Windows 7: Befall von mehreren Trojanern/Viren -Win64/Conedex.B + C + I, Win64/Sirefef.AZ+BJ

schrauber · 14.12.2013, 16:21

Tool-Bereinigung mit OTC
Bitte lade Dir OTC von OldTimer herunter.

Speichere es auf Deinem Desktop.
Doppelklick auf OTC.exe um das Programm auszuführen.
Eine Datei* sollte nun heruntergeladen werden.
*Das ist eine Datei mit einer Liste von Helferprogrammen, die dann automatisch von Deinem System entfernt werden.
OTC fragt eventuell nach einem Neustart.
Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTC und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind.

oigen · 14.12.2013, 21:37

Leider wieder kein Erfolg...

Das Programm führt gleich nach der Ausführung einen Neustart durch - nach dem Neustart (als Admin) wirkt es so, wie wenn gar nichts mehr passiert. Das Verzeichnis ist immer noch da.

schrauber · 15.12.2013, 08:13

LOL, das ist ja strange

Der Pfad ist C:\FRST oder? zu dem Ordner?

oigen · 15.12.2013, 10:39

Ja genau. Und drinnen ist nur noch \Quarantine\Install\... - der Pfad der schon ursprünglich in Google\Desktop genauso ausgesehen hat, und nicht zu löschen war.

Sowas dürfte wohl nicht zu oft vorkommen...

schrauber · 15.12.2013, 18:54

Der ist in Quarasntäne, also hat das nix mit Malware zu tun.

Falls noch nicht vorhanden, lade Dir OTM von OldTimer herunter.

Speichere die Datei auf deinem Desktop.
Sollte Dein Anti-Virus-Programm "Alarm" schlagen, bitte ignorieren und/oder OTM auf die Liste der Ausnahmen setzen.
Starte bitte die OTM.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere den Inhalt der folgenden Codebox komplett in die Box.
Code:
ATTFilter
```
:files
C:\FRST
:commands
[emptytemp]
         
```
Klicke nun auf .
Bitte alles aus dem Ergebnisfenster ( ) herauskopieren
oder
den Inhalt der Datei C:\_OTM\MovedFiles\<datum_nr.>.log kopieren
und das Ergebnis in Deine nächste Antwort posten.
Schließe OTM

Sollte eine Datei oder ein Ordner nicht verschoben werden können, wirst Du eventuell aufgefordert, den PC neuzustarten damit der Prozess abgeschlossen werden kann. Sollte dies der Fall sein, bestätige das mit Ja..

oigen · 16.12.2013, 20:30

OK - FRST ist weg

Code:

ATTFilter

All processes killed
========== FILES ==========
Folder move failed. C:\FRST\Quarantine\Install\{b76a39d9-6a23-bedc-000d-ea3828816a40}\   \... scheduled to be moved on reboot.
C:\FRST\Quarantine\Install\{b76a39d9-6a23-bedc-000d-ea3828816a40}\    folder moved successfully.
Folder move failed. C:\FRST\Quarantine\Install\{b76a39d9-6a23-bedc-000d-ea3828816a40} scheduled to be moved on reboot.
C:\FRST\Quarantine\Install folder moved successfully.
C:\FRST\Quarantine folder moved successfully.
C:\FRST folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Admin
->Temp folder emptied: 2382751 bytes
->Temporary Internet Files folder emptied: 26275289 bytes
->FireFox cache emptied: 104879121 bytes
->Google Chrome cache emptied: 68601957 bytes
->Flash cache emptied: 58694 bytes
 
User: All Users
 
User: Andi
->Temp folder emptied: 19288529 bytes
->Temporary Internet Files folder emptied: 280497470 bytes
->FireFox cache emptied: 403571036 bytes
->Flash cache emptied: 80248 bytes
 
User: Angi
->Temp folder emptied: 1900496 bytes
->Temporary Internet Files folder emptied: 13465727 bytes
->FireFox cache emptied: 323667379 bytes
->Google Chrome cache emptied: 390280942 bytes
->Flash cache emptied: 76467 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56468 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Hans
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56468 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56468 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 100558971 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 39024 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50562 bytes
RecycleBin emptied: 5440 bytes
 
Total Files Cleaned = 1.655,00 mb
 
 
OTM by OldTimer - Version 3.1.21.0 log created on 12162013_202043

schrauber · 17.12.2013, 10:40

Dann jetzt bitte in OTM auf den Cleanup Button drücken

oigen · 19.12.2013, 20:19

Ähnliches Problem - OTM läuft durch. Dafür habe ich jetzt einen Ordner C:\_OTM wo die verschobenen Dateien drin sind, und sich wieder nicht löschen lassen...

schrauber · 20.12.2013, 11:35

LOL, das wird ja spannend. Bitte jetzt mal OTC laufen lassen wie einige Posts zuvor.

oigen · 20.12.2013, 17:47

Leider keine Veränderung - C:\_OTM noch da und kann nicht gelöscht werden.

schrauber · 21.12.2013, 16:17

Das is ja witzig.

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

oigen · 22.12.2013, 16:56

OK!

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2013 02
Ran by SYSTEM on MININT-NK9HDUA on 22-12-2013 16:49:14
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-15] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [6330568 2013-03-21] (ESET)
HKLM\...\Run: [combofix] - C:\ComboFix\CF29693.3XE /c C:\ComboFix\Combobatch.bat
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [297280 2011-04-23] (NTI Corporation)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-06-30] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [ArcadeMovieService] - C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-08-26] (CyberLink Corp.)
HKLM-x32\...\Run: [DataCardMonitor] - C:\Program Files (x86)\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe [253952 2012-06-02] (Huawei Technologies Co., Ltd.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact] - "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
HKU\Admin\...\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] - C:\Program Files (x86)\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.)
HKU\Admin\...\Run: [Wondershare Helper Compact] - "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
HKU\Admin\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKU\Andi\...\Run: [Orbitum] - C:\Users\Andi\AppData\Local\Orbitum\Application\chrome.exe
HKU\Andi\...\Run: [HW_OPENEYE_OUC_] - C:\Program Files (x86)\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.)
HKU\Angi\...\Run: [Google Update] - C:\Users\Angi\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-06-02] (Google Inc.)
HKU\Angi\...\Run: [HW_OPENEYE_OUC_] - C:\Program Files (x86)\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-12] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-12] ()
HKU\Hans\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-12] ()
HKU\UpdatusUser\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\Users\Angi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)

