| |
| |||||||
Log-Analyse und Auswertung: TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
12.02.2014, 10:13
| #1 |
 |  TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Guten Morgen. Seit ca. einer halben Woche hat mein Computer die ersten Syptome für einen Virus gezeigt. Die da wären: -Sicherheitscenter lässt sich nicht starten, da der Dienst deaktiviert ist. Wenn ich ihn auf Automatisch stelle aktiviert er sich, ist aber beim Neustart wieder aus. -Nach der Aktivierung vom Sicherheitcenter kriege ich die Fehlermeldung Windows Firewall konnte nicht gestartet werden. Manuell starten kann ich ihn nicht. -Der Taskmanager ist grau hinterlegt, wenn ich ihn mit Rechtsklick in der Taskleiste versuche zu starten. Wenn ich Strg-Alt-Entf drücke wird der Button für den Taskmanager gar nicht angezeigt. Das Problem ist, das der Wert im Schlüssel auf 1 gesetzt ist. Wenn ich den Wert auf 0 setze ändert er sich automatisch wieder zu 1. -Malwarebytes blockiert alle 20 Sekunden eine Verbindung mit einer schädlichen Website. Die Verbindung wird von cvtres.exe automatisch gestartet. -Der Prozess svchost.exe hat eine ungewöhnlich hohe Auslastung von 300.000. Ich habe den Computer einmal mit Malwarebytes und ein Mal mit Norton Security durchlaufen lassen und so einiges gefunden, jedoch hat sich nichts geändert. Ich weiß wirklich nicht mehr was ich tun könnte. Sogar mein Mauszeiger hängt sich beim Bewegen auf und beim Tippen erscheinen die Buchstaben mit verzögerung. Ich habe einen Fx-6100 Prozessor mit 8 GB RAM und Win 7. Ich glaube ich weiß welches Programm den Virus eingeschleußt hat, jedoch weiß ich nicht wie ich ihn wieder entfernen könnte. Hier die Log Files. Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-02-2014 01
Ran by Pc at 2014-02-11 22:29:03
Running from C:\Users\Pc\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
µTorrent (HKCU Version: 3.3.2.30303 - BitTorrent Inc.)
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden
Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment) Hidden
Age of Conan: Unchained (x32 Version: - Funcom)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
AI Suite (x32 Version: 1.06.22 - )
AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge)
AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge) Hidden
AirPlus XtremeG DWL-G122 (x32 Version: 1.0.30 - D-Link)
Aiseesoft MP4 Video Converter 7.1.20 (x32 Version: 7.1.20 - Aiseesoft Studio)
Akamai NetSession Interface (HKCU Version: - Akamai Technologies, Inc)
Akamai NetSession Interface (x32 Version: - Akamai Technologies, Inc)
Alliance of Valiant Arms (x32 Version: - )
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.923.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
AMD Fuel (Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
American Conquest Fight Back (x32 Version: - )
ANNO 2070 (x32 Version: 1.0.0.0 - Ubisoft)
ASUS WebStorage (x32 Version: 3.0.94.193 - eCareme Technologies, Inc.)
ASUSUpdate (x32 Version: 7.18.03 - ASUSTeK Computer Inc.)
ATI AVIVO64 Codecs (Version: 11.6.0.10707 - ATI Technologies Inc.) Hidden
Audacity 2.0.2 (x32 Version: 2.0.2 - Audacity Team)
Babylon Chrome Toolbar (x32 Version: 2.0.0.4 - Babylon Ltd) <==== ATTENTION
Babylon toolbar (x32 Version: - BabylonToolbar) <==== ATTENTION
Battle For Graxia (x32 Version: - )
BioShock Infinite (x32 Version: - Irrational Games)
Black & White® 2 (x32 Version: 1.00.0000 - Lionhead Studios)
Blitzkrieg Burning Horizon (x32 Version: - )
Brick-Force (x32 Version: - Infernum Productions AG)
Browser Defender 3.0 (x32 Version: 3.0.0.314 - Threat Expert Ltd.)
Brytenwalda Version 1.40 (x32 Version: 1.40 - Brytenwalda Dev.)
Bundled software uninstaller (x32 Version: - ) <==== ATTENTION
CAESAR IV (x32 Version: 1.2 - Tilted Mill Entertainment)
Call of Duty: Black Ops II - Multiplayer (x32 Version: - )
Call of Duty: Black Ops II - Zombies (x32 Version: - )
Camtasia Studio 8 (x32 Version: 8.0.3.994 - TechSmith Corporation)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCleaner (Version: 4.09 - Piriform)
CDBurnerXP (x32 Version: 4.5.1.3868 - CDBurnerXP)
Celtic Kings - The Punic Wars (x32 Version: - )
Chivalry Medieval Warfare (c) Torn Banner Studios version 1 (x32 Version: 1 - )
Codec Pack Packages (HKCU Version: - ) <==== ATTENTION
Cossacks - The Art Of War (x32 Version: - )
Cossacks 2 - Battle for Europe (x32 Version: - )
Cossacks II (x32 Version: - )
Cross Fire En (x32 Version: - Z8Games.com)
Crossfire Europe (x32 Version: 1.107 - SG INTERACTIVE)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (x32 Version: 4.48.1.0347 - Disc Soft Ltd)
DarthMod: Shogun II (x32 Version: - )
DBO_CT_TW (x32 Version: 1.57.22 - Cayennetech)
DC-Bass Source 1.3.0 (x32 Version: - )
Die Schlacht um Mittelerde™ II (x32 Version: - )
DirectVobSub 2.40.4209 (x32 Version: 2.40.4209 - MPC-HC Team)
DivX-Setup (x32 Version: 2.6.1.8 - DivX, LLC)
Dota 2 (x32 Version: - Valve )
Dungeons and Dragons Online (HKCU Version: - )
Dynasty Warriors Online (x32 Version: - )
Elsword_DE (x32 Version: - )
EPU-4 Engine (x32 Version: 1.02.01 - )
Europa Universalis IV (x32 Version: - Paradox Interactive)
ExpressFiles (HKCU Version: 1.8.1 - hxxp://www.express-files.com/) <==== ATTENTION
ffdshow v1.1.4399 [2012-03-22] (x32 Version: 1.1.4399.0 - )
Floris Mod Pack 2.54 (x32 Version: - )
Forged By Chaos (x32 Version: - )
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fraps (remove only) (x32 Version: - )
Free Audio CD Burner version 2.0.22.320 (x32 Version: 2.0.22.320 - DVDVideoSoft Ltd.)
Free MP4 Video Converter version 5.0.20.1031 (x32 Version: 5.0.20.1031 - DVDVideoSoft Ltd.)
From Dust (x32 Version: 1.0.0 - Ubisoft)
FuNDeaulls (x32 Version: - FFunDeals)
Gameforge Live 1.7.0 "Legend" (x32 Version: 1.7.0 - Gameforge)
GameRanger (HKCU Version: - GameRanger Technologies)
GamersFirst LIVE! (HKCU Version: - GamersFirst)
Ghost Recon Online (EU) (HKCU Version: 1.34.9860.1 - Ubisoft)
GIMP 2.8.2 (Version: 2.8.2 - The GIMP Team)
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Drive (x32 Version: 1.13.5782.599 - Google, Inc.)
