| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: OpenCandy und Search Protect von ConduitWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
02.02.2014, 21:01
| #1 |
 |  OpenCandy und Search Protect von Conduit Nachdem ich gestern meinen PC komplett neu aufgesetzt habe ist heute leider wieder was in Malwarebytes aufgetaucht: hxxp://i.imgur.com/2euKdNn.png (Screenshot auf imgur.com hochgeladen) Ich glaube nicht dass das was Schlimmes ist, möchte aber alles sicher haben. Search Protect (zu dem man einiges auf Google findet und was harmlos zu sein scheint) habe ich einfach deinstalliert (vor dem Malwarebytes Scan), jedoch weiß ich nicht was dieses "OpenCandy" ist. defrogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:22 on 02/02/2014 (wupto)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04 Ran by wupto (administrator) on WUPTO-PC on 02-02-2014 20:34:22 Running from C:\Users\wupto\Desktop Windows 7 Home Premium (X64) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files\Plantronics\GameCom780\GameCom780.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe (Dropbox, Inc.) C:\Users\wupto\AppData\Roaming\Dropbox\bin\Dropbox.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_43.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_43.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7743008 2009-04-27] (Realtek Semiconductor) HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-04-27] (Realtek Semiconductor Corp.) HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation) HKLM\...\Run: [GamecomSound] - C:\Program Files\Plantronics\GameCom780\GameCom780.exe [777448 2011-12-01] () HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1179576 2014-01-21] (NVIDIA Corporation) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-12-10] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [Adobe Creative Cloud] - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2239376 2013-12-19] (Adobe Systems Incorporated) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM-x32\...\Runonce: [SpUninstallCleanUp] - REG delete HKEY_LOCAL_MACHINE\Software\SearchProtect /f [x] HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) HKU\S-1-5-21-1998335624-851730918-2200616401-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20728480 2014-01-14] (Skype Technologies S.A.) Startup: C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\wupto\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP8E9C2945-6351-47A6-BAEA-89E85DC528E6&q={searchTerms}&SSPV= BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\wupto\AppData\Roaming\Mozilla\Firefox\Profiles\x46msonk.default FF SelectedSearchEngine: Google FF Homepage: hxxp://www.youtube.com/feed/subscriptions|https://mail.google.com/mail/u/0/?shva=1#inbox|https://twitter.com/|hxxp://www.deviantart.com/|hxxp://www.rockpapershotgun.com/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin: adobe.com/AdobeAAMDetect_x86_64 - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.3 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom) FF SearchPlugin: C:\Users\wupto\AppData\Roaming\Mozilla\Firefox\Profiles\x46msonk.default\searchplugins\conduit-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Magic Actions for YouTube™ - C:\Users\wupto\AppData\Roaming\Mozilla\Firefox\Profiles\x46msonk.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi [2014-02-02] FF Extension: Adblock Plus - C:\Users\wupto\AppData\Roaming\Mozilla\Firefox\Profiles\x46msonk.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-02] ==================== Services (Whitelisted) ================= R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation) S2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [621336 2013-12-04] (Wacom Technology, Corp.) ==================== Drivers (Whitelisted) ==================== R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation) R3 PlantronicsGC; C:\Windows\System32\drivers\PLTGC.sys [1327104 2011-11-05] (C-Media Electronics Inc) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-02 20:34 - 2014-02-02 20:34 - 00010402 _____ () C:\Users\wupto\Desktop\FRST.txt 2014-02-02 20:34 - 2014-02-02 20:34 - 00000000 ____D () C:\FRST 2014-02-02 20:24 - 2014-02-02 20:25 - 02080256 _____ (Farbar) C:\Users\wupto\Desktop\FRST64.exe 2014-02-02 20:22 - 2014-02-02 20:22 - 00050477 _____ () C:\Users\wupto\Desktop\Defogger.exe 2014-02-02 20:22 - 2014-02-02 20:22 - 00000472 _____ () C:\Users\wupto\Desktop\defogger_disable.log 2014-02-02 20:22 - 2014-02-02 20:22 - 00000000 _____ () C:\Users\wupto\defogger_reenable 2014-02-02 19:48 - 2014-02-02 19:48 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Malwarebytes 2014-02-02 19:47 - 2014-02-02 19:47 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-02 19:47 - 2014-02-02 19:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-02 19:47 - 2014-02-02 19:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-02 19:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-02-02 19:46 - 2014-02-02 19:48 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\uTorrent 2014-02-02 19:45 - 2014-02-02 19:46 - 01307736 _____ (BitTorrent Inc.) C:\Users\wupto\Downloads\utorrent.exe 2014-02-02 19:43 - 2014-02-02 19:47 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\wupto\Downloads\mbam-setup-1.75.0.1300.exe 2014-02-02 19:42 - 2014-02-02 19:42 - 00000000 ____D () C:\Users\Public\Documents\ZBrushData 2014-02-02 19:35 - 2014-02-02 19:35 - 00001704 _____ () C:\Users\wupto\Desktop\Photoshop.lnk 2014-02-02 18:47 - 2014-02-02 19:12 - 00000000 ____D () C:\Program Files\Adobe 2014-02-02 18:43 - 2014-02-02 19:11 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-02-02 17:45 - 2014-02-02 17:45 - 00000000 ____D () C:\Users\wupto\Documents\game of thrones 2014-02-02 17:16 - 2014-02-02 17:16 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\.minecraft 2014-02-02 17:13 - 2014-02-02 17:13 - 00001070 _____ () C:\Users\Public\Desktop\Adobe Creative Cloud.lnk 2014-02-02 17:11 - 2014-02-02 19:13 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-02-02 17:08 - 2014-02-02 17:08 - 00000000 ____D () C:\Users\wupto\AppData\Local\divinity 2 2014-02-02 17:02 - 2014-02-02 17:01 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-02-02 17:02 - 2014-02-02 17:01 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-02-02 17:02 - 2014-02-02 17:01 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-02-02 17:02 - 2014-02-02 17:01 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-02-02 17:01 - 2014-02-02 17:01 - 00000000 ____D () C:\Program Files\Java 2014-02-02 16:56 - 2014-02-02 19:49 - 00000000 ____D () C:\Users\wupto\Desktop\Minecraft 2014-02-02 16:54 - 2014-02-02 16:54 - 02844536 _____ (Adobe Systems Incorporated) C:\Users\wupto\Downloads\CreativeCloudSet-Up.exe 2014-02-02 16:53 - 2014-02-02 16:53 - 00001001 _____ () C:\Users\wupto\Desktop\Dropbox.lnk 2014-02-02 16:52 - 2014-02-02 16:53 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\DropboxMaster 2014-02-02 16:52 - 2014-02-02 16:52 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-02-02 