==================== Services (Whitelisted) =================

S2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1341664 2013-03-21] (ESET)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-23] (NTI Corporation)
S2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-01] (Microsoft Corporation)
S4 RemoteAccess; C:\Windows\System32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] ()

==================== Drivers (Whitelisted) ====================

S3 androidusb; C:\Windows\System32\Drivers\wsadb.sys [40736 2013-10-03] (Google Inc)
S1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-20] (ESET)
S1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
S2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [190232 2013-01-10] (ESET)
S1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [59440 2013-01-10] (ESET)
S0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [58416 2013-02-20] (ESET)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [243200 2009-10-21] (Huawei Technologies Co., Ltd.)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.)
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [204568 2013-08-19] (DEVGURU Co., LTD.(www.devguru.co.kr))
S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-22 16:49 - 2013-12-22 16:49 - 00000000 ____D C:\FRST
2013-12-22 07:34 - 2013-12-22 07:34 - 01928024 _____ (Farbar) C:\Users\Andi\Downloads\FRST64.exe
2013-12-22 01:18 - 2013-12-22 02:11 - 262144000 _____ C:\Users\Andi\Downloads\DareDorm.11.12.30.Girls.Girls.Girls.XXX.INTERNAL.HR.FLV-KTR_mov-world.net.part1.rar
2013-12-21 02:08 - 2013-12-21 02:08 - 00000000 ____D C:\Users\Andi\AppData\Roaming\wargaming.net
2013-12-20 14:25 - 2010-06-01 19:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2013-12-20 14:25 - 2010-06-01 19:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_7.dll
2013-12-20 14:25 - 2010-06-01 19:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2013-12-20 14:25 - 2010-06-01 19:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_7.dll
2013-12-20 14:25 - 2010-06-01 19:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_5.dll
2013-12-20 14:25 - 2010-06-01 19:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\System32\d3dcsx_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\System32\d3dx11_43.dll
2013-12-20 14:25 - 2010-05-26 02:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2013-12-20 14:25 - 2010-02-04 01:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_6.dll
2013-12-20 14:25 - 2010-02-04 01:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2013-12-20 14:25 - 2010-02-04 01:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2013-12-20 14:25 - 2010-02-04 01:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_6.dll
2013-12-20 14:25 - 2010-02-04 01:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_4.dll
2013-12-20 14:25 - 2010-02-04 01:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2013-12-20 14:25 - 2010-02-04 01:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\System32\X3DAudio1_7.dll
2013-12-20 14:25 - 2010-02-04 01:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2013-12-20 14:25 - 2009-09-04 08:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_5.dll
2013-12-20 14:25 - 2009-09-04 08:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2013-12-20 14:25 - 2009-09-04 08:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_5.dll
2013-12-20 14:25 - 2009-09-04 08:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_3.dll
2013-12-20 14:25 - 2009-09-04 08:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\System32\d3dcsx_42.dll
2013-12-20 14:25 - 2009-09-04 08:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2013-12-20 14:25 - 2009-09-04 08:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_42.dll
2013-12-20 14:25 - 2009-09-04 08:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_42.dll
2013-12-20 14:25 - 2009-09-04 08:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2013-12-20 14:25 - 2009-09-04 08:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2013-12-20 14:25 - 2009-09-04 08:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\System32\d3dx11_42.dll
2013-12-20 14:25 - 2009-09-04 08:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2013-12-20 14:25 - 2009-03-16 05:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_4.dll
2013-12-20 14:25 - 2009-03-16 05:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2013-12-20 14:25 - 2009-03-16 05:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2013-12-20 14:25 - 2009-03-16 05:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_4.dll
2013-12-20 14:25 - 2009-03-16 05:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\System32\X3DAudio1_6.dll
2013-12-20 14:25 - 2009-03-16 05:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2013-12-20 14:25 - 2009-03-09 06:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_41.dll
2013-12-20 14:25 - 2009-03-09 06:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2013-12-20 14:25 - 2009-03-09 06:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_41.dll
2013-12-20 14:25 - 2009-03-09 06:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_41.dll
2013-12-20 14:25 - 2008-10-27 01:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_3.dll
2013-12-20 14:25 - 2008-10-27 01:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2013-12-20 14:25 - 2008-10-27 01:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2013-12-20 14:25 - 2008-10-27 01:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_3.dll
2013-12-20 14:25 - 2008-10-27 01:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_2.dll
2013-12-20 14:25 - 2008-10-27 01:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2013-12-20 14:25 - 2008-10-27 01:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\System32\X3DAudio1_5.dll
2013-12-20 14:25 - 2008-10-27 01:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2013-12-20 14:25 - 2008-10-09 19:52 - 05631312 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_40.dll
2013-12-20 14:25 - 2008-10-09 19:52 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2013-12-20 14:25 - 2008-10-09 19:52 - 02605920 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_40.dll
2013-12-20 14:25 - 2008-10-09 19:52 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2013-12-20 14:25 - 2008-10-09 19:52 - 00519000 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_40.dll
2013-12-20 14:25 - 2008-10-09 19:52 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2013-12-20 14:25 - 2008-07-31 01:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2013-12-20 14:25 - 2008-07-31 01:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_2.dll
2013-12-20 14:25 - 2008-07-31 01:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_1.dll
2013-12-20 14:25 - 2008-07-31 01:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2013-12-20 14:25 - 2008-07-31 01:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_2.dll