Google Earth (x32 Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (x32 Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Gothic III (x32 Version: 1.0.0 - JoWooD Productions Software AG)
grafstat4 (x32 Version: 4.276 - DrSoft)
GS-Supporter 1.80 (x32 Version: - Verified Publisher) <==== ATTENTION
Guild Wars 2 (x32 Version: - NCsoft Corporation, Ltd.)
Haali Media Splitter (x32 Version: - )
Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)
Haunt 1.0 64bit (HKCU Version: - )
Hi-Rez Studios Authenticate and Update Service (x32 Version: 3.0.0.0 - Hi-Rez Studios)
HydraVision (x32 Version: 4.2.208.0 - ATI Technologies Inc.) Hidden
Infestation: Survivor Stories (x32 Version: - Hammerpoint Interactive)
inSSIDer 3 (x32 Version: 3.0.6.42 - MetaGeek, LLC)
Installation (HKCU Version: 1.0.0.8 - Installation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2266 - Intel Corporation)
IrfanView (remove only) (x32 Version: 4.32 - Irfan Skiljan)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (x32 Version: 0.9 - AppWork GmbH)
King Arthur II (x32 Version: - Paradox Interactive)
K-Lite Codec Pack 9.4.0 (Basic) (x32 Version: 9.4.0 - )
Lagarith Lossless Codec (1.3.27) (x32 Version: - )
LAME v3.99.3 (for Windows) (x32 Version: - )
League of Legends (x32 Version: 1.3 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
LOCO EVOLUTION (x32 Version: EVOLUTION - DanalGames)
Logitech Print Service (x32 Version: - )
Logitech QuickCam-Software (x32 Version: 8.47.0000 - Logitech, Inc.)
LOLReplay (x32 Version: 0.8.5.1 - www.leaguereplays.com)
Lost Empire - Immortals (x32 Version: 1.0.0 - Pollux Gamelabs)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Metin2 (x32 Version: - Gameforge 4D GmbH)
Microsoft .NET Framework 1.1 (x32 Version: - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (x32 Version: - )
Microsoft Age of Empires II: The Conquerors Expansion (x32 Version: - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (x32 Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft XNA Framework Redistributable 1.0 Refresh (x32 Version: 1.1.10405.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (x32 Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (x32 Version: 4.0.20823.0 - Microsoft Corporation)
Mobistel Cynus T1 Drivers(x86) (x32 Version: 2.00 - Mobistel)
Mount&Blade Warband (x32 Version: - )
Mount&Blade With Fire and Sword (x32 Version: - )
MountMusket Battalion (x32 Version: 0.4.2 - MountMusket Battalion Team)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Movie2KDownloader (x32 Version: 2.1 Build 26473 - Movie2KDownloader.com)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MySQL Connector/ODBC 3.51 (x32 Version: 3.51.12 - MySQL AB)
Napoleonic Wars (x32 Version: 1.0 - Mount&Blade Napoleonic Wars)
NC Launcher (GameForge) (x32 Version: - NCsoft)
Nero 9 Essentials (x32 Version: - Nero AG)
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden
Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.12.100 - Nero AG) Hidden
Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Norton Internet Security (x32 Version: 21.1.0.18 - Symantec Corporation)
Notepad++ (x32 Version: 6.4.2 - Notepad++ Team)
NVIDIA 3D Vision Treiber 270.61 (Version: 270.61 - NVIDIA Corporation)
NVIDIA Drivers (Version: 1.10.57.35 - NVIDIA Corporation)
NVIDIA ForceWare Network Access Manager (x32 Version: 1.00.7325.0 - NVIDIA Corporation)
NVIDIA Grafiktreiber 270.61 (Version: 270.61 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.2.22.1 (Version: 1.2.22.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.270.54.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0513 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.7061 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 270.61 (Version: 270.61 - NVIDIA Corporation) Hidden
Open It! (x32 Version: 1.1.1 - OpenIt)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)
OpenSource Flash Video Splitter 1.0.0.5 (x32 Version: 1.0.0.5 - )
Pando Media Booster (x32 Version: 2.6.0.8 - Pando Networks Inc.)
Panzar (x32 Version: 1.0 - Panzar)
Patch v2.2 (x32 Version: - RUNEFORGE Games Studios)
Patrizier IV (x32 Version: 1.0.0 - Kalypso Media)
PC Probe II (x32 Version: 1.04.92 - ASUSTeK Computer Inc.)
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
PileFile reminder (HKCU Version: - FINEDREAM INVEST LTD)
Pixsta (HKCU Version: 2.5.0.48600 - Pokki)
PlanetSide 2 (HKCU Version: 1.0.3.183 - Sony Online Entertainment)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Pokki (HKCU Version: 0.266.1.172 - Pokki)
Pokki Download Helper (HKCU Version: 1.3.1.282 - Pokki)
PowerISO (x32 Version: 5.4 - Power Software Ltd)
PrivitizeVPN (x32 Version: 1.0.0 - OOO Industry) <==== ATTENTION
ProtectDisc Driver, Version 11 (x32 Version: 11.0.0.14 - ProtectDisc Software GmbH)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
Qtrax Connection Manager (HKCU Version: 20.13.07.02 - Qtrax Inc)
Qtrax Player (HKCU Version: - portal.qtrax.com)
QuickShare (x32 Version: 1.38.61.10911 - Linkury Inc.) <==== ATTENTION
RaiderZ (x32 Version: 1.0.0.36787 - Gameforge)
RAIDXpert (x32 Version: 3.2.1540.10 - AMD)
RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden
Realtek Ethernet Controller Driver (x32 Version: 7.52.203.2012 - Realtek)
Realtek Ethernet Diagnostic Utility (x32 Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6526 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation) Hidden
Rise and Fall (x32 Version: 1.00.0000 - Midway Games)
Roads of Rome 3 (x32 Version: - Realore Studios)
Roma Surrectum Deutsch 1.1.0.5 (x32 Version: 1.1.0.5 - ecozone)
Roma Surrectum II 2.5 (x32 Version: 2.5 - Roma Surrectum Team)
Rome - Total War(TM) (x32 Version: 1.0 - Activision)
Rome - Total War(TM) (x32 Version: 1.0 - Activision) Hidden
Rome Total War - patch 1.3 (x32 Version: 1.3 - )
S4 League_EU (x32 Version: 1.00.0000 - )
Search Protect (x32 Version: 2.7.23.2 - Conduit) <==== ATTENTION
Security Task Manager 1.8g (x32 Version: 1.8g - Neuber Software)
SeeSimilar (x32 Version: 1.0.0.5 - SeeSimilar.com)
Sid Meier's Civilization IV Colonization (x32 Version: 1.00 - Firaxis Games)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Smite (x32 Version: 0.1.1850.0 - Hi-Rez Studios)
SOE Web Installer (HKCU Version: 1.0.3.171 - Sony Online Entertainment)
Sony Ericsson Update Engine (x32 Version: 2.13.6.201305161305 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.181 (x32 Version: 2.10.181 - Sony)
Special Force 2 1.0 (x32 Version: - )
Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)
Spotydl 0.9.36.0 (x32 Version: 0.9.36.0 - spotydl.com)
Spyware Doctor 8.0 (x32 Version: 8.0 - PC Tools)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
Stronghold 2 (x32 Version: 1.00 - Firefly Studios)
surf aand kEEp (x32 Version: 1.2.0.1049 - surif aand keep) <==== ATTENTION
Swords and Sandals 3 Multiplae Ultratus (x32 Version: 1.2.7 - 3rdsense Pty Ltd)
System Requirements Lab CYRI (x32 Version: 6.0.7.0 - Husdawg, LLC)
System Requirements Lab Detection (x32 Version: 1.0.5.0 - Husdawg, LLC)
System Requirements Lab for Intel (x32 Version: 4.5.13.0 - Husdawg, LLC)
TAP-Windows 9.9.2 (Version: 9.9.2 - )
TeamSpeak 3 Client (Version: 3.0.13.1 - TeamSpeak Systems GmbH)
The War Z version 1.0 (x32 Version: 1.0 - Arktos Entertainment Group LLC)
Tube Karaoke (x32 Version: - Dacotta SoftEngineering)
Tunngle beta (x32 Version: - Tunngle.net GmbH)
Turbo Key (x32 Version: 1.01.03 - )
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1 - Microsoft Corporation)
Vanguard: Saga of Heroes (x32 Version: 1.00.000 - Sigil Games Online)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VIA Plattform-Geräte-Manager (x32 Version: 1.34 - VIA Technologies, Inc.)