16:48 - 2014-02-02 20:13 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Dropbox 2014-02-02 16:47 - 2014-02-02 17:06 - 00000000 ____D () C:\Users\wupto\Downloads\old 2014-02-02 16:47 - 2014-02-02 16:58 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\ftblauncher 2014-02-02 16:42 - 2014-02-02 16:42 - 00000000 ____D () C:\Users\wupto\Documents\nbgi 2014-02-02 16:40 - 2014-02-02 16:40 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Subversion 2014-02-02 16:38 - 2014-02-02 16:39 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\GameMaker-Studio 2014-02-02 16:38 - 2014-02-02 16:38 - 00000000 ____D () C:\Users\wupto\Documents\3D-CoatV3 2014-02-02 16:37 - 2014-02-02 16:37 - 00000000 ____D () C:\Users\wupto\AppData\Local\YoYo_Games_Ltd 2014-02-02 16:35 - 2014-02-02 16:43 - 00000000 ____D () C:\Users\wupto\Documents\3D-CoatV4 2014-02-02 16:35 - 2014-02-02 16:41 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameMaker-Studio 1.2 2014-02-02 16:35 - 2014-02-02 16:35 - 00001850 _____ () C:\Users\wupto\Desktop\Game Maker.lnk 2014-02-02 16:34 - 2014-02-02 16:41 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\3d-Coat-V4 2014-02-02 16:34 - 2014-02-02 16:41 - 00000000 ____D () C:\Users\wupto\AppData\Local\GameMaker-Studio 2014-02-02 16:34 - 2014-02-02 16:35 - 00000000 ____D () C:\Users\wupto\GameMaker-Studio 1.2 2014-02-02 16:34 - 2014-02-02 16:35 - 00000000 ____D () C:\Program Files\3D-Coat-V4 2014-02-02 16:34 - 2014-02-02 16:34 - 00000665 _____ () C:\Users\wupto\Desktop\3D Coat.lnk 2014-02-02 15:55 - 2014-02-02 15:55 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wacomrouterfilter_01009.Wdf 2014-02-02 15:55 - 2014-02-02 15:55 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wachidrouter_01009.Wdf 2014-02-02 15:55 - 2014-02-02 15:55 - 00000000 ____D () C:\Program Files\TabletPlugins 2014-02-02 15:55 - 2014-02-02 15:55 - 00000000 ____D () C:\Program Files (x86)\TabletPlugins 2014-02-02 15:55 - 2013-11-12 01:16 - 00015160 _____ (Wacom Technology) C:\Windows\system32\Drivers\wacomrouterfilter.sys 2014-02-02 15:54 - 2014-02-02 15:55 - 00000000 ____D () C:\Program Files\Tablet 2014-02-02 15:54 - 2013-12-04 17:35 - 01945880 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.dll 2014-02-02 15:54 - 2013-12-04 17:35 - 01938712 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Touch_Tablet.dll 2014-02-02 15:54 - 2013-12-04 17:35 - 01808152 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wintab32.dll 2014-02-02 15:54 - 2013-12-04 17:35 - 01805080 _____ (Wacom Technology, Corp.) C:\Windows\system32\WacomMT.dll 2014-02-02 15:54 - 2013-12-04 17:35 - 01604376 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Tablet.dll 2014-02-02 15:54 - 2013-12-04 17:35 - 01596696 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Touch_Tablet.dll 2014-02-02 15:54 - 2013-12-04 17:35 - 01483032 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wintab32.dll 2014-02-02 15:54 - 2013-12-04 17:35 - 01479960 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\WacomMT.dll 2014-02-02 15:54 - 2013-11-12 01:16 - 00090424 _____ (Wacom Technology) C:\Windows\system32\Drivers\wachidrouter.sys 2014-02-02 15:54 - 2013-11-12 01:16 - 00014136 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\hidkmdf.sys 2014-02-02 15:54 - 2012-12-11 23:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\wdfcoinstaller01009.dll 2014-02-02 15:54 - 2012-12-11 23:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wdfcoinstaller01009.dll 2014-02-02 15:13 - 2014-02-02 15:13 - 00000000 ____D () C:\Users\wupto\Tor Browser 2014-02-02 14:35 - 2014-02-02 18:48 - 00000000 ____D () C:\ProgramData\Adobe 2014-02-02 14:08 - 2014-02-02 19:48 - 00000000 ___RD () C:\Users\wupto\Desktop\Games 2014-02-02 13:22 - 2014-02-02 20:20 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-02-02 13:22 - 2014-02-02 19:17 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\NVIDIA 2014-02-02 13:22 - 2014-02-02 13:22 - 00000963 _____ () C:\Users\wupto\Desktop\Steam.lnk 2014-02-02 13:15 - 2014-02-02 13:23 - 00000001 _____ () C:\Users\wupto\random.dat 2014-02-02 13:15 - 2014-02-02 13:15 - 00000044 _____ () C:\Users\wupto\jagex_cl_runescape_LIVE.dat 2014-02-02 13:15 - 2014-02-02 13:15 - 00000000 ____D () C:\Users\wupto\jagexcache 2014-02-02 13:10 - 2014-02-02 13:51 - 00000000 ____D () C:\Users\wupto\Desktop\Programme 2014-02-02 12:58 - 2014-02-02 19:17 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Adobe 2014-02-02 12:58 - 2014-02-02 12:58 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Macromedia 2014-02-02 12:58 - 2014-02-02 12:58 - 00000000 ____D () C:\Users\wupto\AppData\Local\Macromedia 2014-02-02 12:57 - 2014-02-02 20:11 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-02 12:57 - 2014-02-02 12:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-02-02 12:57 - 2014-02-02 12:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-02-02 12:57 - 2014-02-02 12:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-02-02 12:57 - 2014-02-02 12:57 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2014-02-02 12:57 - 2014-02-02 12:57 - 00000000 ____D () C:\Windows\system32\Macromed 2014-02-02 12:56 - 2014-02-02 19:17 - 00000000 ____D () C:\Users\wupto\AppData\Local\Adobe 2014-02-02 12:38 - 2014-02-02 12:38 - 00000000 ____D () C:\ProgramData\Sun 2014-02-02 12:38 - 2014-02-02 12:38 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-02 12:37 - 2014-02-02 12:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-02-02 12:37 - 2014-02-02 12:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-02-02 12:37 - 2014-02-02 12:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-02-02 12:37 - 2014-02-02 12:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-02-02 12:37 - 2014-02-02 12:37 - 00000000 ____D () C:\Program Files (x86)\Java 2014-02-02 04:45 - 2014-02-02 04:50 - 00000000 ____D () C:\Users\wupto\Desktop\Programme (x86) 2014-02-02 04:25 - 2014-02-02 04:26 - 00000000 ____D () C:\Users\wupto\Virenbekämpfung 2014-02-02 04:25 - 2014-02-02 04:25 - 00000000 ____D () C:\Users\wupto\shelper 2014-02-02 04:25 - 2014-02-02 04:25 - 00000000 ____D () C:\Users\wupto\Schule 2014-02-02 04:23 - 2014-02-02 04:24 - 00000000 ____D () C:\Users\wupto\Musik 2014-02-02 04:11 - 2014-02-02 04:14 - 00000000 ____D () C:\Users\wupto\Filme 2014-02-02 04:03 - 2014-02-02 16:54 - 00000000 ___RD () C:\Users\wupto\Dropbox 2014-02-02 03:58 - 2014-02-02 03:58 - 00000000 ____D () C:\Users\wupto\Dokumente 2014-02-02 03:37 - 2014-02-02 03:58 - 00000000 ____D () C:\Users\wupto\Bilder 2014-02-02 03:36 - 2014-02-02 15:18 - 00000000 ____D () C:\Users\wupto\Desktop\TO DO 2014-02-02 03:36 - 2014-02-02 03:36 - 00000000 ____D () C:\Users\wupto\Desktop\website 2014-02-02 03:36 - 2014-02-02 03:36 - 00000000 ____D () C:\Users\wupto\Desktop\PA 2014-02-02 03:36 - 2014-02-02 03:36 - 00000000 ____D () C:\Users\wupto\adobeshit 2014-02-02 03:36 - 2013-09-28 15:53 - 00000037 _____ () C:\Users\wupto\cgpeers com.txt 2014-02-02 03:34 - 2014-02-02 03:36 - 00000000 ____D () C:\Users\wupto\Desktop\Modelling 