2013-12-20 14:25 - 2008-07-31 01:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2013-12-20 14:25 - 2008-07-10 02:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2013-12-20 14:25 - 2008-07-10 02:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2013-12-20 14:25 - 2008-07-10 02:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2013-12-20 14:25 - 2008-05-30 05:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_1.dll
2013-12-20 14:25 - 2008-05-30 05:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2013-12-20 14:25 - 2008-05-30 05:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2013-12-20 14:25 - 2008-05-30 05:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_1.dll
2013-12-20 14:25 - 2008-05-30 05:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\System32\XAPOFX1_0.dll
2013-12-20 14:25 - 2008-05-30 05:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2013-12-20 14:25 - 2008-05-30 05:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2013-12-20 14:25 - 2008-05-30 05:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\System32\X3DAudio1_4.dll
2013-12-20 14:25 - 2008-05-30 05:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_38.dll
2013-12-20 14:25 - 2008-05-30 05:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2013-12-20 14:25 - 2008-05-30 05:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_38.dll
2013-12-20 14:25 - 2008-05-30 05:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2013-12-20 14:25 - 2008-05-30 05:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_38.dll
2013-12-20 14:25 - 2008-05-30 05:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2013-12-20 14:25 - 2008-03-05 07:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\System32\XAudio2_0.dll
2013-12-20 14:25 - 2008-03-05 07:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2013-12-20 14:25 - 2008-03-05 07:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2013-12-20 14:25 - 2008-03-05 07:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\System32\xactengine3_0.dll
2013-12-20 14:25 - 2008-03-05 07:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\System32\X3DAudio1_3.dll
2013-12-20 14:25 - 2008-03-05 07:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2013-12-20 14:25 - 2008-03-05 06:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\System32\D3DX9_37.dll
2013-12-20 14:25 - 2008-03-05 06:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2013-12-20 14:25 - 2008-03-05 06:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_37.dll
2013-12-20 14:25 - 2008-03-05 06:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2013-12-20 14:25 - 2008-02-05 14:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_37.dll
2013-12-20 14:25 - 2008-02-05 14:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2013-12-20 14:25 - 2007-10-21 18:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_10.dll
2013-12-20 14:25 - 2007-10-21 18:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2013-12-20 14:25 - 2007-10-21 18:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\System32\X3DAudio1_2.dll
2013-12-20 14:25 - 2007-10-21 18:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2013-12-20 14:25 - 2007-10-12 06:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_36.dll
2013-12-20 14:25 - 2007-10-12 06:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2013-12-20 14:25 - 2007-10-12 06:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_36.dll
2013-12-20 14:25 - 2007-10-12 06:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2013-12-20 14:25 - 2007-10-02 00:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_36.dll
2013-12-20 14:25 - 2007-10-02 00:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2013-12-20 14:25 - 2007-07-19 15:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_9.dll
2013-12-20 14:25 - 2007-07-19 15:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2013-12-20 14:25 - 2007-07-19 09:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_35.dll
2013-12-20 14:25 - 2007-07-19 09:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2013-12-20 14:25 - 2007-07-19 09:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_35.dll
2013-12-20 14:25 - 2007-07-19 09:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2013-12-20 14:25 - 2007-06-20 11:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_8.dll
2013-12-20 14:25 - 2007-06-20 11:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2013-12-20 14:25 - 2007-05-16 07:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_34.dll
2013-12-20 14:25 - 2007-05-16 07:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2013-12-20 14:25 - 2007-05-16 07:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_34.dll
2013-12-20 14:25 - 2007-05-16 07:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2013-12-20 14:25 - 2007-05-16 07:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_34.dll
2013-12-20 14:25 - 2007-05-16 07:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2013-12-20 14:25 - 2007-04-04 09:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_7.dll
2013-12-20 14:25 - 2007-04-04 09:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2013-12-20 14:25 - 2007-04-04 09:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\System32\xinput1_3.dll
2013-12-20 14:25 - 2007-04-04 09:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2013-12-20 14:25 - 2007-03-15 07:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10_33.dll
2013-12-20 14:25 - 2007-03-15 07:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2013-12-20 14:25 - 2007-03-12 07:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_33.dll
2013-12-20 14:25 - 2007-03-12 07:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2013-12-20 14:25 - 2007-03-12 07:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\System32\D3DCompiler_33.dll
2013-12-20 14:25 - 2007-03-12 07:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2013-12-20 14:25 - 2007-03-05 03:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\System32\x3daudio1_1.dll
2013-12-20 14:25 - 2007-03-05 03:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2013-12-20 14:25 - 2007-01-24 06:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_6.dll
2013-12-20 14:25 - 2007-01-24 06:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2013-12-20 14:25 - 2006-12-08 03:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2013-12-20 14:25 - 2006-12-08 03:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_5.dll
2013-12-20 14:25 - 2006-11-29 04:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\System32\d3dx10.dll
2013-12-20 14:25 - 2006-11-29 04:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2013-12-20 14:25 - 2006-09-28 07:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2013-12-20 14:25 - 2006-09-28 07:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2013-12-20 14:25 - 2006-09-28 07:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_4.dll