Video downloader 2.0.0.433 (Version: 2.0.0.433 - Southstarco)
VirtualCloneDrive (x32 Version: - Elaborate Bytes)
VLC media player 2.0.2 (x32 Version: 2.0.2 - VideoLAN)
VLC Media Player DB Toolbar Toolbar (x32 Version: - )
War Thunder Launcher 1.0.1.278 (x32 Version: - 2013 Gaijin Entertainment Corporation)
Wargame AirLand Battle (c) Focus Home Interactive version RLD! (x32 Version: RLD! - )
Winamp (x32 Version: 5.63 - Nullsoft, Inc)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Mobile Device Updater Component (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
WinRAR 4.00 (64-Bit) (Version: 4.00.0 - win.rar GmbH)
World of Tanks (x32 Version: - Wargaming.net)
Xfire (remove only) (x32 Version: - )
Xvid Video Codec (x32 Version: 1.3.2 - Xvid Team)
YGOPro DevPro Version 1.9.6 r0 (x32 Version: 1.9.6 r0 - YGOPro DevPro Online)
Yontoo 1.12.02 (Version: 1.12.02 - Yontoo LLC) <==== ATTENTION
YoutubeAdblocker (x32 Version: 2.3.0.1751 - YoutubeAdblocker) <==== ATTENTION
Zip Opener Packages (HKCU Version: - ) <==== ATTENTION
Zune (Version: 04.08.2345.00 - Microsoft Corporation)
Zune (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CHS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CHT) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (CSY) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (DAN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (DEU) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ELL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ESP) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (FIN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (FRA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (HUN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (IND) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (ITA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (JPN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (KOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (MSL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (NLD) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (NOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PLK) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PTB) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (PTG) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (RUS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
Zune Language Pack (SVE) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
==================== Restore Points =========================
04-02-2014 12:03:18 Windows-Sicherung
04-02-2014 12:09:33 Microsoft Visual C++ 2005 Redistributable (x64) wird installiert
04-02-2014 12:10:40 Installed League of Legends
04-02-2014 12:11:27 DirectX wurde installiert
04-02-2014 14:39:51 Windows-Sicherung
04-02-2014 16:41:35 Windows-Sicherung
04-02-2014 17:06:40 Windows-Sicherung
04-02-2014 18:20:49 Windows Defender Checkpoint
10-02-2014 16:09:55 Windows-Sicherung
11-02-2014 14:49:45 Windows Update
11-02-2014 15:28:55 Installed Java 7 Update 51
11-02-2014 15:33:50 avast! Free Antivirus Setup
11-02-2014 16:17:07 Norton_Power_Eraser_20140211171701336
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {07441F79-075D-46D1-9621-B4385A0413E1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)
Task: {0ACDB7B0-58EC-44A5-B853-C74A95AB7C8B} - System32\Tasks\{350C38A0-1817-4215-9180-5D11686186E7} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()
Task: {175BF8A3-9AD4-4F9A-B98B-598E8F706334} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)
Task: {2691ADFB-DB4E-45E7-9439-ACD0C99AA70D} - System32\Tasks\{B7AB28D8-B0B8-4B92-82A6-19F4C878FB44} => C:\Users\Public\Sony Online Entertainment\Installed Games\PlanetSide 2 PSG\LaunchPad.exe [2013-03-05] (Sony Online Entertainment)
Task: {278F70B7-06C4-4D40-B948-858B1C8E33C9} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe [2013-08-01] (Symantec Corporation)
Task: {2B8021C3-95EB-4032-8827-F4F20FC80119} - System32\Tasks\{2AF4B969-DDA4-42BC-AC4D-0202126F86FA} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()
Task: {2E3A57BD-04E8-453A-AE42-B25FECD4F834} - System32\Tasks\{B08B504C-C99F-4CA5-AB04-41F9856C1544} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)
Task: {46983AB9-9DB0-4B15-9866-70EB3D8ED964} - System32\Tasks\Digital Sites => C:\Users\Pc\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE
Task: {4913A02B-EF24-4AAE-98AF-0834AF4DCD6F} - System32\Tasks\{BB6CE9F5-E484-406C-AD0E-5A4DC75E4283} => D:\support\DrvSetup.exe
Task: {742E0C46-1F1B-4465-9AFF-E499A0C68AA9} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)
Task: {78BBB10A-F364-4E92-8219-8439ED42836E} - System32\Tasks\PileFile reminder => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION
Task: {7F1E600F-A1FB-44A2-95B1-0A9CFB4AED02} - System32\Tasks\{BEE78D85-4CF3-4479-8433-33E17174DFEB} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)
Task: {85F44FDF-4E73-4F08-858C-DC3F9505CFEB} - System32\Tasks\DSite => C:\Users\Pc\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {8BDCC15A-AFC6-4F6B-9A3E-2D7C1ACF8C54} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe [2013-10-08] (Symantec Corporation)
Task: {8EDAF150-B25F-4F96-8025-08EF10739F82} - System32\Tasks\{31CDF611-4FF3-4119-866C-074E0E880CD6} => D:\support\DrvSetup.exe
Task: {8EDF384F-376F-4AB7-BA38-D81A4DAC2105} - System32\Tasks\DealPly => C:\Users\Pc\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {981EBD38-9CF4-43D6-917F-8EFD65DC3C76} - System32\Tasks\{59A28418-2F35-48CC-8491-DB29133B4A07} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()
Task: {99E34A15-E072-4951-88AF-47AFBAFFADE7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {9F055FC0-CA38-4918-A35F-E6909C3003BB} - System32\Tasks\{0CA4769F-3858-49F3-9E24-950045D22EC6} => D:\support\DrvSetup.exe
Task: {9FE6EAD7-A7CA-4ADC-BDE3-78CA35F5CD32} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-07] (Adobe Systems Incorporated)
Task: {ADB9BBC4-A3DA-49FF-A644-3E893812D24D} - System32\Tasks\PileFile logon => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION
Task: {B2D48DE0-F4A7-42F9-816C-1AC56B1A8872} - System32\Tasks\DealPlyUpdate => C:\Program
Task: {B5285F3B-D7AF-45AE-9F2E-1BB7DBCFE22C} - System32\Tasks\EPUpdater => C:\Users\Pc\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe <==== ATTENTION
Task: {B7F72847-9DC9-4BB9-83F3-9AADE971AD15} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)
Task: {BDAE8D31-C31A-436B-B816-F52EBF6947BA} - System32\Tasks\{69E6A0E4-9323-4511-9F4D-F69A398016E0} => D:\support\DrvSetup.exe
Task: {BE8F4974-67DF-4139-8246-206804A585FD} - System32\Tasks\{0C835611-E4AA-47E2-B53B-38A3543F30E8} => C:\Program Files (x86)\Cossacks - Back To War\dmcr.exe
Task: {C68FBEF9-502F-4103-B36B-27B4CDCDDD95} - System32\Tasks\{DA870EE4-507F-42F9-9DFB-BB41BD1ACED8} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)
Task: {CA19F92B-7524-4334-B5E5-3F47A5A3A453} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()
Task: {D57D1710-AB16-40CD-A68E-A83485C47529} - System32\Tasks\{C02B44A9-7C7F-4B5E-87FD-8BFE74268C40} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)
Task: {EB55C353-1ABB-4AFA-91C2-31D786524836} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe [2013-08-01] (Symantec Corporation)
Task: {F04B063C-0CD8-4D1E-941D-A30B17FF7A50} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Pc\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\DSite.job => C:\Users\Pc\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-11-01 06:31 - 2013-11-01 06:31 - 02329928 _____ () C:\Users\Pc\AppData\Local\Pokki\ocdeskband_0.dll
2011-04-11 04:34 - 2011-04-11 04:34 - 00003584 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.94.193\LogicNP.PropSheetExtensionHelper_x64.dll
2011-05-10 01:56 - 2011-03-02 11:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2012-10-18 00:42 - 2009-03-19 21:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
2012-10-18 00:42 - 2009-03-19 21:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
2012-10-18 00:42 - 2009-01-15 13:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2012-10-18 00:42 - 2009-03-25 15:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2009-12-15 16:40 - 2009-12-15 16:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
2009-12-15 22:44 - 2009-12-15 22:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll
2013-08-18 17:42 - 2014-01-24 22:17 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-02-11 17:54 - 2011-09-01 14:50 - 00157656 _____ () C:\Program Files (x86)\PC Tools Security\NetworkLayer\PCTCFHook.dll