2014-02-02 03:34 - 2014-02-02 03:34 - 00000000 ____D () C:\Users\wupto\Desktop\Hammerwatch Art 2014-02-02 03:23 - 2014-02-02 03:34 - 00000000 ____D () C:\Users\wupto\Desktop\Games & so 2014-02-02 03:18 - 2014-02-02 03:23 - 00000000 ____D () C:\Users\wupto\Desktop\Game Maker Games 2014-02-02 03:17 - 2014-02-02 19:49 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Skype 2014-02-02 03:17 - 2014-02-02 03:17 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-02-02 03:17 - 2014-02-02 03:17 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-02-02 03:17 - 2014-02-02 03:17 - 00000000 ____D () C:\Users\wupto\AppData\Local\Skype 2014-02-02 03:17 - 2014-02-02 03:17 - 00000000 ____D () C:\ProgramData\Skype 2014-02-02 03:14 - 2014-02-02 19:21 - 00000000 ____D () C:\Users\wupto\Desktop\ART 2014-02-02 03:14 - 2014-02-02 03:18 - 00000000 ____D () C:\Users\wupto\Desktop\Design Projects 2014-02-02 03:13 - 2014-02-02 15:17 - 00000000 ____D () C:\Users\wupto\Desktop\random 2014-02-02 03:13 - 2014-02-01 17:10 - 00000724 _____ () C:\Users\wupto\Desktop\films u should watch.txt 2014-02-02 03:10 - 2014-02-02 19:17 - 00057560 _____ () C:\Users\wupto\AppData\Local\GDIPFONTCACHEV1.DAT 2014-02-02 03:09 - 2014-02-02 03:09 - 00002154 _____ () C:\Windows\epplauncher.mif 2014-02-02 03:08 - 2014-02-02 03:08 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-02-02 03:08 - 2014-02-02 03:08 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client 2014-02-02 03:08 - 2010-04-09 12:06 - 01898376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-02-02 03:08 - 2010-04-09 12:06 - 00374664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-02-02 02:52 - 2014-02-02 02:52 - 00000000 ____D () C:\Users\wupto\AppData\Local\NVIDIA Corporation 2014-02-02 02:52 - 2014-01-21 03:53 - 01179576 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-02-02 02:52 - 2014-01-21 03:53 - 01048152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-02-02 02:52 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll 2014-02-02 02:52 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll 2014-02-02 02:52 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll 2014-02-02 02:52 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll 2014-02-02 02:52 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2014-02-02 02:52 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2014-02-02 02:51 - 2013-12-27 19:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2014-02-02 02:51 - 2013-12-27 19:42 - 00033056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2014-02-02 02:50 - 2014-02-02 02:50 - 00000534 _____ () C:\Windows\PLTGC.ini.imi 2014-02-02 02:50 - 2014-02-02 02:50 - 00000402 _____ () C:\Windows\PLTGC.ini.cfl 2014-02-02 02:50 - 2014-02-02 02:50 - 00000132 _____ () C:\Windows\system\Dlap.pfx 2014-02-02 02:50 - 2014-02-02 02:50 - 00000000 ____D () C:\Program Files\Plantronics 2014-02-02 02:50 - 2011-12-01 21:18 - 00813288 ____N () C:\Windows\system32\PLTGC.exe 2014-02-02 02:50 - 2011-11-23 19:08 - 00003489 ____N () C:\Windows\PLTGC.ini.cfg 2014-02-02 02:50 - 2011-11-05 01:47 - 01327104 _____ (C-Media Electronics Inc) C:\Windows\system32\Drivers\PLTGC.sys 2014-02-02 02:50 - 2011-01-27 16:02 - 00003072 ____N () C:\Windows\Thumbs.db 2014-02-02 02:50 - 2009-08-20 10:00 - 00359424 ____N () C:\Windows\system32\CmiInstallResAll64.dll 2014-02-02 02:50 - 2004-04-14 20:28 - 00315392 _____ (C-Media Electronics Inc.) C:\Windows\system\fltrPLTGC.dll 2014-02-02 02:49 - 2006-10-06 23:45 - 00524768 ____R (Microsoft Corporation) C:\Windows\difxapi.dll 2014-02-02 02:45 - 2014-02-02 02:49 - 00000000 ____D () C:\Users\wupto\AppData\Local\NVIDIA 2014-02-02 02:45 - 2014-02-02 02:45 - 00001347 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk 2014-02-02 02:45 - 2014-02-02 02:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2014-02-02 02:44 - 2014-02-02 03:10 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-02 02:43 - 2014-02-02 02:52 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2014-02-02 02:43 - 2014-02-02 02:52 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-02-02 02:43 - 2014-01-19 08:33 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-02-02 02:43 - 2013-12-19 21:33 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2014-02-02 02:43 - 2013-12-19 21:33 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2014-02-02 02:43 - 2013-12-19 19:53 - 06671648 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2014-02-02 02:43 - 2013-12-19 19:53 - 03490080 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2014-02-02 02:43 - 2013-12-19 19:53 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2014-02-02 02:43 - 2013-12-19 19:53 - 00922912 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2014-02-02 02:43 - 2013-12-19 19:53 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2014-02-02 02:43 - 2013-12-19 19:53 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2014-02-02 02:43 - 2013-12-19 06:01 - 03539040 _____ () C:\Windows\system32\nvcoproc.bin 2014-02-02 02:42 - 2014-02-02 02:43 - 01588294 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-02 02:39 - 2009-11-25 20:47 - 01942856 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-02-02 02:39 - 2009-11-25 20:47 - 01130824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll 2014-02-02 02:39 - 2009-11-25 20:47 - 00444752 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll 2014-02-02 02:39 - 2009-11-25 20:47 - 00320352 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe 2014-02-02 02:39 - 2009-11-25 20:47 - 00297808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscoree.dll 2014-02-02 02:39 - 2009-11-25 20:47 - 00295264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHost.exe 2014-02-02 02:39 - 2009-11-25 20:47 - 00109912 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll 2014-02-02 02:39 - 2009-11-25 20:47 - 00099176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHostProxy.dll 2014-02-02 02:39 - 2009-11-25 20:47 - 00049472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netfxperf.dll 2014-02-02 02:39 - 2009-11-25 20:47 - 00048960 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll 2014-02-02 02:38 - 2014-02-02 02:52 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-02-02 02:38 - 2013-12-27 19:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 30372640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 22960416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 18310112 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 18222008 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 15877216 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 15230352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 12645664 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-02-02 02:38 - 2013-12-19 21:33 - 11605752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 11554264 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 09700224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 09657464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 03071656 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 02698272 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433221.