22 06:48 - 2013-09-29 18:05 - 00040256 _____ () C:\Program Files (x86)\IObit\Start Menu 8\winkey.dll
2012-08-22 08:26 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-11-06 09:39 - 2013-11-06 09:39 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-10-09 17:46 - 2013-07-17 22:56 - 00430080 _____ () C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox\components\FirefoxPickerCommunication.dll
2013-10-10 08:56 - 2013-10-10 09:26 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2013-10-10 08:56 - 2013-10-10 09:27 - 00359592 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\c2r32.dll
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Deskjet F4500 series
Description: Deskjet F4500 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/09/2013 05:23:04 PM) (Source: Perflib) (User: )
Description: WmiApRplC:\windows\system32\wbem\wmiaprpl.dll4
Error: (11/09/2013 05:23:04 PM) (Source: Perflib) (User: )
Description: rdyboost4
Error: (11/09/2013 05:23:03 PM) (Source: Perflib) (User: )
Description: MSDTCC:\windows\system32\msdtcuiu.DLL4
Error: (11/09/2013 05:23:03 PM) (Source: Perflib) (User: )
Description: LsaC:\Windows\System32\Secur32.dll4
Error: (11/09/2013 05:23:03 PM) (Source: Perflib) (User: )
Description: ESENTC:\windows\system32\esentprf.dll4
Error: (11/09/2013 05:23:03 PM) (Source: Perflib) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll4
Error: (11/08/2013 10:13:02 PM) (Source: Perflib) (User: )
Description: WmiApRplC:\windows\system32\wbem\wmiaprpl.dll4
Error: (11/08/2013 10:13:02 PM) (Source: Perflib) (User: )
Description: rdyboost4
Error: (11/08/2013 10:13:02 PM) (Source: Perflib) (User: )
Description: MSDTCC:\windows\system32\msdtcuiu.DLL4
Error: (11/08/2013 10:13:02 PM) (Source: Perflib) (User: )
Description: LsaC:\Windows\System32\Secur32.dll4
System errors:
=============
Error: (11/09/2013 05:51:49 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst NlaSvc erreicht.
Error: (11/09/2013 05:51:19 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst NlaSvc erreicht.
Error: (11/09/2013 03:01:41 PM) (Source: bowser) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "GABRIELESPC" auf Transport "NetBT_Tcpip_{F777ADDD-2478-438E-85C8-BF3C873A22A6}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
Error: (11/09/2013 00:50:03 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst NlaSvc erreicht.
Error: (11/09/2013 00:10:07 PM) (Source: bowser) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "GABRIELESPC" auf Transport "NetBT_Tcpip_{F777ADDD-2478-438E-85C8-BF3C873A22A6}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
Error: (11/09/2013 00:10:00 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst NlaSvc erreicht.
Error: (11/08/2013 11:54:30 PM) (Source: DCOM) (User: )
Description: 50NT AuthorityLocalService{478B41E6-3257-4519-BDA8-E971F9843849}
Error: (11/08/2013 11:28:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Update BatBrowse" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (11/08/2013 08:31:25 AM) (Source: bowser) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "GABRIELESPC" auf Transport "NetBT_Tcpip_{F777ADDD-2478-438E-85C8-BF3C873A22A6}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
Error: (11/06/2013 06:14:58 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst NlaSvc erreicht.
Microsoft Office Sessions:
=========================
Error: (11/09/2013 05:23:04 PM) (Source: Perflib)(User: )
Description: WmiApRplC:\windows\system32\wbem\wmiaprpl.dll4
Error: (11/09/2013 05:23:04 PM) (Source: Perflib)(User: )
Description: rdyboost4
Error: (11/09/2013 05:23:03 PM) (Source: Perflib)(User: )
Description: MSDTCC:\windows\system32\msdtcuiu.DLL4
Error: (11/09/2013 05:23:03 PM) (Source: Perflib)(User: )
Description: LsaC:\Windows\System32\Secur32.dll4
Error: (11/09/2013 05:23:03 PM) (Source: Perflib)(User: )
Description: ESENTC:\windows\system32\esentprf.dll4
Error: (11/09/2013 05:23:03 PM) (Source: Perflib)(User: )
Description: BITSC:\Windows\System32\bitsperf.dll4
Error: (11/08/2013 10:13:02 PM) (Source: Perflib)(User: )
Description: WmiApRplC:\windows\system32\wbem\wmiaprpl.dll4
Error: (11/08/2013 10:13:02 PM) (Source: Perflib)(User: )
Description: rdyboost4
Error: (11/08/2013 10:13:02 PM) (Source: Perflib)(User: )
Description: MSDTCC:\windows\system32\msdtcuiu.DLL4
Error: (11/08/2013 10:13:02 PM) (Source: Perflib)(User: )
Description: LsaC:\Windows\System32\Secur32.dll4
==================== Memory info ===========================
Percentage of memory in use: 46%
Total physical RAM: 5845.53 MB
Available physical RAM: 3098.29 MB
Total Pagefile: 11733.53 MB
Available Pagefile: 8445 MB
Total Virtual: 8192 MB
Available Virtual: 8191.76 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:442.04 GB) (Free:385.64 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 1 (Size: 22 GB) (Disk ID: C059FB77)
Partition: GPT Partition Type
==================== End Of Log ============================
|
|
| Themen zu Mail mit Anhang Payment_20130611.zip (Trojaner) |
| adware/installcore.gen, anhang, antivir, entfernen, klick, meldung, neustart, nicht mehr, payment_20130611.zip, quarantäne, tr/andromeda.adcs.1, tr/dropper.vb.1164, tr/kazy.118784.33, trojaner, trojanisches, trojanisches pferd, verlassen, verschieben, Übersetzung |
Hybrid-Darstellung