2014-02-11 17:54 - 2011-09-01 14:50 - 00091608 _____ () C:\Program Files (x86)\PC Tools Security\avengine\sdkBSCtrl.dll
2014-02-11 17:54 - 2011-09-01 14:51 - 01394648 _____ () C:\Program Files (x86)\PC Tools Security\UserModeFileCache.dll
2009-12-15 16:40 - 2009-12-15 16:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe
2009-12-15 16:41 - 2009-12-15 16:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe
2012-10-18 00:33 - 2009-04-29 13:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll
2012-10-18 00:33 - 2009-04-29 13:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll
2012-10-18 00:33 - 2009-04-29 13:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll
2013-09-07 03:11 - 2013-09-07 03:11 - 00569856 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\ppGoogleNaClPluginChrome.dll
2013-09-07 03:11 - 2013-09-07 03:11 - 01400846 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avcodec-54.dll
2013-09-07 03:11 - 2013-09-07 03:11 - 00151054 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avutil-51.dll
2013-09-07 03:11 - 2013-09-07 03:11 - 00222734 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avformat-54.dll
2013-12-20 11:56 - 2013-12-20 11:56 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-04-07 20:54 - 2011-04-07 20:54 - 00239720 _____ () C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: McComponentHostService => 3
MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2
MSCONFIG\Services: Sony PC Companion => 3
MSCONFIG\Services: TunngleService => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Pc^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk => C:\Windows\pss\GamersFirst LIVE!.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: Aeria Ignite => "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent
MSCONFIG\startupreg: ASUSWebStorage => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSPanel.exe /S
MSCONFIG\startupreg: cefbaeacdccceasacfsfdsf => "C:\ProgramData\cefbaeacdccceasacfsfdsf.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
MSCONFIG\startupreg: HDAudDeck => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
MSCONFIG\startupreg: ISUSPM => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
MSCONFIG\startupreg: LogitechSoftwareUpdate => "C:\Program Files (x86)\Logitech\Video\ManifestEngine.exe" boot
MSCONFIG\startupreg: LogitechVideoRepair => C:\Program Files (x86)\Logitech\Video\ISStart.exe /RegAll
MSCONFIG\startupreg: LogitechVideoTray => C:\Program Files (x86)\Logitech\Video\LogiTray.exe
MSCONFIG\startupreg: Pokki => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
MSCONFIG\startupreg: PrivitizeVPN => C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe /autorun
MSCONFIG\startupreg: QtraxNotification => C:\Users\Pc\Qtrax\Player\Notification.exe
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background
MSCONFIG\startupreg: Spotify => "C:\Users\Pc\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Pc\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent
MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MSCONFIG\startupreg: uTorrent => "C:\Users\Pc\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"
MSCONFIG\startupreg: Xvid => C:\Program Files (x86)\Xvid\CheckUpdate.exe
MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"
==================== Faulty Device Manager Devices =============
Name: TAP-Win32 Adapter V9 (Tunngle)
Description: TAP-Win32 Adapter V9 (Tunngle)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Win32 Provider V9 (Tunngle)
Service: tap0901t
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PC Tools Data Store
Description: PC Tools Data Store
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: pctDS
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/11/2014 05:48:58 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/11/2014 03:43:11 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
0x80080005
Error: (02/05/2014 01:05:13 PM) (Source: Application Hang) (User: )
Description: Programm Infestation.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 105c
Startzeit: 01cf22667e20cc8f
Endzeit: 281
Anwendungspfad: C:\Program Files (x86)\Steam\steamapps\common\The War Z\Infestation.exe
Berichts-ID:
Error: (02/05/2014 10:07:05 AM) (Source: Winlogon) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
Error: (02/04/2014 10:22:24 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: wwanapi.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5be0a8
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000333eb
ID des fehlerhaften Prozesses: 0x714
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (02/04/2014 10:15:34 PM) (Source: Winlogon) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
Error: (02/04/2014 07:20:49 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {eb0c23e6-5da4-4c15-af73-54cfc9bff500}
Error: (02/04/2014 06:07:56 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 26.0.0.5087 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 978
Startzeit: 01cf21cb7fe36447
Endzeit: 62
Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Berichts-ID: e06d2591-8dbe-11e3-badf-3085a94266a8
Error: (02/04/2014 06:06:17 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Der RPC-Server ist nicht verfügbar. (0x800706BA)"
Error: (02/04/2014 05:33:07 PM) (Source: Winlogon) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
System errors:
=============
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Automatische WLAN-Konfiguration" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Programmkompatibilitäts-Assistent-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkverbindungen" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Zugriff auf Eingabegeräte" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Offlinedateien" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Audio-Endpunkterstellung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (02/11/2014 05:48:58 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Pc\Downloads\SoftonicDownloader_fuer_pc-tools-spyware-doctor-mit-antivirus-2011.exe
Error: (02/11/2014 03:43:11 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x80080005
Error: (02/05/2014 01:05:13 PM) (Source: Application Hang)(User: )
Description: Infestation.exe0.0.0.0105c01cf22667e20cc8f281C:\Program Files (x86)\Steam\steamapps\common\The War Z\Infestation.exe
Error: (02/05/2014 10:07:05 AM) (Source: Winlogon)(User: )
Description: 0x800700050x00000000
Error: (02/04/2014 10:22:24 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4wwanapi.dll6.1.7600.163854a5be0a8c000000500000000000333eb71401cf21ee3eb25316C:\Windows\Explorer.EXEC:\Windows\system32\wwanapi.dll70658b1d-8de2-11e3-bd0b-3085a94266a8
Error: (02/04/2014 10:15:34 PM) (Source: Winlogon)(User: )
Description: 0x800700050x00000000
Error: (02/04/2014 07:20:49 PM) (Source: VSS)(User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {eb0c23e6-5da4-4c15-af73-54cfc9bff500}
Error: (02/04/2014 06:07:56 PM) (Source: Application Hang)(User: )
Description: firefox.exe26.0.0.508797801cf21cb7fe3644762C:\Program Files (x86)\Mozilla Firefox\firefox.exee06d2591-8dbe-11e3-badf-3085a94266a8
Error: (02/04/2014 06:06:17 PM) (Source: Windows Backup)(User: )
Description: Der RPC-Server ist nicht verfügbar. (0x800706BA)
Error: (02/04/2014 05:33:07 PM) (Source: Winlogon)(User: )
Description: 0x800700050x00000000
CodeIntegrity Errors:
===================================
Date: 2014-02-11 21:35:50.012
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 21:35:49.887
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 21:35:16.487
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 21:35:16.378
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 17:29:57.547
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 17:29:57.438
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 17:29:25.599
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 17:29:25.489
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 16:57:44.864
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-11 16:57:44.755
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 8174.12 MB
Available physical RAM: 4613.23 MB
Total Pagefile: 16346.41 MB
Available Pagefile: 12342.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:261.45 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 85EAEEE9)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST.txt FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-02-2014 01
Ran by Pc (administrator) on PC-PC on 11-02-2014 22:27:43