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433221.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 01436528 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 01242400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00882464 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00879392 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00852768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00847648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00479520 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00405280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00357152 _____ () C:\Windows\system32\NvIFROpenGL.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00314656 _____ () C:\Windows\SysWOW64\NvIFROpenGL.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00168616 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00141336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2014-02-02 02:38 - 2013-12-19 21:33 - 00023754 _____ () C:\Windows\system32\nvinfo.pb 2014-02-02 02:38 - 2013-11-28 14:38 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2014-02-02 02:38 - 2013-11-28 14:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2014-02-02 02:38 - 2013-11-22 09:36 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll 2014-02-02 02:37 - 2014-02-02 02:37 - 00000000 ____D () C:\NVIDIA 2014-02-02 02:33 - 2012-02-15 07:27 - 01031680 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll 2014-02-02 02:33 - 2012-02-15 06:44 - 00826368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll 2014-02-02 02:33 - 2012-02-15 05:47 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys 2014-02-02 02:33 - 2012-02-15 05:46 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys 2014-02-02 02:33 - 2010-01-09 08:19 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\cabview.dll 2014-02-02 02:33 - 2010-01-09 07:52 - 00132608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabview.dll 2014-02-02 02:29 - 2014-02-02 02:29 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Mozilla 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\Users\wupto\AppData\Local\Mozilla 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\ProgramData\Mozilla 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-02-02 02:29 - 2012-06-02 23:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-02-02 02:29 - 2012-06-02 23:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-02-02 02:29 - 2012-06-02 23:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-02-02 02:29 - 2012-06-02 23:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-02-02 02:28 - 2012-06-02 23:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-02-02 02:28 - 2012-06-02 23:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-02-02 02:28 - 2012-06-02 23:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-02-02 02:28 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-02-02 02:28 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-02-02 02:23 - 2014-02-02 02:23 - 00000000 ____D () C:\Program Files\Intel 2014-02-02 02:23 - 2009-06-22 12:05 - 00273072 _____ (Intel Corporation) C:\Windows\system32\Drivers\e1k62x64.sys 2014-02-02 02:23 - 2009-06-03 18:38 - 00078016 _____ (Intel Corporation) C:\Windows\system32\NicInstK.dll 2014-02-02 02:23 - 2009-05-26 11:05 - 00036472 _____ (Intel Corporation) C:\Windows\system32\NicCo36.dll 2014-02-02 02:23 - 2009-04-21 18:39 - 00072288 _____ (Intel Corporation) C:\Windows\system32\e1kmsg.dll 2014-02-02 02:23 - 2009-03-31 14:58 - 00342656 ____R (Intel Corporation) C:\Windows\system32\PROUnstl.exe 2014-02-02 02:23 - 2009-03-07 03:08 - 00003127 _____ () C:\Windows\system32\e1k62x64.din 2014-02-02 02:23 - 2006-01-12 15:52 - 00001904 ____N () C:\Windows\system32\SetupBD.din 2014-02-02 02:21 - 2014-02-02 02:21 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM 2014-02-02 02:21 - 2014-02-02 02:21 - 00000000 ____D () C:\Program Files\Realtek 2014-02-02 02:21 - 2008-04-30 09:48 - 00193536 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll 2014-02-02 02:21 - 2007-07-25 10:34 - 00150528 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll 2014-02-02 02:21 - 2007-05-17 12:26 - 00211376 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll 2014-02-02 02:21 - 2006-12-13 11:30 - 00513536 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll 2014-02-02 02:20 - 2014-02-02 02:50 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-02-02 02:20 - 2014-02-02 02:21 - 00002014 _____ () C:\RHDSetup.log 2014-02-02 02:20 - 2014-02-02 02:21 - 00000206 _____ () C:\realtek.log 2014-02-02 02:20 - 2014-02-02 02:20 - 00000000 ____D () C:\Program Files (x86)\Realtek 2014-02-02 02:20 - 2009-04-27 20:50 - 01272352 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll 2014-02-02 02:20 - 2009-04-27 20:50 - 00611360 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl 2014-02-02 02:20 - 2009-04-27 20:50 - 00332320 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll 2014-02-02 02:20 - 2009-04-27 20:49 - 01552416 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll 2014-02-02 02:20 - 2009-04-27 20:49 - 01163296 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll 2014-02-02 02:20 - 2009-04-27 20:49 - 00417824 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll 2014-02-02 02:20 - 2009-04-27 20:49 - 00149536 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll 2014-02-02 02:20 - 2009-04-27 20:49 - 00066080 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInst64.dll 2014-02-02 02:20 - 2009-04-27 20:22 - 01766048 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys 2014-02-02 02:20 - 2009-04-16 18:23 - 00540672 ____R (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll 2014-02-02 02:20 - 2009-04-16 11:13 - 00166400 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll 2014-02-02 02:20 - 2009-03-31 15:02 - 00108032 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll 2014-02-02 02:20 - 2009-03-09 06:32 - 00304640 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll 2014-02-02 02:20 - 2009-03-09 06:30 - 00304640 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll 2014-02-02 02:20 - 2009-02-12 18:14 - 00176640 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\FMAPO64.dll 2014-02-02 02:20 - 2008-11-09 12:57 - 00311296 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll 2014-02-02 02:16 - 2014-02-02 02:16 - 00000000 ____D () C:\Program Files (x86)\Intel 2014-02-02 02:16 - 2014-02-02 02:16 - 00000000 ____D () C:\Intel 2014-02-02 02:16 - 2009-07-08 16:34 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll 2014-02-02 02:15 - 2014-02-02 02:27 - 00000000 ____D () C:\TempEI4 2014-02-02 02:15 - 2014-02-02 02:15 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0 2014-02-02 02:12 - 2014-02-02 16:53 - 00000000 ___RD () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-02 02:12 - 2014-02-02 02:12 - 00001439 _____ () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-02-02 