Bei Nutzung von Google Captcha Abfrage / Verdacht auf Mißbrauch meines Internetzugangs

Deza

Hallo,

ich hatte dieses Problem früher schon mal, damals ist es aber wieder verschwunden, deswegen habe ich nichts unternommen. (Fast) jedes Mal wenn ich eine Google Anfrage mache, werde ich aufgefordert einen Captcha Code einzugeben, eine Erklärung darunter sagt mir dann, dass von meiner IP verdächtige Anfragen laufen. Hier im Forum gibt es dieses Problem ja häufiger. In meinem Fall kommt dazu, dass ich vor einigen Monaten Post von einem der berüchtigten Abmahnanwälte bekommen habe. Angeblich hätte ich einen Film zum Download angeboten. Von dem Film hatte ich noch nie etwas gehört, geschweige denn ihn (oder irgendeinen anderen) zum DL angeboten. Das ist eine andere Baustelle, aber nun habe ich den Verdacht, das ein Zusammenhang besteht.
Ich wohne mit meiner Freundin zusammen, wir nutzen denselben Internetzugang und sie hat seit heute das Captcha Problem auch. Leider nutzt sie einen Rechner von ihrem Arbeitgeber auf dem sie keine Adminrechte hat. Ich habe zwar auch einen Arbeitslaptop, aber in meinem Fall mit Adminrechten wenn ich mich entsprechend einlogge (was ich normalerweise nicht tue).
Ich habe alle Schritte die in der Anleitung stehen erledigt, hier die Logs:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:44 on 12/12/2013 (****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-12-2013
Ran by **** (ATTENTION: The logged in user is not administrator) on LOE10123LAP on 12-12-2013 09:50:06
Running from C:\Users\****\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Users\sismer\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McTray.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Dropbox, Inc.) C:\Users\sismer\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Mendeley Ltd.) C:\Program Files (x86)\Mendeley Desktop\MendeleyDesktop.exe
(Thomson Reuters) C:\Program Files (x86)\EndNote X5\EndNote.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\WINDOWS\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [684016 2012-12-21] (Alps Electric Co., Ltd.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2780776 2011-07-19] (CANON INC.)
HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000}
HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196}
HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196}
HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\WINDOWS\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\WINDOWS\inf\ksfilter.inf,MSTEE.Interface.Install
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoDesktopCleanupWizard] 1
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [17707624 2013-02-07] (Skype Technologies S.A.)
HKCU\...\Run: [SkyDrive] - C:\Users\****\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257136 2013-08-23] (Microsoft Corporation)
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE [944520 2011-02-11] (Microsoft Corporation)
HKCU\...\Policies\system: [RunLogonScriptSync] 1
HKCU\...\Policies\Explorer: [ForceStartMenuLogOff] 1
HKCU\...\Policies\Explorer: [NoSMBalloonTip] 1
HKCU\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKCU\...\Policies\Explorer: [NoNetHood] 1
HKCU\...\Policies\Explorer: [HideSCAHealth] 1
MountPoints2: {9c9b1ba4-5420-11e3-ac30-74e543508e32} - F:\Startme.exe
HKLM-x32\...\Run: [McAfeeUpdaterUI] - C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe [333416 2012-08-21] (McAfee, Inc.)
HKLM-x32\...\Run: [ShStatEXE] - C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe [215360 2011-01-12] (McAfee, Inc.)
HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [362432 2011-12-22] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [39136 2012-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [825560 2012-12-18] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1637496 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [468112 2011-07-25] (CANON INC.)
Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft SharePoint Workspace.lnk
ShortcutTarget: Microsoft SharePoint Workspace.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.fu-berlin.de/
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.7.0_25\bin\ssv.dll (Oracle Corporation)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120910124241.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.7.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.7.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120910124242.dll (McAfee, Inc.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.7.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\bgucrjj5. new
FF Homepage: hxxp://www.fu-berlin.de
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre1.7.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre1.7.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pieps.com/PiepsUpdate - C:\Users\****\AppData\Roaming\Pieps\PiepsUpdate\1.3.0.0\npPiepsUpdate.dll (Pieps GmbH)
FF Extension: leechblock - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\bgucrjj5. new\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi
FF Extension: Adblock Plus - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\bgucrjj5. new\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}
FF Extension: Quick Locale Switcher - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{25A1388B-6B18-46c3-BEBA-A81915D0DE8F}
FF Extension: langpack-de - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\langpack-de@firefox.mozilla.org.xpi
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: IDS_SS_NAME - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn

==================== Services (Whitelisted) =================

R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [132712 2012-08-21] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199008 2012-09-10] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe [209760 2011-01-12] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [158832 2012-09-10] (McAfee, Inc.)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 smstsmgr; C:\Windows\SysWOW64\CCM\TSManager.exe [246624 2009-09-18] ()
R2 USBDLM; C:\Program Files (x86)\USBDLM\USBDLM.exe [156160 2008-09-18] (Uwe Sieber - www.uwe-sieber.de)

==================== Drivers (Whitelisted) ====================

R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [135720 2012-07-04] (Broadcom Corporation.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [158712 2012-09-10] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [228752 2012-09-10] (McAfee, Inc.)
U3 mfeavfk01; No ImagePath
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [642952 2012-09-10] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100904 2012-09-10] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [283744 2012-09-10] (McAfee, Inc.)
S3 prepdrvr; C:\Windows\SysWOW64\CCM\prepdrv.sys [26992 2009-09-18] ()
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [68208 2011-11-04] (STMicroelectronics)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-12 09:50 - 2013-12-12 09:50 - 00020140 _____ C:\Users\****\Desktop\FRST.txt
2013-12-12 09:49 - 2013-12-12 09:49 - 00000000 ____D C:\FRST
2013-12-12 09:45 - 2013-12-12 09:48 - 01927106 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-12-12 09:44 - 2013-12-12 09:44 - 00000474 _____ C:\Users\****\Desktop\defogger_disable.log
2013-12-12 09:40 - 2013-12-12 09:40 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-12-10 11:17 - 2013-12-10 11:17 - 00002175 _____ C:\Users\****\.recently-used.xbel
2013-12-04 17:01 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2013-12-04 17:01 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2013-12-04 17:01 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2013-12-04 17:01 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2013-12-04 17:00 - 2013-12-04 17:00 - 00001361 _____ C:\WINDOWS\IE9_main.log
2013-12-04 17:00 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2013-12-04 17:00 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2013-12-04 17:00 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2013-12-04 17:00 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesysprep.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2013-12-04 17:00 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2013-12-04 17:00 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2013-12-04 17:00 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesysprep.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2013-12-04 17:00 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2013-12-04 17:00 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\RegisterIEPKEYs.exe
2013-12-04 17:00 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RegisterIEPKEYs.exe
2013-11-29 18:36 - 2013-11-29 18:36 - 00430093 _____ C:\Users\sismer\Desktop\Mark_Lawrence_Prince_of_Thorns__2011.epub
2013-11-27 15:42 - 2013-11-27 15:42 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2013-11-27 15:42 - 2013-11-27 15:42 - 01441280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2013-11-27 15:42 - 2013-11-27 15:42 - 01400416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dat
2013-11-27 15:42 - 2013-11-27 15:42 - 01400416 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dat
2013-11-27 15:42 - 2013-11-27 15:42 - 01054720 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00905728 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmlmedia.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00762368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00719360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmlmedia.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00523264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00441856 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2013-11-27 15:42 - 2013-11-27 15:42 - 00361984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2013-11-27 15:42 - 2013-11-27 15:42 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00242200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\url.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\url.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\elshyph.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00216064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msls31.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\elshyph.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iexpress.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00158720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msls31.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00150528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iexpress.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\occache.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wextract.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wextract.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00137216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00136192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00135680 _____ (Microsoft Corporation) C:\WINDOWS\system32\IEAdvpack.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\occache.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IEAdvpack.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SetIEInstalledDate.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00082432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inseng.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\icardie.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2013-11-27 15:42 - 2013-11-27 15:42 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SetIEInstalledDate.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\icardie.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2013-11-27 15:42 - 2013-11-27 15:42 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pngfilt.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\imgutil.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmler.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmler.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedsbs.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imgutil.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\licmgr10.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00023040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\licmgr10.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshta.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshta.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedssync.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedssync.exe
2013-11-27 15:39 - 2013-11-27 15:39 - 03928064 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 03419136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 02776576 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 02565120 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 02284544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01887232 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01682432 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01643520 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01504768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01424384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01247744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01238528 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01158144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01080832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00648192 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00604160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00522752 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10_1core.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10core.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00293376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10_1core.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecsExt.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10core.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecsExt.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00194560 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10_1.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10_1.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00010752 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00010752 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00009728 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00009728 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00005632 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00005632 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00005632 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00005632 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00004096 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00004096 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003584 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003584 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003072 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003072 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003072 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003072 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00002560 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00002560 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-21 14:27 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2013-11-21 14:27 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2013-11-21 14:23 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2013-11-20 21:50 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2013-11-20 21:50 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2013-11-20 21:50 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2013-11-20 21:50 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2013-11-20 21:50 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\secur32.dll
2013-11-20 21:50 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2013-11-20 21:50 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2013-11-20 21:50 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll
2013-11-20 21:50 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2013-11-20 21:50 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2013-11-20 21:50 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\secur32.dll
2013-11-20 21:50 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll
2013-11-20 21:50 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2013-11-20 21:50 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2013-11-20 21:37 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2013-11-20 21:37 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2013-11-20 21:36 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2013-11-20 21:36 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2013-11-20 21:36 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2013-11-20 21:36 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2013-11-20 21:36 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL

==================== One Month Modified Files and Folders =======

2013-12-12 09:50 - 2013-12-12 09:50 - 00020140 _____ C:\Users\*****\Desktop\FRST.txt
2013-12-12 09:49 - 2013-12-12 09:49 - 00000000 ____D C:\FRST
2013-12-12 09:48 - 2013-12-12 09:45 - 01927106 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2013-12-12 09:47 - 2012-12-11 14:29 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype
2013-12-12 09:45 - 2009-07-14 05:45 - 00019120 ____H C:\WINDOWS\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-12 09:45 - 2009-07-14 05:45 - 00019120 ____H C:\WINDOWS\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-12 09:44 - 2013-12-12 09:44 - 00000474 _____ C:\Users\*****\Desktop\defogger_disable.log
2013-12-12 09:44 - 2013-08-21 12:41 - 00000000 ____D C:\Users\*****.LOE10123LAP
2013-12-12 09:41 - 2012-09-13 11:50 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc
2013-12-12 09:40 - 2013-12-12 09:40 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe
2013-12-12 09:23 - 2013-08-26 09:21 - 00001110 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-12 09:23 - 2013-08-26 09:21 - 00001106 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-10 16:09 - 2010-11-21 07:21 - 00701698 _____ C:\WINDOWS\system32\perfh007.dat
2013-12-10 16:09 - 2010-11-21 07:21 - 00150542 _____ C:\WINDOWS\system32\perfc007.dat
2013-12-10 16:09 - 2009-07-14 06:13 - 01626052 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-12-10 11:17 - 2013-12-10 11:17 - 00002175 _____ C:\Users\*****\.recently-used.xbel
2013-12-10 11:17 - 2013-01-12 12:35 - 00000000 ____D C:\Users\*****\AppData\Roaming\gtk-2.0
2013-12-10 11:17 - 2013-01-12 12:30 - 00000000 ____D C:\Users\*****\.gimp-2.6
2013-12-10 11:17 - 2012-09-13 11:45 - 00000000 ____D C:\Users\*****
2013-12-09 19:51 - 2012-09-13 10:48 - 01227154 _____ C:\WINDOWS\WindowsUpdate.log
2013-12-09 13:08 - 2009-07-14 04:20 - 00000000 ____D C:\WINDOWS\rescache
2013-12-09 09:16 - 2013-10-01 07:32 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox
2013-12-09 09:15 - 2012-09-13 11:50 - 00001431 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-09 09:01 - 2012-09-10 11:38 - 00000392 _____ C:\WINDOWS\SMSCFG.INI
2013-12-09 09:00 - 2009-07-14 06:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-12-09 09:00 - 2009-07-14 05:51 - 00138948 _____ C:\WINDOWS\setupact.log
2013-12-08 20:05 - 2009-07-14 04:20 - 00000000 ____D C:\WINDOWS\SysWOW64\zh-HK
2013-12-08 20:05 - 2009-07-14 04:20 - 00000000 ____D C:\WINDOWS\SysWOW64\tr-TR
2013-12-08 20:05 - 2009-07-14 04:20 - 00000000 ____D C:\WINDOWS\system32\zh-HK
2013-12-08 20:05 - 2009-07-14 04:20 - 00000000 ____D C:\WINDOWS\system32\tr-TR
2013-12-08 20:05 - 2009-07-14 04:20 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2013-12-04 17:00 - 2013-12-04 17:00 - 00001361 _____ C:\WINDOWS\IE9_main.log
2013-11-29 18:36 - 2013-11-29 18:36 - 00430093 _____ C:\Users\sismer\Desktop\Mark_Lawrence_Prince_of_Thorns__2011.epub
2013-11-27 17:04 - 2012-09-10 11:39 - 01600332 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2013-11-27 15:42 - 2013-11-27 15:42 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2013-11-27 15:42 - 2013-11-27 15:42 - 01441280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2013-11-27 15:42 - 2013-11-27 15:42 - 01400416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dat
2013-11-27 15:42 - 2013-11-27 15:42 - 01400416 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dat
2013-11-27 15:42 - 2013-11-27 15:42 - 01054720 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00905728 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmlmedia.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00762368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00719360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmlmedia.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00523264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00452096 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00441856 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2013-11-27 15:42 - 2013-11-27 15:42 - 00361984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2013-11-27 15:42 - 2013-11-27 15:42 - 00357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00247296 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00242200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\url.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\url.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\elshyph.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00216064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msls31.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\elshyph.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iexpress.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00158720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msls31.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00150528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iexpress.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\occache.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wextract.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wextract.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00137216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00136192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00135680 _____ (Microsoft Corporation) C:\WINDOWS\system32\IEAdvpack.