Running from C:\Users\Pc\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Threat Expert Ltd.) C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe
(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsGui.exe
(Threat Expert Ltd.) C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(AutoIt Team) C:\Users\Pc\cc4j5zs76kd2kj\SQeUDVpi.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe
(PC Tools) C:\Program Files (x86)\PC Tools Security\upgrade.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [ISTray] - C:\Program Files (x86)\PC Tools Security\pctsGui.exe [1600984 2011-09-01] (PC Tools)
HKLM-x32\...\Run: [PCTools FGuard] - C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe [247760 2011-09-01] (Threat Expert Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Akamai NetSession Interface] - "C:\Users\Pc\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Load] - C:\Users\Pc\AppData\Roaming\vbc.exe [1169224 2010-11-05] (Microsoft Corporation)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Wcenter] - C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter34.exe [32768 2010-11-05] (Microsoft Corporation)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\RunOnce: [cc4j5zs76kd2kj] - C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs [190 2014-02-11] ()
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\system: [DisableTaskMgr] 1
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [NoFolderOptions] 1
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\MountPoints2: {045dbeba-7158-11e3-9483-3085a94266a8} - E:\setup.exe
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\MountPoints2: {2549caac-7476-11e2-9477-3085a94266a8} - H:\Startme.exe
AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => File Not Found
AppInit_DLLs-x32: c:\progra~2\gs-ena~1\browsafe.dll => File Not Found
Startup: C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk
ShortcutTarget: start.lnk -> C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKCU - ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar\tbhelper.dll ()
URLSearchHook: HKCU - PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=f0e6090c-d942-4ce4-94f4-095b9a73bb7a&searchtype=ds&q={searchTerms}&installDate=07/04/2013
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=289500240103DCA8&affID=121963&tsp=4980
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: PC Tools Browser Guard BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {338B4DFE-2E2C-4338-9E41-E176D497299E} - No File
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.0.0\ViProtocol.dll No File
Winsock: Catalog9 01 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 02 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 03 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 04 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 05 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 06 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9 18 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 01 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 02 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 03 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 04 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 05 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 06 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Winsock: Catalog9-x64 18 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566
FF user.js: detected! => C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js
FF NewTab: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\\npsitesafety.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
FF HKLM\...\Firefox\Extensions: [{77BEC163-D389-42c1-91A4-C758846296A5}] - C:\Program Files\Video downloader\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2014-02-11]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{cb84136f-9c44-433a-9048-c5cd9df1dc16}] - C:\Program Files (x86)\PC Tools Security\BDT\Firefox\
FF Extension: Browser Defender Toolbar - C:\Program Files (x86)\PC Tools Security\BDT\Firefox\ []
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
Chrome:
=======
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E
CHR RestoreOnStartup: "hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E"
CHR DefaultSearchKeyword: conduit.search
CHR DefaultSearchProvider: Conduit Search
CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Happy Cloud Plugin) - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
CHR Plugin: (SOE Web Installer) - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
CHR Plugin: (Pokki Download Helper) - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (FuNDeaulls) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll [2013-12-31]
CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]
CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]
CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]
CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]
CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [fmfnfnpmhcllokmkepffndflpnadjmma] - C:\Program Files (x86)\DealPly\DealPly.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Pc\AppData\Local\Wajam\Chrome\wajam.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [khialnikbocfgkohdegnebhmmaifoglp] - C:\Program Files (x86)\LyricsMonkey\Chrome.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\Exts\Chrome.crx [2014-02-11]
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx [2013-02-10]
CHR HKLM-x32\...\Chrome\Extension: [pggagllhehfjjfgnfnfkjedjlmbchamf] - C:\Users\Pc\AppData\Roaming\SeeSimilar\SeeSimilar.crx [2013-06-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 Browser Defender Update Service; C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe [337872 2011-09-01] (Threat Expert Ltd.)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [275696 2013-10-08] (Symantec Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()
R2 sdAuxService; C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe [371472 2011-02-18] (PC Tools)
R2 sdCoreService; C:\Program Files (x86)\PC Tools Security\pctsSvc.exe [1117144 2011-09-01] (PC Tools)
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)
R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140121.001\BHDrvx64.sys [1526488 2014-01-21] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-02-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-02-11] (Symantec Corporation)
R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140209.002\IDSvia64.sys [521944 2014-02-09] (Symantec Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140211.003\ENG64.SYS [126040 2014-02-11] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140211.003\EX64.SYS [2099288 2014-02-11] (Symantec Corporation)
R0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [360696 2011-08-23] (PC Tools)
R0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [452872 2010-06-29] (PC Tools)
R0 pctEFA; C:\Windows\System32\drivers\pctEFA64.sys [816016 2010-07-16] (PC Tools)
R1 PCTSD; C:\Windows\System32\Drivers\PCTSD64.sys [228392 2011-08-18] (PC Tools)
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
R1 SRTSP; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-02-11] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\NISx64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-11 22:27 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:24 - 2014-02-11 22:27 - 00031586 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-11 22:23 - 2014-02-11 22:27 - 00000000 ____D () C:\FRST
2014-02-11 22:22 - 2014-02-11 22:23 - 02151424 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:20 - 2014-02-11 22:20 - 00050477 _____ () C:\Users\Pc\Desktop\Defogger.exe
2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 18:03 - 2011-09-01 11:39 - 02189264 _____ (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll
2014-02-11 18:03 - 2011-09-01 11:39 - 01533904 _____ (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll
2014-02-11 18:03 - 2011-09-01 11:39 - 00149456 _____ (PC Tools) C:\Windows\SGDetectionTool.dll
2014-02-11 18:03 - 2011-09-01 11:38 - 00767952 _____ () C:\Windows\BDTSupport.dll
2014-02-11 18:03 - 2011-01-06 10:54 - 00002125 _____ () C:\Windows\UDB.zip
2014-02-11 18:03 - 2010-08-20 09:50 - 00000882 _____ () C:\Windows\RegSDImport.xml
2014-02-11 18:03 - 2010-01-22 08:44 - 00000879 _____ () C:\Windows\RegISSImport.xml
2014-02-11 18:03 - 2008-11-26 11:08 - 00000131 _____ () C:\Windows\IDB.zip
2014-02-11 17:54 - 2014-02-11 21:51 - 00000000 ____D () C:\Program Files (x86)\PC Tools Security