2013-12-20 14:24 - 2006-07-28 00:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\System32\xinput1_2.dll
2013-12-20 14:24 - 2006-07-28 00:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_3.dll
2013-12-20 14:24 - 2006-07-28 00:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2013-12-20 14:24 - 2006-07-28 00:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2013-12-20 14:24 - 2006-05-30 22:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2013-12-20 14:24 - 2006-05-30 22:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_2.dll
2013-12-20 14:24 - 2006-03-31 03:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_1.dll
2013-12-20 14:24 - 2006-03-31 03:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2013-12-20 14:24 - 2006-03-31 03:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\System32\xinput1_1.dll
2013-12-20 14:24 - 2006-03-31 03:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2013-12-20 14:24 - 2006-02-02 23:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_29.dll
2013-12-20 14:24 - 2006-02-02 23:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2013-12-20 14:24 - 2006-02-02 23:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\System32\xactengine2_0.dll
2013-12-20 14:24 - 2006-02-02 23:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2013-12-20 14:24 - 2006-02-02 23:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\System32\x3daudio1_0.dll
2013-12-20 14:24 - 2006-02-02 23:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2013-12-20 14:24 - 2005-12-05 09:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_28.dll
2013-12-20 14:24 - 2005-12-05 09:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2013-12-20 14:24 - 2005-07-22 10:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_27.dll
2013-12-20 14:24 - 2005-07-22 10:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2013-12-20 14:24 - 2005-05-26 06:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_26.dll
2013-12-20 14:24 - 2005-05-26 06:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2013-12-20 14:24 - 2005-03-18 08:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_25.dll
2013-12-20 14:24 - 2005-03-18 08:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2013-12-20 14:24 - 2005-02-05 10:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\System32\d3dx9_24.dll
2013-12-20 14:24 - 2005-02-05 10:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2013-12-20 14:21 - 2013-12-21 03:02 - 00000000 ____D C:\Program Files\World of Warplanes
2013-12-20 14:21 - 2013-12-20 14:23 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-12-20 14:21 - 2013-12-20 14:21 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-12-20 14:20 - 2013-12-20 14:20 - 08988024 _____ (Wargaming.net                                               ) C:\Users\Andi\Downloads\WoWP_internet_install_eu.exe
2013-12-16 11:20 - 2013-12-16 11:20 - 00000000 ____D C:\_OTM
2013-12-14 01:21 - 2013-12-14 01:21 - 00000620 _____ C:\DelFix.txt
2013-12-13 11:01 - 2013-12-13 11:08 - 00000000 ____D C:\Users\Andi\AppData\Local\download.am-data
2013-12-13 10:59 - 2013-12-13 10:59 - 00001053 _____ C:\Users\Admin\Desktop\Download.am.lnk
2013-12-11 06:13 - 2013-12-11 06:13 - 00002430 _____ C:\Users\Angi\Downloads\angelswe (1).mid
2013-12-11 06:12 - 2013-12-11 06:12 - 00002430 _____ C:\Users\Angi\Downloads\angelswe.mid
2013-12-11 06:11 - 2013-12-11 06:11 - 00001406 _____ C:\Users\Angi\Downloads\regentsq.mid
2013-12-11 03:54 - 2013-12-11 03:54 - 00002768 _____ C:\Users\Angi\Desktop\Tasche Anna.pcf
2013-12-11 03:54 - 2013-12-11 03:54 - 00000000 ____D C:\Users\Angi\Desktop\Tasche Anna-Dateien
2013-12-11 03:41 - 2013-12-11 03:41 - 00008989 _____ C:\Users\Angi\Desktop\Poster Sarah.pcf
2013-12-11 03:41 - 2013-12-11 03:41 - 00000000 ____D C:\Users\Angi\Desktop\Poster Sarah-Dateien
2013-12-11 03:25 - 2013-12-11 03:25 - 00008450 _____ C:\Users\Angi\Desktop\Poster Anna.pcf
2013-12-11 03:25 - 2013-12-11 03:25 - 00000000 ____D C:\Users\Angi\Desktop\Poster Anna-Dateien
2013-12-10 16:29 - 2013-05-09 21:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\System32\wmp.dll
2013-12-10 16:29 - 2013-05-09 21:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\System32\wmploc.DLL
2013-12-10 16:29 - 2013-05-09 20:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-10 16:29 - 2013-05-09 20:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-10 16:27 - 2013-11-26 03:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-12-10 16:27 - 2013-11-26 02:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-12-10 16:27 - 2013-11-26 02:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2013-12-10 16:27 - 2013-11-26 02:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-10 16:27 - 2013-11-26 01:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-12-10 16:27 - 2013-11-26 01:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2013-12-10 16:27 - 2013-11-26 01:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-12-10 16:27 - 2013-11-26 01:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-12-10 16:27 - 2013-11-26 01:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-12-10 16:27 - 2013-11-26 01:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-10 16:27 - 2013-11-26 01:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-12-10 16:27 - 2013-11-26 01:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-12-10 16:27 - 2013-11-26 01:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2013-12-10 16:27 - 2013-11-26 01:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2013-12-10 16:27 - 2013-11-26 00:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-12-10 16:27 - 2013-11-26 00:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-10 16:27 - 2013-11-26 00:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-10 16:27 - 2013-11-26 00:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-12-10 16:27 - 2013-11-26 00:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-10 16:27 - 2013-11-26 00:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-10 16:27 - 2013-11-26 00:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-10 16:27 - 2013-11-26 00:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-12-10 16:27 - 2013-11-25 23:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-12-10 16:27 - 2013-11-25 23:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-10 16:27 - 2013-11-25 23:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-10 16:27 - 2013-11-25 23:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-12-10 16:27 - 2013-11-25 22:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-12-10 16:27 - 2013-11-25 22:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-12-10 16:27 - 2013-11-25 22:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-10 16:27 - 2013-11-25 22:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-10 16:27 - 2013-11-25 22:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-10 14:43 - 2013-11-23 10:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-10 14:43 - 2013-11-23 09:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll
2013-12-10 14:43 - 2013-11-11 18:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-12-10 14:43 - 2013-11-11 18:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-10 14:43 - 2013-10-29 18:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\System32\msieftp.dll
2013-12-10 14:43 - 2013-10-29 18:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-10 14:43 - 2013-10-29 17:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-12-10 14:43 - 2013-10-18 18:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\imagehlp.dll
2013-12-10 14:43 - 2013-10-18 17:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-10 14:43 - 2013-10-11 18:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\System32\wshom.ocx
2013-12-10 14:43 - 2013-10-11 18:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\System32\scrrun.dll
2013-12-10 14:43 - 2013-10-11 18:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-10 14:43 - 2013-10-11 18:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-10 14:43 - 2013-10-11 17:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\System32\wscript.exe
2013-12-10 14:43 - 2013-10-11 17:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\System32\cscript.exe
2013-12-10 14:43 - 2013-10-11 17:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-10 14:43 - 2013-10-11 17:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-10 14:43 - 2013-10-03 18:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\drmk.sys
2013-12-10 14:43 - 2013-10-03 17:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\portcls.sys
2013-12-09 14:49 - 2013-12-11 03:37 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-09 14:48 - 2013-12-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-12-08 15:58 - 2013-12-22 06:03 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cef47153d6009b.job
2013-12-08 15:58 - 2013-12-08 15:58 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cef47153d6009b
2013-12-03 13:25 - 2013-12-03 13:25 - 00283184 _____ (Mozilla) C:\Users\Andi\Downloads\Firefox Setup Stub 25.0.1.exe
2013-12-03 13:17 - 2013-12-03 13:17 - 00000690 _____ C:\Users\Angi\Desktop\Bestellung_HappyFoto.psc
2013-12-03 13:17 - 2013-12-03 13:17 - 00000000 ____D C:\Users\Angi\Desktop\Bestellung_HappyFoto-Dateien
2013-12-03 07:05 - 2013-10-14 09:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\System32\IEUDINIT.EXE
2013-12-03 07:02 - 2013-12-03 07:02 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-03 07:02 - 2013-12-03 07:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-12-03 07:02 - 2013-12-03 07:02 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2013-12-03 07:02 - 2013-12-03 07:02 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-03 07:02 - 2013-12-03 07:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-12-03 07:02 - 2013-12-03 07:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-03 07:02 - 2013-12-03 07:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-03 07:01 - 2013-12-03 07:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-12-03 07:01 - 2013-12-03 07:01 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-12-03 07:01 - 2013-12-03 07:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-12-03 07:00 - 2013-12-03 07:05 - 00010277 _____ C:\Windows\IE11_main.log
2013-12-03 06:33 - 2013-12-03 06:33 - 00009635 _____ C:\Users\Angi\Desktop\Kreativposter.pcf
2013-12-03 06:33 - 2013-12-03 06:33 - 00000000 ____D C:\Users\Angi\Desktop\Kreativposter-Dateien
2013-12-03 04:10 - 2013-12-03 04:10 - 00001073 _____ C:\Users\Public\Desktop\HappyFoto-Designer.lnk
2013-12-03 04:10 - 2013-12-03 04:10 - 00000000 ____D C:\Users\Angi\AppData\Local\HappyFoto-Designer
2013-12-03 04:08 - 2013-12-03 04:10 - 00000000 ____D C:\Program Files (x86)\HappyFoto-Designer
2013-12-03 04:08 - 2013-12-03 04:08 - 00000000 ____D C:\ProgramData\HappyFoto-Designer
2013-12-03 04:04 - 2013-12-03 04:07 - 255251040 _____ (                                                            ) C:\Users\Angi\Downloads\HappyFoto-Designer.exe
2013-12-02 12:00 - 2013-12-02 12:00 - 02347384 _____ (ESET) C:\Users\Andi\Downloads\esetsmartinstaller_enu.exe
2013-12-01 11:43 - 2013-12-22 04:42 - 00000000 ___RD C:\Users\Angi\Dropbox
2013-12-01 11:43 - 2013-12-01 11:43 - 00001036 _____ C:\Users\Angi\Desktop\Dropbox.lnk
2013-12-01 11:39 - 2013-12-22 04:42 - 00000000 ____D C:\Users\Angi\AppData\Roaming\Dropbox
2013-12-01 11:39 - 2013-12-01 11:39 - 00000182 _____ C:\Windows\wininit.ini
2013-12-01 11:39 - 2013-12-01 11:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Dropbox
2013-12-01 11:38 - 2013-12-01 11:39 - 35334016 _____ (Dropbox, Inc.) C:\Users\Angi\Downloads\Dropbox 2.4.7.exe
2013-12-01 06:15 - 2013-12-01 06:16 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-01 06:15 - 2013-04-04 05:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-11-27 03:50 - 2013-12-13 12:55 - 00000000 ____D C:\Windows\ERUNT
2013-11-27 03:15 - 2013-11-27 03:15 - 00000000 ____D C:\Users\Andi\AppData\Roaming\Malwarebytes
2013-11-27 02:58 - 2013-11-27 02:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-11-27 02:58 - 2013-11-27 02:58 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-24 10:59 - 2013-11-24 10:59 - 00603312 _____ (Emsisoft GmbH) C:\Users\Andi\Downloads\emsiclean.exe
2013-11-24 10:59 - 2013-11-24 10:59 - 00122614 _____ C:\Users\Andi\Downloads\EmsiClean_2013.11.24_19.59.55.txt
2013-11-24 09:06 - 2013-11-24 09:06 - 00000000 ____D C:\Windows\pss
2013-11-24 07:43 - 2013-12-13 12:53 - 00000000 ____D C:\Windows\erdnt
2013-11-24 04:40 - 2013-11-24 04:40 - 00377856 _____ C:\Users\Andi\Downloads\gmer_2.1.19163.exe
2013-11-23 23:54 - 2013-11-23 23:54 - 00000000 ____D C:\Users\Admin\Documents\Anti-Malware
2013-11-23 23:51 - 2013-11-23 23:54 - 209467344 _____ (Emsisoft GmbH                                               ) C:\Users\Andi\Downloads\EmsisoftAntiMalwareSetup.exe
2013-11-23 23:26 - 2013-12-22 06:31 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1001UA1cee8e678ff332c.job
2013-11-23 23:26 - 2013-11-23 23:26 - 00004090 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1001UA1cee8e678ff332c
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Users\Andi\Downloads\www.torrent.to...Gefaehrten.2011.DVDScr.German.AC3MD.XViD-PWND
2013-11-23 08:24 - 2013-11-23 08:25 - 00000000 ____D C:\Windows\SysWOW64\C2MP
2013-11-23 08:22 - 2013-11-23 08:24 - 42450960 _____ (VLC - Codec Pack) C:\Users\Andi\Downloads\vlc.codec.pack.v2.0.5.1.setup.exe
2013-11-23 07:35 - 2013-11-23 07:37 - 00000000 ____D C:\Users\Andi\Downloads\The Hobbit The Desolation of Smaug 2013
2013-11-23 07:32 - 2013-11-23 09:35 - 00000000 ____D C:\Users\Andi\Downloads\Der.Hobbit.Eine.unerwartete.Reise.2012.DVDRip.LD.German.XviD-CiNETiPP