02:12 - 2014-02-02 02:12 - 00001405 _____ () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-02-02 02:12 - 2014-02-02 02:12 - 00000000 ___RD () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-02-02 02:12 - 2014-02-02 02:12 - 00000000 ____D () C:\Users\wupto\AppData\Local\VirtualStore 2014-02-02 02:11 - 2014-02-02 20:26 - 01300601 _____ () C:\Windows\WindowsUpdate.log 2014-02-02 02:11 - 2014-02-02 20:22 - 00000000 ____D () C:\Users\wupto 2014-02-02 02:11 - 2014-02-02 02:11 - 00000020 ___SH () C:\Users\wupto\ntuser.ini 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Vorlagen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Startmenü 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Netzwerkumgebung 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Lokale Einstellungen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Eigene Dateien 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Druckumgebung 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Documents\Eigene Musik 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Documents\Eigene Bilder 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\AppData\Local\Verlauf 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\AppData\Local\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Vorlagen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Startmenü 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Druckumgebung 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Programme 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Vorlagen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Startmenü 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Favoriten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Dokumente 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Dokumente und Einstellungen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 __SHD () C:\Recovery 2014-02-02 02:11 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-02-02 02:11 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-02-02 02:07 - 2014-02-02 02:07 - 00001313 _____ () C:\Windows\TSSysprep.log 2014-02-02 02:03 - 2014-02-02 02:11 - 00000000 ____D () C:\Windows\Panther ==================== One Month Modified Files and Folders ======= 2014-02-02 20:34 - 2014-02-02 20:34 - 00010402 _____ () C:\Users\wupto\Desktop\FRST.txt 2014-02-02 20:34 - 2014-02-02 20:34 - 00000000 ____D () C:\FRST 2014-02-02 20:26 - 2014-02-02 02:11 - 01300601 _____ () C:\Windows\WindowsUpdate.log 2014-02-02 20:25 - 2014-02-02 20:24 - 02080256 _____ (Farbar) C:\Users\wupto\Desktop\FRST64.exe 2014-02-02 20:22 - 2014-02-02 20:22 - 00050477 _____ () C:\Users\wupto\Desktop\Defogger.exe 2014-02-02 20:22 - 2014-02-02 20:22 - 00000472 _____ () C:\Users\wupto\Desktop\defogger_disable.log 2014-02-02 20:22 - 2014-02-02 20:22 - 00000000 _____ () C:\Users\wupto\defogger_reenable 2014-02-02 20:22 - 2014-02-02 02:11 - 00000000 ____D () C:\Users\wupto 2014-02-02 20:20 - 2014-02-02 13:22 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-02-02 20:13 - 2014-02-02 16:48 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Dropbox 2014-02-02 20:11 - 2014-02-02 12:57 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-02 19:49 - 2014-02-02 16:56 - 00000000 ____D () C:\Users\wupto\Desktop\Minecraft 2014-02-02 19:49 - 2014-02-02 03:17 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Skype 2014-02-02 19:48 - 2014-02-02 19:48 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Malwarebytes 2014-02-02 19:48 - 2014-02-02 19:46 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\uTorrent 2014-02-02 19:48 - 2014-02-02 14:08 - 00000000 ___RD () C:\Users\wupto\Desktop\Games 2014-02-02 19:47 - 2014-02-02 19:47 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-02 19:47 - 2014-02-02 19:47 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-02 19:47 - 2014-02-02 19:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-02 19:47 - 2014-02-02 19:43 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\wupto\Downloads\mbam-setup-1.75.0.1300.exe 2014-02-02 19:46 - 2014-02-02 19:45 - 01307736 _____ (BitTorrent Inc.) C:\Users\wupto\Downloads\utorrent.exe 2014-02-02 19:42 - 2014-02-02 19:42 - 00000000 ____D () C:\Users\Public\Documents\ZBrushData 2014-02-02 19:35 - 2014-02-02 19:35 - 00001704 _____ () C:\Users\wupto\Desktop\Photoshop.lnk 2014-02-02 19:21 - 2014-02-02 03:14 - 00000000 ____D () C:\Users\wupto\Desktop\ART 2014-02-02 19:17 - 2014-02-02 13:22 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\NVIDIA 2014-02-02 19:17 - 2014-02-02 12:58 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Adobe 2014-02-02 19:17 - 2014-02-02 12:56 - 00000000 ____D () C:\Users\wupto\AppData\Local\Adobe 2014-02-02 19:17 - 2014-02-02 03:10 - 00057560 _____ () C:\Users\wupto\AppData\Local\GDIPFONTCACHEV1.DAT 2014-02-02 19:13 - 2014-02-02 17:11 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-02-02 19:13 - 2009-07-14 05:45 - 00013584 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-02 19:13 - 2009-07-14 05:45 - 00013584 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-02 19:12 - 2014-02-02 18:47 - 00000000 ____D () C:\Program Files\Adobe 2014-02-02 19:11 - 2014-02-02 18:43 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-02-02 18:48 - 2014-02-02 14:35 - 00000000 ____D () C:\ProgramData\Adobe 2014-02-02 17:45 - 2014-02-02 17:45 - 00000000 ____D () C:\Users\wupto\Documents\game of thrones 2014-02-02 17:16 - 2014-02-02 17:16 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\.minecraft 2014-02-02 17:14 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-02-02 17:13 - 2014-02-02 17:13 - 00001070 _____ () C:\Users\Public\Desktop\Adobe Creative Cloud.lnk 2014-02-02 17:08 - 2014-02-02 17:08 - 00000000 ____D () C:\Users\wupto\AppData\Local\divinity 2 2014-02-02 17:06 - 2014-02-02 16:47 - 00000000 ____D () C:\Users\wupto\Downloads\old 2014-02-02 17:01 - 2014-02-02 17:02 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-02-02 17:01 - 2014-02-02 17:02 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-02-02 17:01 - 2014-02-02 17:02 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-02-02 17:01 - 2014-02-02 17:02 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-02-02 17:01 - 2014-02-02 17:01 - 00000000 ____D () C:\Program Files\Java 2014-02-02 16:58 - 2014-02-02 16:47 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\ftblauncher 2014-02-02 16:54 - 2014-02-02 16:54 - 02844536 _____ (Adobe Systems Incorporated) C:\Users\wupto\Downloads\CreativeCloudSet-Up.exe 2014-02-02 16:54 - 2014-02-02 04:03 - 00000000 ___RD () C:\Users\wupto\Dropbox 2014-02-02 16:53 - 2014-02-02 16:53 - 00001001 _____ () C:\Users\wupto\Desktop\Dropbox.lnk 2014-02-02 16:53 - 2014-02-02 16:52 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\DropboxMaster 2014-02-02 16:53 - 2014-02-02 02:12 - 00000000 ___RD () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-02 16:52 - 2014-02-02 16:52 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-02-02 16:43 - 2014-02-02 16:35 - 00000000 ____D () C:\Users\wupto\Documents\3D-CoatV4 2014-02-02 16:42 - 2014-02-02 16:42 - 00000000 ____D () C:\Users\wupto\Documents\nbgi 2014-02-02 16:41 - 2014-02-02 16:35 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameMaker-Studio 1.2 2014-02-02 16:41 - 2014-02-02 16:34 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\3d-Coat-V4 2014-02-02 16:41 - 2014-02-02 16:34 - 00000000 ____D () C:\Users\wupto\AppData\Local\GameMaker-Studio 2014-02-02 16:40 - 2014-02-02 16:40 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Subversion 2014-02-02 16:39 - 2014-02-02 16:38 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\GameMaker-Studio 2014-02-02 16:38 - 2014-02-02 16:38 - 00000000 ____D () C:\Users\wupto\Documents\3D-CoatV3 2014-02-02 16:37 - 2014-02-02 16:37 - 00000000 ____D () C:\Users\wupto\AppData\Local\YoYo_Games_Ltd 2014-02-02 16:35 - 2014-02-02 16:35 - 00001850 _____ () C:\Users\wupto\Desktop\Game Maker.lnk 2014-02-02 16:35 - 2014-02-02 16:34 - 00000000 ____D () C:\Users\wupto\GameMaker-Studio 1.2 2014-02-02 16:35 - 2014-02-02 16:34 - 00000000 ____D () C:\Program Files\3D-Coat-V4 2014-02-02 16:34 - 2014-02-02 16:34 - 00000665 _____ () C:\Users\wupto\Desktop\3D Coat.lnk 2014-02-02 15:55 - 2014-02-02 15:55 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wacomrouterfilter_01009.Wdf 2014-02-02 15:55 - 2014-02-02 15:55 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wachidrouter_01009.Wdf 2014-02-02 15:55 - 2014-02-02 15:55 - 00000000 ____D () C:\Program Files\TabletPlugins 2014-02-02 15:55 - 2014-02-02 15:55 - 00000000 ____D () C:\Program Files (x86)\TabletPlugins 2014-02-02 15:55 - 2014-02-02 15:54 - 00000000 ____D () C:\Program Files\Tablet 2014-02-02 15:55 - 2009-07-14 05:51 - 00019026 _____ () C:\Windows\setupact.log 2014-02-02 15:18 - 2014-02-02 03:36 - 00000000 ____D () C:\Users\wupto\Desktop\TO DO 2014-02-02 15:17 - 2014-02-02 03:13 - 00000000 ____D () C:\Users\wupto\Desktop\random 2014-02-02 15:13 - 2014-02-02 15:13 - 00000000 ____D () C:\Users\wupto\Tor Browser 2014-02-02 13:51 - 2014-02-02 13:10 - 00000000 ____D () C:\Users\wupto\Desktop\Programme 2014-02-02 13:23 - 2014-02-02 13:15 - 00000001 _____ () C:\Users\wupto\random.dat 2014-02-02 13:22 - 2014-02-02 13:22 - 00000963 _____ () C:\Users\wupto\Desktop\Steam.lnk 2014-02-02 13:15 - 2014-02-02 13:15 - 00000044 _____ () C:\Users\wupto\jagex_cl_runescape_LIVE.dat 2014-02-02 13:15 - 2014-02-02 13:15 - 00000000 ____D () C:\Users\wupto\jagexcache 2014-02-02 12:58 - 2014-02-02 12:58 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Macromedia 2014-02-02 12:58 - 2014-02-02 12:58 - 00000000 ____D () C:\Users\wupto\AppData\Local\Macromedia 2014-02-02 12:57 - 2014-02-02 12:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-02-02 12:57 - 2014-02-02 12:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-02-02 12:57 - 2014-02-02 12:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-02-02 12:57 - 2014-02-02 12:57 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2014-02-02 12:57 - 2014-02-02 12:57 - 00000000 ____D () C:\Windows\system32\Macromed 2014-02-02 12:38 - 2014-02-02 12:38 - 00000000 ____D () C:\ProgramData\Sun 2014-02-02 12:38 - 2014-02-02 12:38 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-02 12:37 - 2014-02-02 12:37 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-02-02 12:37 - 2014-02-02 12:37 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-02-02 12:37 - 2014-02-02 12:37 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-02-02 12:37 - 2014-02-02 12:37 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-02-02 12:37 - 2014-02-02 12:37 - 00000000 ____D () C:\Program Files (x86)\Java 2014-02-02 04:50 - 2014-02-02 04:45 - 00000000 ____D () C:\Users\wupto\Desktop\Programme (x86) 2014-02-02 04:26 - 2014-02-02 04:25 - 00000000 ____D () C:\Users\wupto\Virenbekämpfung 2014-02-02 04:25 - 2014-02-02 04:25 - 00000000 ____D () C:\Users\wupto\shelper 2014-02-02 04:25 - 2014-02-02 04:25 - 00000000 ____D () C:\Users\wupto\Schule 2014-02-02 04:24 - 2014-02-02 04:23 - 00000000 ____D () C:\Users\wupto\Musik 2014-02-02 04:14 - 2014-02-02 04:11 - 00000000 ____D () C:\Users\wupto\Filme 2014-02-02 03:58 - 2014-02-02 03:58 - 00000000 ____D () C:\Users\wupto\Dokumente 2014-02-02 03:58 - 2014-02-02 03:37 - 00000000 ____D () C:\Users\wupto\Bilder 2014-02-02 03:36 - 2014-02-02 03:36 - 00000000 ____D () C:\Users\wupto\Desktop\website 2014-02-02 03:36 - 2014-02-02 03:36 - 00000000 ____D () C:\Users\wupto\Desktop\PA 2014-02-02 03:36 - 2014-02-02 03:36 - 00000000 ____D () C:\Users\wupto\adobeshit 2014-02-02 03:36 - 2014-02-02 03:34 - 00000000 ____D () C:\Users\wupto\Desktop\Modelling 2014-02-02 03:34 - 2014-02-02 03:34 - 00000000 ____D () C:\Users\wupto\Desktop\Hammerwatch Art 2014-02-02 03:34 - 2014-02-02 03:23 - 00000000 ____D () C:\Users\wupto\Desktop\Games & so 2014-02-02 03:23 - 2014-02-02 03:18 - 00000000 ____D () C:\Users\wupto\Desktop\Game Maker Games 2014-02-02 03:18 - 2014-02-02 03:14 - 00000000 ____D () C:\Users\wupto\Desktop\Design Projects 2014-02-02 03:17 - 2014-02-02 03:17 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-02-02 03:17 - 2014-02-02 03:17 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-02-02 03:17 - 2014-02-02 03:17 - 00000000 ____D () C:\Users\wupto\AppData\Local\Skype 2014-02-02 03:17 - 2014-02-02 03:17 - 00000000 ____D () C:\ProgramData\Skype 2014-02-02 03:16 - 2009-07-14 18:58 - 00696132 _____ () C:\Windows\system32\perfh007.dat 2014-02-02 03:16 - 2009-07-14 18:58 - 00147428 _____ () C:\Windows\system32\perfc007.dat 2014-02-02 03:16 - 2009-07-14 06:13 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-02 03:10 - 2014-02-02 02:44 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-02 03:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-02 03:09 - 2014-02-02 03:09 - 00002154 _____ () C:\Windows\epplauncher.mif 2014-02-02 03:08 - 2014-02-02 03:08 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-02-02 03:08 - 2014-02-02 03:08 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client 2014-02-02 02:52 - 2014-02-02 02:52 - 00000000 ____D () C:\Users\wupto\AppData\Local\NVIDIA Corporation 2014-02-02 02:52 - 2014-02-02 02:43 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2014-02-02 02:52 - 2014-02-02 02:43 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-02-02 02:52 - 2014-02-02 02:38 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-02-02 02:50 - 2014-02-02 02:50 - 00000534 _____ () C:\Windows\PLTGC.ini.imi 2014-02-02 02:50 - 2014-02-02 02:50 - 00000402 _____ () C:\Windows\PLTGC.ini.cfl 2014-02-02 02:50 - 2014-02-02 02:50 - 00000132 _____ () C:\Windows\system\Dlap.pfx 2014-02-02 02:50 - 2014-02-02 02:50 - 00000000 ____D () C:\Program Files\Plantronics 2014-02-02 02:50 - 2014-02-02 02:20 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-02-02 02:50 - 2011-11-18 02:21 - 00000432 _____ () C:\Windows\system\PLTGC.ini 2014-02-02 02:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system 2014-02-02 02:49 - 2014-02-02 02:45 - 00000000 ____D () C:\Users\wupto\AppData\Local\NVIDIA 