2014-02-11 17:54 - 2014-02-11 18:16 - 00141312 _____ (PC Tools) C:\Windows\system32\Drivers\pctwfpfilter64.sys
2014-02-11 17:54 - 2014-02-11 17:55 - 02514894 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:54 - 2014-02-11 17:54 - 00002072 _____ () C:\Users\Public\Desktop\Spyware Doctor.lnk
2014-02-11 17:54 - 2011-08-23 11:45 - 00360696 _____ (PC Tools) C:\Windows\system32\Drivers\PCTCore64.sys
2014-02-11 17:54 - 2011-08-18 09:31 - 00228392 _____ (PC Tools) C:\Windows\system32\Drivers\PCTSD64.sys
2014-02-11 17:54 - 2011-07-19 09:23 - 00092896 _____ (PC Tools) C:\Windows\system32\Drivers\pctplsg64.sys
2014-02-11 17:54 - 2011-07-19 09:18 - 00336512 _____ (PC Tools) C:\Windows\system32\Drivers\pctgntdi64.sys
2014-02-11 17:54 - 2010-07-16 14:53 - 00816016 _____ (PC Tools) C:\Windows\system32\Drivers\pctEFA64.sys
2014-02-11 17:54 - 2010-06-29 10:35 - 00452872 _____ (PC Tools) C:\Windows\system32\Drivers\pctDS64.sys
2014-02-11 17:50 - 2014-02-11 17:54 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 17:50 - 2014-02-11 17:50 - 00507360 _____ () C:\Users\Pc\Desktop\sdsetup_2011.exe
2014-02-11 16:55 - 2014-02-11 21:33 - 00035740 _____ () C:\Windows\PFRO.log
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00177752 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2014-02-11 16:37 - 2014-02-11 16:37 - 00008222 _____ () C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:37 - 2014-02-11 16:37 - 00002585 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-02-11 16:37 - 2014-02-11 16:37 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-11 16:35 - 2014-02-11 21:35 - 00000280 _____ () C:\Windows\Tasks\Digital Sites.job
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Windows\system32\Drivers\NISx64
2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security
2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:19 - 2014-02-11 21:45 - 00000280 _____ () C:\Windows\setupact.log
2014-02-11 16:19 - 2014-02-11 16:19 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-04 16:14 - 2013-09-29 23:55 - 00043810 _____ () C:\Users\Pc\AppData\Roaming\poclbm130302.cl
2014-02-04 16:14 - 2013-06-12 15:15 - 00119888 _____ (Open Source Software community LGPL) C:\Users\Pc\AppData\Roaming\pthreadGC2.dll
2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:45 - 2014-02-04 13:45 - 00000134 _____ () C:\Users\Pc\Desktop\Microsoft Fix*it.url
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-04 13:09 - 2014-02-04 13:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
2014-02-11 22:27 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:27 - 2014-02-11 22:24 - 00031586 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-11 22:27 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST
2014-02-11 22:23 - 2014-02-11 22:22 - 02151424 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-11 22:21 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc
2014-02-11 22:20 - 2014-02-11 22:20 - 00050477 _____ () C:\Users\Pc\Desktop\Defogger.exe
2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-11 21:51 - 2014-02-11 17:54 - 00000000 ____D () C:\Program Files (x86)\PC Tools Security
2014-02-11 21:45 - 2014-02-11 16:19 - 00000280 _____ () C:\Windows\setupact.log
2014-02-11 21:36 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-11 21:35 - 2014-02-11 16:35 - 00000280 _____ () C:\Windows\Tasks\Digital Sites.job
2014-02-11 21:35 - 2013-05-21 18:33 - 00000274 _____ () C:\Windows\Tasks\DSite.job
2014-02-11 21:34 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-11 21:34 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-11 21:33 - 2014-02-11 16:55 - 00035740 _____ () C:\Windows\PFRO.log
2014-02-11 21:31 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-11 21:31 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 21:23 - 2014-02-04 15:05 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-11 21:23 - 2014-02-04 12:08 - 00000000 _RSHD () C:\Users\Pc\xripb
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\50Coeuupons
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki
2014-02-11 18:16 - 2014-02-11 17:54 - 00141312 _____ (PC Tools) C:\Windows\system32\Drivers\pctwfpfilter64.sys
2014-02-11 17:55 - 2014-02-11 17:54 - 02514894 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:54 - 2014-02-11 17:54 - 00002072 _____ () C:\Users\Public\Desktop\Spyware Doctor.lnk
2014-02-11 17:54 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 17:50 - 2014-02-11 17:50 - 00507360 _____ () C:\Users\Pc\Desktop\sdsetup_2011.exe
2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:51 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00177752 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2014-02-11 16:37 - 2014-02-11 16:37 - 00008222 _____ () C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:37 - 2014-02-11 16:37 - 00002585 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-02-11 16:37 - 2014-02-11 16:37 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Windows\system32\Drivers\NISx64
2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security
2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG
2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-11 16:19 - 2014-02-11 16:19 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-11 16:17 - 2011-05-10 01:27 - 01478483 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite
2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent
2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client
2014-02-11 16:03 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps
2014-02-11 16:03 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-11 15:34 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype
2014-02-10 18:30 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat
2014-02-10 18:30 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat
2014-02-10 18:30 - 2009-07-14 06:13 - 01651686 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt
2014-02-07 14:59 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-07 14:59 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-07 14:59 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:45 - 2014-02-04 13:45 - 00000134 _____ () C:\Users\Pc\Desktop\Microsoft Fix*it.url
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:12 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-04 13:11 - 2012-10-28 14:16 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele
2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-26 16:16 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe
2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}
2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment
2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify
2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify
2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler
2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 14:30 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 14:24 - 2012-10-18 05:30 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\ProgramData\cefbaeacdccceasacfsfdsf.exe
C:\ProgramData\libnspr4.dll
Some content of TEMP:
====================
C:\Users\Pc\AppData\Local\Temp\27132-673656-spyware-doctor.exe
C:\Users\Pc\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-11 14:00
==================== End Of Log ============================
Ich habe zu viele Zeichen benutzt, weshalb ich die Log von Malwarebyte und Gmer.txt nicht reinstellen kann. |
|
12.02.2014, 10:34
| #2 |
| /// Malwareteam   |  TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Ich bedanke mich für deine Geduld 
__________________ |
|
12.02.2014, 10:38
| #3 |
| | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Vielen Dank. Da jemand nun geantwortet hat, werde ich jetzt auch noch die anderen Logs reinstellen.
__________________Gmer.txt Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-12 09:15:52
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Hitachi_HUA721010KLA330 rev.GKAOAB0A 931,51GB
Running: pn49km1w.exe; Driver: C:\Users\Pc\AppData\Local\Temp\pgldapog.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\svchost.exe[1064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75]
.text C:\Windows\SysWOW64\svchost.exe[1064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75]
.text ... * 2
.text C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75]
.text C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75]
.text ... * 2
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75]