==================== One Month Modified Files and Folders =======

2013-12-22 16:49 - 2013-12-22 16:49 - 00000000 ____D C:\FRST
2013-12-22 07:44 - 2012-01-15 10:22 - 01330141 _____ C:\Windows\WindowsUpdate.log
2013-12-22 07:44 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-22 07:44 - 2009-07-13 20:51 - 00190040 _____ C:\Windows\setupact.log
2013-12-22 07:39 - 2009-07-13 20:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-22 07:39 - 2009-07-13 20:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-22 07:37 - 2012-10-10 13:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-22 07:37 - 2012-01-15 19:15 - 00669464 _____ C:\Windows\System32\perfh007.dat
2013-12-22 07:37 - 2012-01-15 19:15 - 00134990 _____ C:\Windows\System32\perfc007.dat
2013-12-22 07:37 - 2009-07-13 21:13 - 01528364 _____ C:\Windows\System32\PerfStringBackup.INI
2013-12-22 07:34 - 2013-12-22 07:34 - 01928024 _____ (Farbar) C:\Users\Andi\Downloads\FRST64.exe
2013-12-22 07:32 - 2013-07-08 07:40 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-22 06:31 - 2013-11-23 23:26 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1001UA1cee8e678ff332c.job
2013-12-22 06:23 - 2013-10-12 11:12 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1002UA1cec77f502d0aa.job
2013-12-22 06:03 - 2013-12-08 15:58 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cef47153d6009b.job
2013-12-22 04:42 - 2013-12-01 11:43 - 00000000 ___RD C:\Users\Angi\Dropbox
2013-12-22 04:42 - 2013-12-01 11:39 - 00000000 ____D C:\Users\Angi\AppData\Roaming\Dropbox
2013-12-22 03:24 - 2013-11-10 05:24 - 00000000 ____D C:\Users\Andi\AppData\Roaming\BitTorrent
2013-12-22 03:22 - 2013-08-26 21:26 - 00000000 ____D C:\Users\Andi\AppData\Roaming\vlc
2013-12-22 02:11 - 2013-12-22 01:18 - 262144000 _____ C:\Users\Andi\Downloads\DareDorm.11.12.30.Girls.Girls.Girls.XXX.INTERNAL.HR.FLV-KTR_mov-world.net.part1.rar
2013-12-21 03:02 - 2013-12-20 14:21 - 00000000 ____D C:\Program Files\World of Warplanes
2013-12-21 02:08 - 2013-12-21 02:08 - 00000000 ____D C:\Users\Andi\AppData\Roaming\wargaming.net
2013-12-20 14:25 - 2013-12-20 14:21 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-12-20 14:25 - 2011-10-13 19:34 - 00010071 _____ C:\Windows\DirectX.log
2013-12-20 14:23 - 2013-12-20 14:21 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-12-20 14:20 - 2013-12-20 14:20 - 08988024 _____ (Wargaming.net                                               ) C:\Users\Andi\Downloads\WoWP_internet_install_eu.exe
2013-12-20 14:12 - 2012-06-02 04:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-20 08:48 - 2012-06-02 04:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-20 08:43 - 2010-11-20 19:47 - 00388320 _____ C:\Windows\PFRO.log
2013-12-19 11:07 - 2012-06-02 02:43 - 00000000 ____D C:\ProgramData\clear.fi
2013-12-19 08:23 - 2012-06-02 04:35 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1002Core.job
2013-12-17 23:31 - 2013-09-13 13:21 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1001Core1ceb0c727a22316.job
2013-12-16 11:20 - 2013-12-16 11:20 - 00000000 ____D C:\_OTM
2013-12-16 11:20 - 2012-08-14 11:29 - 00000000 ____D C:\Users\Andi\AppData\Roaming\SoftGrid Client
2013-12-16 11:11 - 2012-06-02 03:48 - 00000000 ____D C:\Fusspflege
2013-12-15 04:37 - 2012-06-02 04:32 - 00000000 ____D C:\Users\Angi\AppData\Local\Mozilla
2013-12-14 15:32 - 2013-08-15 05:17 - 90708896 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-12-14 15:32 - 2013-08-15 05:17 - 00000000 ____D C:\Windows\System32\MRT
2013-12-14 12:07 - 2012-06-02 02:21 - 00000000 ____D C:\users\Admin
2013-12-14 01:21 - 2013-12-14 01:21 - 00000620 _____ C:\DelFix.txt
2013-12-13 13:32 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-12-13 12:55 - 2013-11-27 03:50 - 00000000 ____D C:\Windows\ERUNT
2013-12-13 12:53 - 2013-11-24 07:43 - 00000000 ____D C:\Windows\erdnt
2013-12-13 11:08 - 2013-12-13 11:01 - 00000000 ____D C:\Users\Andi\AppData\Local\download.am-data
2013-12-13 10:59 - 2013-12-13 10:59 - 00001053 _____ C:\Users\Admin\Desktop\Download.am.lnk
2013-12-12 11:04 - 2013-07-08 07:40 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-11 06:13 - 2013-12-11 06:13 - 00002430 _____ C:\Users\Angi\Downloads\angelswe (1).mid
2013-12-11 06:12 - 2013-12-11 06:12 - 00002430 _____ C:\Users\Angi\Downloads\angelswe.mid
2013-12-11 06:11 - 2013-12-11 06:11 - 00001406 _____ C:\Users\Angi\Downloads\regentsq.mid
2013-12-11 04:37 - 2012-10-10 13:33 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 03:54 - 2013-12-11 03:54 - 00002768 _____ C:\Users\Angi\Desktop\Tasche Anna.pcf
2013-12-11 03:54 - 2013-12-11 03:54 - 00000000 ____D C:\Users\Angi\Desktop\Tasche Anna-Dateien
2013-12-11 03:41 - 2013-12-11 03:41 - 00008989 _____ C:\Users\Angi\Desktop\Poster Sarah.pcf
2013-12-11 03:41 - 2013-12-11 03:41 - 00000000 ____D C:\Users\Angi\Desktop\Poster Sarah-Dateien
2013-12-11 03:37 - 2013-12-09 14:49 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 03:37 - 2011-10-13 19:49 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 03:25 - 2013-12-11 03:25 - 00008450 _____ C:\Users\Angi\Desktop\Poster Anna.pcf
2013-12-11 03:25 - 2013-12-11 03:25 - 00000000 ____D C:\Users\Angi\Desktop\Poster Anna-Dateien
2013-12-11 03:09 - 2012-06-04 12:00 - 00000000 ____D C:\Fotos
2013-12-10 23:19 - 2013-09-11 21:01 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-12-10 21:41 - 2009-07-13 20:45 - 00481440 _____ C:\Windows\System32\FNTCACHE.DAT
2013-12-09 14:49 - 2013-12-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-12-08 15:58 - 2013-12-08 15:58 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cef47153d6009b
2013-12-08 15:58 - 2013-07-08 07:40 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-08 08:18 - 2013-10-12 11:12 - 00004084 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1002UA1cec77f502d0aa
2013-12-08 08:18 - 2012-06-02 04:35 - 00003688 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1002Core
2013-12-06 04:37 - 2009-07-13 21:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-03 13:28 - 2012-06-04 21:34 - 00000000 ____D C:\Users\Andi\AppData\Local\Mozilla
2013-12-03 13:26 - 2012-06-02 04:17 - 00001155 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-12-03 13:25 - 2013-12-03 13:25 - 00283184 _____ (Mozilla) C:\Users\Andi\Downloads\Firefox Setup Stub 25.0.1.exe
2013-12-03 13:17 - 2013-12-03 13:17 - 00000690 _____ C:\Users\Angi\Desktop\Bestellung_HappyFoto.psc
2013-12-03 13:17 - 2013-12-03 13:17 - 00000000 ____D C:\Users\Angi\Desktop\Bestellung_HappyFoto-Dateien
2013-12-03 12:59 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-03 07:05 - 2013-12-03 07:00 - 00010277 _____ C:\Windows\IE11_main.log
2013-12-03 07:02 - 2013-12-03 07:02 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-03 07:02 - 2013-12-03 07:02 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-12-03 07:02 - 2013-12-03 07:02 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2013-12-03 07:02 - 2013-12-03 07:02 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-03 07:02 - 2013-12-03 07:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-12-03 07:02 - 2013-12-03 07:02 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-03 07:02 - 2013-12-03 07:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-03 07:02 - 2013-12-03 07:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-12-03 07:02 - 2013-12-03 07:02 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-03 07:01 - 2013-12-03 07:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-12-03 07:01 - 2013-12-03 07:01 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-12-03 07:01 - 2013-12-03 07:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-12-03 07:01 - 2013-12-03 07:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-12-03 06:33 - 2013-12-03 06:33 - 00009635 _____ C:\Users\Angi\Desktop\Kreativposter.pcf