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\occache.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IEAdvpack.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\inseng.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SetIEInstalledDate.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00082432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inseng.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\system32\icardie.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2013-11-27 15:42 - 2013-11-27 15:42 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SetIEInstalledDate.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\icardie.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\pngfilt.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2013-11-27 15:42 - 2013-11-27 15:42 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pngfilt.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\imgutil.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmler.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmler.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedsbs.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imgutil.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\licmgr10.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00023040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\licmgr10.dll
2013-11-27 15:42 - 2013-11-27 15:42 - 00013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshta.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshta.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedssync.exe
2013-11-27 15:42 - 2013-11-27 15:42 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedssync.exe
2013-11-27 15:39 - 2013-11-27 15:39 - 03928064 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 03419136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 02776576 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 02565120 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 02284544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01887232 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01682432 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01643520 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01504768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01424384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01247744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01238528 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01175552 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01158144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 01080832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00648192 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00604160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00522752 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10_1core.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10core.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00293376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10_1core.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00245248 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecsExt.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10core.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecsExt.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00194560 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10_1.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10_1.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00010752 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00010752 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00009728 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00009728 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00005632 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00005632 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00005632 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00005632 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00004096 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00004096 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003584 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003584 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003072 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003072 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003072 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00003072 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00002560 ____H (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-27 15:39 - 2013-11-27 15:39 - 00002560 ____H (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-27 15:33 - 2012-09-27 12:12 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe
2013-11-27 15:33 - 2012-09-13 11:01 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2013-11-27 15:33 - 2012-09-13 11:01 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-27 15:31 - 2012-09-13 11:12 - 00047724 __RSH C:\ProgramData\ntuser.pol
2013-11-23 10:21 - 2010-11-21 04:47 - 00251404 _____ C:\WINDOWS\PFRO.log
2013-11-21 15:07 - 2012-09-10 11:49 - 00000000 ____D C:\ProgramData\Microsoft Help