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75]
.text ... * 2
.text C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe[2876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75]
.text C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe[2876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75]
.text ... * 2
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe[680] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75]
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe[680] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75]
.text ... * 2
.text C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75]
.text C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75]
.text ... * 2
.text C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000074611a22 2 bytes [61, 74]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000074611ad0 2 bytes [61, 74]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000074611b08 2 bytes [61, 74]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000074611bba 2 bytes [61, 74]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000074611bda 2 bytes [61, 74]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75]
.text ... * 2
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWaitForSingleObject 000000007751f8bc 5 bytes JMP 0000000176de0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtReadFile 000000007751f8f0 5 bytes JMP 00000001770c0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile 000000007751f928 5 bytes JMP 00000001770e0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtClose 000000007751f9e0 5 bytes JMP 0000000177040000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryObject 000000007751f9f8 5 bytes JMP 0000000176ae0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationFile 000000007751fa10 5 bytes JMP 0000000177060000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey 000000007751fa28 5 bytes JMP 0000000176c60000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey 000000007751fa40 5 bytes JMP 0000000176d00000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey 000000007751fa90 5 bytes JMP 0000000176c20000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007751faa8 5 bytes JMP 0000000176be0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationProcess 000000007751fad8 5 bytes JMP 0000000176a60000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey 000000007751fb40 5 bytes JMP 0000000176d80000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 000000007751fc38 5 bytes JMP 0000000177080000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 000000007751fc50 5 bytes JMP 0000000176f80000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection 000000007751fc80 5 bytes JMP 0000000176f40000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey 000000007751fd4c 5 bytes JMP 0000000176d20000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 000000007751fd64 5 bytes JMP 00000001774f0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 000000007751fd98 5 bytes JMP 0000000176ea0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection 000000007751fdc8 5 bytes JMP 0000000177000000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFsControlFile 000000007751fdf8 5 bytes JMP 0000000176e20000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject 000000007751fe44 5 bytes JMP 0000000176f20000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile 000000007751fe5c 5 bytes JMP 0000000176fc0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryVolumeInformationFile 000000007751ff8c 2 bytes JMP 0000000176ee0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryVolumeInformationFile + 3 000000007751ff8f 2 bytes [9C, FF]
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection 000000007751ffa4 2 bytes JMP 0000000177020000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection + 3 000000007751ffa7 2 bytes [B0, FF]
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushBuffersFile 000000007751ffbc 2 bytes JMP 0000000176e40000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushBuffersFile + 3 000000007751ffbf 2 bytes [92, FF]
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQuerySection 0000000077520050 5 bytes JMP 0000000176f60000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000775200b4 5 bytes JMP 00000001774d0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWaitForMultipleObjects 0000000077520148 5 bytes JMP 0000000176dc0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000775201c4 5 bytes JMP 0000000176b40000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheck 0000000077520228 5 bytes JMP 0000000176a20000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile 00000000775209e4 5 bytes JMP 00000001770a0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey 00000000775209fc 5 bytes JMP 0000000176d60000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077520a44 5 bytes JMP 0000000176d40000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtExtendSection 0000000077520b1c 5 bytes JMP 0000000176da0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey 0000000077520b80 5 bytes JMP 0000000176ce0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushVirtualMemory 0000000077520bb4 5 bytes JMP 0000000176fe0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLoadKey 0000000077520e0c 5 bytes JMP 0000000176cc0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLoadKey2 0000000077520e24 5 bytes JMP 0000000176ca0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLockFile 0000000077520e54 5 bytes JMP 0000000176e80000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeDirectoryFile 0000000077520f58 5 bytes JMP 0000000176e00000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey 0000000077520f70 5 bytes JMP 0000000176c80000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx 0000000077521018 5 bytes JMP 0000000176c40000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile 000000007752133c 5 bytes JMP 0000000176f00000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey 000000007752147c 5 bytes JMP 0000000176c00000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject 0000000077521528 5 bytes JMP 0000000176a40000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey 0000000077521718 5 bytes JMP 0000000176b00000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtReplaceKey 0000000077521748 5 bytes JMP 0000000176bc0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtRestoreKey 00000000775217e0 5 bytes JMP 0000000176ba0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSaveKey 0000000077521874 5 bytes JMP 0000000176b80000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey 0000000077521a58 5 bytes JMP 0000000176b60000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject 0000000077521b9c 5 bytes JMP 0000000176fa0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetVolumeInformationFile 0000000077521c9c 5 bytes JMP 0000000176ec0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnloadKey 0000000077521e70 5 bytes JMP 0000000176b20000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnlockFile 0000000077521eb8 5 bytes JMP 0000000176e60000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!RtlQueryInformationActivationContext 000000007753ba2c 5 bytes JMP 0000000176ac0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007753c4dd 5 bytes JMP 0000000176aa0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077541287 5 bytes JMP 0000000176a80000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateProcessW 000000007575103d 5 bytes JMP 00000001756f0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateProcessA 0000000075751072 5 bytes JMP 0000000175710000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateActCtxW 00000000757591e7 5 bytes JMP 0000000175730000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!WinExec 00000000757d2c51 5 bytes JMP 00000001755d0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserW 00000000763ec532 5 bytes JMP 00000001763d0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!EncryptFileW 00000000764228f8 5 bytes JMP 00000001763b0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!DecryptFileW 0000000076422947 5 bytes JMP 0000000176390000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject 0000000075f921e1 5 bytes JMP 0000000175f70000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoGetClassObject 0000000075fb54ad 5 bytes JMP 0000000175ed0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fc9d0b 5 bytes JMP 0000000175f10000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx 0000000075fc9d4e 5 bytes JMP 0000000175ef0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject 000000007600eacf 5 bytes JMP 0000000175f50000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoFreeUnusedLibraries 0000000076010cc2 5 bytes JMP 0000000175f30000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRegisterSurrogate 00000000760609bf 5 bytes JMP 0000000175eb0000