2013-12-03 06:33 - 2013-12-03 06:33 - 00000000 ____D C:\Users\Angi\Desktop\Kreativposter-Dateien
2013-12-03 04:10 - 2013-12-03 04:10 - 00001073 _____ C:\Users\Public\Desktop\HappyFoto-Designer.lnk
2013-12-03 04:10 - 2013-12-03 04:10 - 00000000 ____D C:\Users\Angi\AppData\Local\HappyFoto-Designer
2013-12-03 04:10 - 2013-12-03 04:08 - 00000000 ____D C:\Program Files (x86)\HappyFoto-Designer
2013-12-03 04:08 - 2013-12-03 04:08 - 00000000 ____D C:\ProgramData\HappyFoto-Designer
2013-12-03 04:07 - 2013-12-03 04:04 - 255251040 _____ (                                                            ) C:\Users\Angi\Downloads\HappyFoto-Designer.exe
2013-12-02 12:00 - 2013-12-02 12:00 - 02347384 _____ (ESET) C:\Users\Andi\Downloads\esetsmartinstaller_enu.exe
2013-12-01 11:43 - 2013-12-01 11:43 - 00001036 _____ C:\Users\Angi\Desktop\Dropbox.lnk
2013-12-01 11:43 - 2012-06-02 04:28 - 00000000 ____D C:\users\Angi
2013-12-01 11:39 - 2013-12-01 11:39 - 00000182 _____ C:\Windows\wininit.ini
2013-12-01 11:39 - 2013-12-01 11:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Dropbox
2013-12-01 11:39 - 2013-12-01 11:38 - 35334016 _____ (Dropbox, Inc.) C:\Users\Angi\Downloads\Dropbox 2.4.7.exe
2013-12-01 06:16 - 2013-12-01 06:15 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-27 03:35 - 2012-06-02 04:24 - 00001333 _____ C:\Users\Admin\Desktop\Google Chrome.lnk
2013-11-27 03:35 - 2012-06-02 04:10 - 00000891 _____ C:\Users\Admin\Desktop\iexplore - Verknüpfung.lnk
2013-11-27 03:15 - 2013-11-27 03:15 - 00000000 ____D C:\Users\Andi\AppData\Roaming\Malwarebytes
2013-11-27 02:58 - 2013-11-27 02:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-11-27 02:58 - 2013-11-27 02:58 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-26 03:54 - 2013-12-10 16:27 - 23183360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-26 03:25 - 2010-11-20 19:27 - 00267936 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-11-26 02:19 - 2013-12-10 16:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-26 02:18 - 2013-12-10 16:27 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2013-11-26 02:11 - 2013-12-10 16:27 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-26 01:48 - 2013-12-10 16:27 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-26 01:46 - 2013-12-10 16:27 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2013-11-26 01:41 - 2013-12-10 16:27 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-26 01:29 - 2013-12-10 16:27 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-26 01:27 - 2013-12-10 16:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-26 01:23 - 2013-12-10 16:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-26 01:21 - 2013-12-10 16:27 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-26 01:18 - 2013-12-10 16:27 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-11-26 01:18 - 2013-12-10 16:27 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2013-11-26 01:16 - 2013-12-10 16:27 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2013-11-26 00:57 - 2013-12-10 16:27 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-26 00:38 - 2013-12-10 16:27 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-26 00:38 - 2013-12-10 16:27 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-26 00:35 - 2013-12-10 16:27 - 05769216 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-26 00:32 - 2013-12-10 16:27 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-26 00:28 - 2013-12-10 16:27 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-26 00:16 - 2013-12-10 16:27 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-26 00:02 - 2013-12-10 16:27 - 01995264 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-11-25 23:48 - 2013-12-10 16:27 - 12996608 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-25 23:32 - 2013-12-10 16:27 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-25 23:26 - 2013-12-10 16:27 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-25 23:07 - 2013-12-10 16:27 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-25 22:40 - 2013-12-10 16:27 - 01395200 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-25 22:34 - 2013-12-10 16:27 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-11-25 22:34 - 2013-12-10 16:27 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-25 22:33 - 2013-12-10 16:27 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-25 22:27 - 2013-12-10 16:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-24 10:59 - 2013-11-24 10:59 - 00603312 _____ (Emsisoft GmbH) C:\Users\Andi\Downloads\emsiclean.exe
2013-11-24 10:59 - 2013-11-24 10:59 - 00122614 _____ C:\Users\Andi\Downloads\EmsiClean_2013.11.24_19.59.55.txt
2013-11-24 09:06 - 2013-11-24 09:06 - 00000000 ____D C:\Windows\pss
2013-11-24 07:54 - 2009-07-13 18:34 - 79691776 _____ C:\Windows\System32\config\SOFTWARE.bak
2013-11-24 07:54 - 2009-07-13 18:34 - 23068672 _____ C:\Windows\System32\config\SYSTEM.bak
2013-11-24 07:54 - 2009-07-13 18:34 - 00524288 _____ C:\Windows\System32\config\DEFAULT.bak
2013-11-24 07:54 - 2009-07-13 18:34 - 00262144 _____ C:\Windows\System32\config\SECURITY.bak
2013-11-24 07:54 - 2009-07-13 18:34 - 00262144 _____ C:\Windows\System32\config\SAM.bak
2013-11-24 04:40 - 2013-11-24 04:40 - 00377856 _____ C:\Users\Andi\Downloads\gmer_2.1.19163.exe
2013-11-23 23:54 - 2013-11-23 23:54 - 00000000 ____D C:\Users\Admin\Documents\Anti-Malware
2013-11-23 23:54 - 2013-11-23 23:51 - 209467344 _____ (Emsisoft GmbH                                               ) C:\Users\Andi\Downloads\EmsisoftAntiMalwareSetup.exe
2013-11-23 23:26 - 2013-11-23 23:26 - 00004090 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1001UA1cee8e678ff332c
2013-11-23 23:26 - 2013-09-13 13:21 - 00003694 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2098008458-3402727504-3613341839-1001Core1ceb0c727a22316
2013-11-23 23:23 - 2012-06-02 02:21 - 00119864 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Users\Andi\Downloads\www.torrent.to...Gefaehrten.2011.DVDScr.German.AC3MD.XViD-PWND
2013-11-23 10:26 - 2013-12-10 14:43 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-23 09:47 - 2013-12-10 14:43 - 00465920 _____ (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll
2013-11-23 09:35 - 2013-11-23 07:32 - 00000000 ____D C:\Users\Andi\Downloads\Der.Hobbit.Eine.unerwartete.Reise.2012.DVDRip.LD.German.XviD-CiNETiPP
2013-11-23 08:31 - 2012-06-02 04:19 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-11-23 08:25 - 2013-11-23 08:24 - 00000000 ____D C:\Windows\SysWOW64\C2MP
2013-11-23 08:24 - 2013-11-23 08:22 - 42450960 _____ (VLC - Codec Pack) C:\Users\Andi\Downloads\vlc.codec.pack.v2.0.5.1.setup.exe
2013-11-23 07:37 - 2013-11-23 07:35 - 00000000 ____D C:\Users\Andi\Downloads\The Hobbit The Desolation of Smaug 2013
2013-11-23 00:41 - 2013-11-20 03:27 - 00000000 ____D C:\Users\Andi\Downloads\Lucky Number Slevin 2006 [German].DVDScr (Dual Audio)