2014-02-02 02:45 - 2014-02-02 02:45 - 00001347 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk 2014-02-02 02:45 - 2014-02-02 02:45 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2014-02-02 02:43 - 2014-02-02 02:42 - 01588294 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-02 02:43 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help 2014-02-02 02:37 - 2014-02-02 02:37 - 00000000 ____D () C:\NVIDIA 2014-02-02 02:29 - 2014-02-02 02:29 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\Users\wupto\AppData\Roaming\Mozilla 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\Users\wupto\AppData\Local\Mozilla 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\ProgramData\Mozilla 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-02-02 02:29 - 2014-02-02 02:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-02-02 02:27 - 2014-02-02 02:15 - 00000000 ____D () C:\TempEI4 2014-02-02 02:23 - 2014-02-02 02:23 - 00000000 ____D () C:\Program Files\Intel 2014-02-02 02:21 - 2014-02-02 02:21 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM 2014-02-02 02:21 - 2014-02-02 02:21 - 00000000 ____D () C:\Program Files\Realtek 2014-02-02 02:21 - 2014-02-02 02:20 - 00002014 _____ () C:\RHDSetup.log 2014-02-02 02:21 - 2014-02-02 02:20 - 00000206 _____ () C:\realtek.log 2014-02-02 02:20 - 2014-02-02 02:20 - 00000000 ____D () C:\Program Files (x86)\Realtek 2014-02-02 02:16 - 2014-02-02 02:16 - 00000000 ____D () C:\Program Files (x86)\Intel 2014-02-02 02:16 - 2014-02-02 02:16 - 00000000 ____D () C:\Intel 2014-02-02 02:15 - 2014-02-02 02:15 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0 2014-02-02 02:15 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\restore 2014-02-02 02:12 - 2014-02-02 02:12 - 00001439 _____ () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-02-02 02:12 - 2014-02-02 02:12 - 00001405 _____ () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-02-02 02:12 - 2014-02-02 02:12 - 00000000 ___RD () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-02-02 02:12 - 2014-02-02 02:12 - 00000000 ____D () C:\Users\wupto\AppData\Local\VirtualStore 2014-02-02 02:11 - 2014-02-02 02:11 - 00000020 ___SH () C:\Users\wupto\ntuser.ini 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Vorlagen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Startmenü 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Netzwerkumgebung 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Lokale Einstellungen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Eigene Dateien 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Druckumgebung 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Documents\Eigene Musik 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Documents\Eigene Bilder 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\AppData\Local\Verlauf 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\AppData\Local\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\wupto\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Vorlagen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Startmenü 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Druckumgebung 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Programme 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Vorlagen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Startmenü 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Favoriten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Dokumente 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 _SHDL () C:\Dokumente und Einstellungen 2014-02-02 02:11 - 2014-02-02 02:11 - 00000000 __SHD () C:\Recovery 2014-02-02 02:11 - 2014-02-02 02:03 - 00000000 ____D () C:\Windows\Panther 2014-02-02 02:11 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-02-02 02:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Windows NT 2014-02-02 02:10 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-02 02:09 - 2009-07-14 05:45 - 00274464 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-02-02 02:07 - 2014-02-02 02:07 - 00001313 _____ () C:\Windows\TSSysprep.log 2014-02-02 02:07 - 2009-07-14 05:46 - 00001774 _____ () C:\Windows\DtcInstall.log 2014-02-02 02:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sysprep 2014-02-02 02:03 - 2009-07-14 06:38 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG 2014-02-02 02:03 - 2009-07-14 06:32 - 00028672 _____ () C:\Windows\system32\config\BCD-Template 2014-02-01 17:10 - 2014-02-02 03:13 - 00000724 _____ () C:\Users\wupto\Desktop\films u should watch.txt 2014-01-21 03:53 - 2014-02-02 02:52 - 01179576 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-01-21 03:53 - 2014-02-02 02:52 - 01048152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-01-19 08:33 - 2014-02-02 02:43 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe Files to move or delete: ==================== C:\Users\wupto\jagex_cl_runescape_LIVE.dat C:\Users\wupto\random.dat Some content of TEMP: ==================== C:\Users\wupto\AppData\Local\Temp\Creative Cloud Helper.exe C:\Users\wupto\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzgs5as.dll C:\Users\wupto\AppData\Local\Temp\fp_pl_pfs_installer.exe C:\Users\wupto\AppData\Local\Temp\Setup-Wacom.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-02 02:04 ==================== End Of Log ============================ --- --- --- Addition FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2014 04
Ran by wupto at 2014-02-02 20:34:43
Running from C:\Users\wupto\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
µTorrent (HKCU Version: 3.3.2.30488 - BitTorrent Inc.)
Adobe Creative Cloud (x32 Version: 2.3.0.322 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Photoshop CC (x32 Version: 14.0 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (x32 Version: - Hidden Path Entertainment, Ensemble Studios)
Alan Wake (x32 Version: - Remedy Entertainment)
Alan Wake's American Nightmare (x32 Version: - Remedy Entertainment)
Amnesia: The Dark Descent (x32 Version: - Frictional Games)
Awesomenauts (x32 Version: - Ronimo Games)
Batman: Arkham Asylum GOTY Edition (x32 Version: - Rocksteady Studios)
Batman: Arkham City GOTY (x32 Version: - Rocksteady Studios)
BioShock (x32 Version: - 2K Boston)
BioShock 2 (x32 Version: - 2K Marin)
BioShock Infinite (x32 Version: - Irrational Games)
Brothers - A Tale of Two Sons (x32 Version: - Starbreeze Studios AB)
Chivalry: Medieval Warfare (x32 Version: - Torn Banner Studios)
Cities XL Platinum (x32 Version: - Focus Home Interactive)
Command and Conquer: Red Alert 3 - Uprising (x32 Version: - EA Los Angeles)
Crysis 2 Maximum Edition (x32 Version: - Crytek Studios)
Dark Souls: Prepare to Die Edition (x32 Version: - FromSoftware)
DayZ (x32 Version: - Bohemia Interactive)
Dead Space (x32 Version: - EA Redwood Shores)
Dear Esther (x32 Version: - thechineseroom & Robert Briscoe)
Delver (x32 Version: - Chad Alan Cuddigan)
Divinity II: Developer's Cut (x32 Version: - Larian Studios)
Don't Starve (x32 Version: - Klei Entertainment)
Dropbox (HKCU Version: 2.6.2 - Dropbox, Inc.)