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================


==================== Memory info ===========================

Percentage of memory in use: 25%
Total physical RAM: 8074.62 MB
Available physical RAM: 5987.18 MB
Total Pagefile: 16147.42 MB
Available Pagefile: 12983.05 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (SYSTEM) (Fixed) (Total:232.88 GB) (Free:174.78 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (lokale Daten ohne Backup) (Fixed) (Total:232.88 GB) (Free:116.74 GB) NTFS
Drive e: (DVD_VIDEO_RECORDER) (CDROM) (Total:1.75 GB) (Free:0 GB) UDF
Drive h: (Offline) (Network) (Total:232.88 GB) (Free:174.78 GB) CSC-CACHE
Drive y: (MyDrive) (Fixed) (Total:298.09 GB) (Free:63.46 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-12 10:26:20
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950042 rev.0005 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\*****~1.LOE\AppData\Local\Temp\ffroikog.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG C:\WINDOWS\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800037f5000 45 bytes [01, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\WINDOWS\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 591 fffff800037f502f 16 bytes [00, 01, 30, 5C, 11, A0, F8, ...]

---- User code sections - GMER 2.1 ----

.text C:\Windows\SysWOW64\CCM\CcmExec.exe[2204] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075731465 2 bytes [73, 75]
.text C:\Windows\SysWOW64\CCM\CcmExec.exe[2204] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757314bb 2 bytes [73, 75]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE[5280] C:\WINDOWS\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000754b8769 5 bytes JMP 0000000171437dbc
? C:\WINDOWS\system32\mssprxy.dll [5776] entry point in ".rdata" section 00000000696871e6
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE[5776] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075731465 2 bytes [73, 75]
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE[5776] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757314bb 2 bytes [73, 75]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE[5588] C:\WINDOWS\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000754b8769 5 bytes JMP 0000000171437dbc
.text C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE[5588] C:\WINDOWS\syswow64\ole32.dll!OleLoadFromStream 0000000076d96143 5 bytes JMP 000000017195c706
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[4820] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075731465 2 bytes [73, 75]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[4820] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757314bb 2 bytes [73, 75]
.text ... * 2
.text C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe[3872] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075731465 2 bytes [73, 75]
.text C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe[3872] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757314bb 2 bytes [73, 75]
.text ... * 2
.text C:\Program Files (x86)\Citrix\ICA Client\WFCRUN32.EXE[5380] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075731465 2 bytes [73, 75]
.text C:\Program Files (x86)\Citrix\ICA Client\WFCRUN32.EXE[5380] C:\WINDOWS\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757314bb 2 bytes [73, 75]
.text ... * 2

---- Threads - GMER 2.1 ----

Thread C:\WINDOWS\sysWOW64\wbem\wmiprvse.exe [3880:3916] 0000000070bc1070
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:6008] 000000007148204a
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:2432] 00000000728f786a
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:6072] 00000000746817a4
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:5016] 000000007148232a
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:3644] 00000000718fcaac
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:4396] 00000000733e46fa
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:1776] 0000000071c5cfb6
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:864] 00000000758e42ed
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:6628] 000000007148232a
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:2448] 000000007148232a
Thread C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE [5588:6500] 000000007148232a

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\74e543508e32 (not active ControlSet)
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74e543508e32
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74e543508e32@fc58faa10058 0xD2 0x9E 0x1D 0x67 ...
Reg HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\74e543508e32 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\74e543508e32@fc58faa10058 0xD2 0x9E 0x1D 0x67 ...

---- EOF - GMER 2.1 ----


Vielen Dank für eure Hilfe!