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
ATTENTION: ====> ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-12-14 01:21:40
Restore point made on: 2013-12-14 01:50:46
Restore point made on: 2013-12-14 15:31:53
Restore point made on: 2013-12-18 00:07:10
Restore point made on: 2013-12-20 14:24:16
Restore point made on: 2013-12-21 02:09:40

==================== Memory info =========================== 

Percentage of memory in use: 11%
Total physical RAM: 8043.86 MB
Available physical RAM: 7137.38 MB
Total Pagefile: 8042.06 MB
Available Pagefile: 7122.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:913.41 GB) (Free:607.46 GB) NTFS
Drive e: (PQSERVICE) (Fixed) (Total:18 GB) (Free:4 GB) NTFS
Drive g: (UDISK 2.0) (Removable) (Total:0.46 GB) (Free:0.12 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 6226A998)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=913 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 471 MB) (Disk ID: 1D701998)
Partition 1: (Active) - (Size=471 MB) - (Type=0E)


LastRegBack: 2013-12-10 00:30

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 23.12.2013, 09:08

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\_OTM

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Starte mal neu und schau ob der Ordner noch da is.

oigen · 28.12.2013, 11:33

So weit so gut...

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-12-2013 02
Ran by SYSTEM at 2013-12-28 11:25:20 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
C:\_OTM
*****************

C:\_OTM => Moved successfully.

==== End of Fixlog ====

Allerdings gibt es jetzt wieder einen Ordner C:\FRST den ich nicht löschen kann

Der Pfad sieht mittlerweile so aus:
C:\FRST\Quarantine\_OTM\MovedFiles\12162013_202043\C_FRST\Quarantine\Install

Was mir in den letzten Tagen aufgefallen ist:
Beim User meiner Frau kommt in unregelmässigen Abständen beim Herunterfahren, dass das Programm service.exe oder services.exe vor dem Herunterfahren beendet werden muss oder so ähnlich. Leider konnte ich die Meldung gerade nicht reproduzieren, weshalb ich den genauen Wortlaut nicht im Kopf habe. Wenn es wieder auftritt gebe ich ein exaktes Update!

Könnte das eine weitere Bedrohung sein?

Danke,
Andreas

schrauber · 29.12.2013, 11:28

Poste bitte mal FRST Logs aus deinem Account und dem deiner Frau.

15.12.2013, 08:13	#33
schrauber /// the machine /// TB-Ausbilder	Windows 7: Befall von mehreren Trojanern/Viren -Win64/Conedex.B + C + I, Win64/Sirefef.AZ+BJ LOL, das ist ja strange Der Pfad ist C:\FRST oder? zu dem Ordner? __________________ __________________

17.12.2013, 10:40	#37
schrauber /// the machine /// TB-Ausbilder	Windows 7: Befall von mehreren Trojanern/Viren -Win64/Conedex.B + C + I, Win64/Sirefef.AZ+BJ Dann jetzt bitte in OTM auf den Cleanup Button drücken __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

20.12.2013, 11:35	#39
schrauber /// the machine /// TB-Ausbilder	Windows 7: Befall von mehreren Trojanern/Viren -Win64/Conedex.B + C + I, Win64/Sirefef.AZ+BJ LOL, das wird ja spannend. Bitte jetzt mal OTC laufen lassen wie einige Posts zuvor. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

29.12.2013, 11:28	#45
schrauber /// the machine /// TB-Ausbilder	Windows 7: Befall von mehreren Trojanern/Viren -Win64/Conedex.B + C + I, Win64/Sirefef.AZ+BJ Poste bitte mal FRST Logs aus deinem Account und dem deiner Frau. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 7: Befall von mehreren Trojanern/Viren -Win64/Conedex.B + C + I, Win64/Sirefef.AZ+BJ

Log-Analyse und Auswertung: Windows 7: Befall von mehreren Trojanern/Viren -Win64/Conedex.B + C + I, Win64/Sirefef.AZ+BJ