Far Cry® 3 (x32 Version: - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
Game of Thrones (x32 Version: - Cyanide Studios)
GameMaker-Studio 1.2 (HKCU Version: - YoYo Games Ltd.)
Garry's Mod (x32 Version: - Facepunch Studios)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Grand Theft Auto IV (x32 Version: - Rockstar North)
Indie Game: The Movie (x32 Version: - BlinkWorks Media)
Intel(R) Network Connections 14.2.100.0 (Version: 14.2.100.0 - Intel)
Intel(R) Network Connections 14.2.100.0 (Version: 14.2.100.0 - Intel) Hidden
Java 7 Update 51 (64-bit) (Version: 7.0.510 - Oracle)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Left 4 Dead 2 (x32 Version: - Valve)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.4.0304.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (Version: 4.4.304.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSXML 4.0 SP2 Parser and SDK (x32 Version: 4.20.9818.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2 (Version: 1.8.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 332.21 (Version: 332.21 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden
NVIDIA Update 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 11.10.11 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.20 (Version: 1.2.20 - NVIDIA Corporation)
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
Plantronics® GameCom 780 Software for Dolby® Headphone (x32 Version: 1.00.0001 - Plantronics)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5841 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden
Skype™ 6.13 (x32 Version: 6.13.104 - Skype Technologies S.A.)
Steam (x32 Version: - Valve Corporation)
Wacom Tablett (Version: 6.3.7-6 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (x32 Version: 2.1.0.3 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (Version: 2.1.0.3 - Wacom Technology Corp.)
==================== Restore Points =========================
02-02-2014 01:15:45 Intel Express Installer
02-02-2014 01:16:40 Installation mit der Intel (R) Express Installer-CD - vorher
02-02-2014 01:20:10 Intel Express Installer
02-02-2014 01:25:35 Intel Express Installer
02-02-2014 01:25:47 Installation mit der Intel (R) Express Installer-CD - danach
02-02-2014 01:28:28 Windows Update
02-02-2014 01:33:40 Windows Update
02-02-2014 01:39:28 Windows Update
02-02-2014 01:50:23 Installiert Plantronics® GameCom 780 Software for Dolby® Headpho8L
02-02-2014 02:07:32 Windows Update
02-02-2014 11:37:11 Installed Java 7 Update 51
02-02-2014 16:01:08 Installed Java 7 Update 51 (64-bit)
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {5E40563C-F63D-4C43-9879-E08221DCED3B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-02] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-12-13 12:20 - 2013-12-13 12:20 - 03359600 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll
2014-02-02 02:50 - 2011-12-01 20:16 - 00150760 ____N () C:\Program Files\Plantronics\GameCom780\VmixPLGC.dll
2014-02-02 16:52 - 2014-02-02 16:52 - 00041984 _____ () c:\users\wupto\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzgs5as.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\wupto\AppData\Roaming\Dropbox\bin\libcef.dll
2014-02-02 02:29 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-02 12:57 - 2014-02-02 12:57 - 16287624 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/02/2014 08:15:59 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (02/02/2014 05:43:28 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Dwarf.exe, Version: 1.0.0.0, Zeitstempel: 0x52ed0118
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bdbdf
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000b727
ID des fehlerhaften Prozesses: 0x1480
Startzeit der fehlerhaften Anwendung: 0xDwarf.exe0
Pfad der fehlerhaften Anwendung: Dwarf.exe1
Pfad des fehlerhaften Moduls: Dwarf.exe2
Berichtskennung: Dwarf.exe3
Error: (02/02/2014 05:43:25 PM) (Source: .NET Runtime) (User: )
Description: Anwendung: Dwarf.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.IO.FileNotFoundException
Stapel:
bei Dwarf.Program.Main(System.String[])
Error: (02/02/2014 02:00:16 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (02/02/2014 01:55:04 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (02/02/2014 01:32:53 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
System errors:
=============
Error: (02/02/2014 01:32:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/02/2014 01:32:52 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Error: (02/02/2014 02:45:23 AM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Microsoft Office Sessions:
=========================
Error: (02/02/2014 08:15:59 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (02/02/2014 05:43:28 PM) (Source: Application Error)(User: )
Description: Dwarf.exe1.0.0.052ed0118KERNELBASE.dll6.1.7600.163854a5bdbdfe04343520000b727148001cf2035e157ee60C:\Users\wupto\Dropbox\dwarf\source\Dwarf\Dwarf\Dwarf\bin\x86\Debug\Dwarf.exeC:\Windows\syswow64\KERNELBASE.dll23b1f5e2-8c29-11e3-a574-00270e06e4f2
Error: (02/02/2014 05:43:25 PM) (Source: .NET Runtime)(User: )
Description: Anwendung: Dwarf.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.IO.FileNotFoundException
Stapel:
bei Dwarf.Program.Main(System.String[])
Error: (02/02/2014 02:00:16 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (02/02/2014 01:55:04 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (02/02/2014 01:32:53 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
==================== Memory info ===========================
Percentage of memory in use: 28%
Total physical RAM: 12278.41 MB
Available physical RAM: 8772.98 MB
Total Pagefile: 24554.98 MB
Available Pagefile: 21033.4 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.41 GB) (Free:603.23 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 0004F85C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
==================== End Of Log ============================
GMER Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-24 22:32:34
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD10EADS-00M2B0 rev.01.00A01 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\wupto\AppData\Local\Temp\ugloqpow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002def000 45 bytes [01, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002def02f 16 bytes [00, 3F, 00, 00, 00, 3E, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\PnkBstrA.exe[1288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072c01a22 2 bytes [C0, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072c01ad0 2 bytes [C0, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072c01b08 2 bytes [C0, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072c01bba 2 bytes [C0, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1288] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072c01bda 2 bytes [C0, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000767e1465 2 bytes [7E, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767e14bb 2 bytes [7E, 76]
.text ... * 2
---- EOF - GMER 2.1 ----
|
| Themen zu OpenCandy und Search Protect von Conduit |
| 32 bit, adblock, alert, defender, explorer, flash player, focus, home, homepage, iexplore.exe, installation, opencandy search protect conduit, pup.optional.conduit.a, pup.optional.opencandy, pup.optional.searchprotect.a, realtek, registry, security, services.exe, svchost.exe, windows xp |
Baum-Darstellung