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75]
.text C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75]
.text ... * 2
---- Trace I/O - GMER 2.1 ----
Trace ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore64.sys ACPI.sys >>UNKNOWN [0xfffffa8007a16d90]<< sfsync04.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys fffffa8007a16d90
Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007a2c790] fffffa8007a2c790
Trace 3 CLASSPNP.SYS[fffff88001c0143f] -> nt!IofCallDriver -> [0xfffffa800799a940] fffffa800799a940
Trace 5 PCTCore64.sys[fffff88001287a40] -> nt!IofCallDriver -> [0xfffffa800798d9b0] fffffa800798d9b0
Trace 7 ACPI.sys[fffff88000f177a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa8006ab3680] fffffa8006ab3680
Trace \Driver\atapi[0xfffffa8006adf3a0] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa8007a16d90 fffffa8007a16d90
---- Threads - GMER 2.1 ----
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4772] 000000000066ca30
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4776] 000000000066c3c0
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4780] 000000000066c3c0
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4784] 000000000066c3c0
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4788] 000000000066c3c0
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4760] 000000000066c3c0
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4796] 000000000066c3c0
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4800] 000000000066c3c0
Thread C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4812] 000000000066c3c0
---- Processes - GMER 2.1 ----
Library :\{9019ACD6-BC11-4308-8C49-92E0601DF38D}\temp\2216\bxsdk32.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216] 0000000010000000
Library C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216] 0000000013900000
Library C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216] 0000000011000000
Library C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216] 0000000013800000
Library C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216] 0000000013000000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001fcf206b16
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export ????FA?????????????????????????????????????????????????????????????????{??????????????????????-AC58-425A-A466-AA544D7B3A97}"?"??? ???????|???????????u?:????????????&????????????????????????????????2?????e??????T??????????????d??????????????????????????????????????? ???????|?????????????:????????????&????????????????????8??? ??????????????????????????????????????wvmbus.inf_amd64_neutral_f6b968c04185b840???.NT??????????????????????????????????????????????????????i??????????????? ???????n??????????????????????????&????????????????????4??????? ?????????????????????0????????????&???????????????????????? ?????????????????????0????????????????????? ???????????????????j?0????????????????????? ???????? ????????????0????????????&???????????????????????? ?????????????????????0?????????????????????????E??? ???????????????????j?0????????????????????????????? ?????????????????????0????????????&????????????????????-??? ?????????????????????0????????????????????????????? ?????????????????????0???????????????????????????????
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001fcf206b16 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.11.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Pc :: PC-PC [Administrator] Schutz: Aktiviert 11.02.2014 21:03:15 mbam-log-2014-02-11 (21-03-15).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 250063 Laufzeit: 18 Minute(n), 36 Sekunde(n) Infizierte Speicherprozesse: 1 C:\Users\Pc\AppData\Local\Temp\ba58Installer.exe (PUP.Optional.Vittalia) -> 2284 -> Löschen bei Neustart. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 64 HKCR\CLSID\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\{562B9316-C08A-444A-9482-62080DD851AE} (PUP.Optional.SpeedAnalysis3.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\{685F23D9-FCFD-475C-B56A-362645945C5A} (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{291BCCC1-6890-484a-89D3-318C928DAC1B} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\esrv.BabylonESrvc.1 (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\esrv.BabylonESrvc (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\wajam.WajamDownloader.1 (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\wajam.WajamDownloader (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\b (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Typelib\{6E8BF012-2C85-4834-B10A-1B31AF173D70} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252} (PUP.Optional.GreatSaver.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF987D06-1DCF-7B36-5B43-13BC8699C44C} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DSite (PUP.Optional.DigitalSites.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\esrv.ividiESrvc (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\esrv.ividiESrvc.1 (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\ividi.ividiappCore (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\ividi.ividiappCore.1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\priam_bho.DLL (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\BabylonToolbar (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\SmartbarBackup (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\SmartbarLog (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\delta LTD (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\iVIDI Plugin (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Google\Chrome\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\WAJAM (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\BabylonToolbar (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Google\chrome\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Vittalia\AxtanInstaller (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{211B330A-499B-415E-B1F1-B7132A8751D2} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{D18734A5-B131-4335-A3E0-15FF90AC90EE} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\i (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{905E34C2-F4EB-49BE-A36B-47692CF957A8} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\ividi.ividiHlpr.1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\ividi.ividiHlpr (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 9 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|22857 (Spyware.Zbot.ED) -> Daten: c:\progra~3\msxcjos.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Wcenter (Trojan.Agent) -> Daten: C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter11.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DealPly|Partner (PUP.Optional.DealPly.A) -> Daten: iron -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoFolderOptions (Hijack.FolderOptions) -> Daten: 1 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Mozilla\Firefox\Extensions|{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2} (PUP.Optional.Wajam.A) -> Daten: C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Wajam|affiliate_id (PUP.Optional.Wajam.A) -> Daten: 6447 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\DealPly|ChromeCrxPath (PUP.Optional.DealPly.A) -> Daten: C:\Program Files (x86)\DealPly\DealPly.crx -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 2 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Conduit.A) -> Bösartig: (hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 19 C:\Users\Pc\AppData\Roaming\Unitech LLC (PUP.Optional.Unitech.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Documents\PCSpeedUp (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Documents\PCSpeedUp\RestorePoints (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Documents\PCSpeedUp\ScanResults (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsFinder (PUP.Optional.AddLyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey\FF (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey\FF\chrome (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey\FF\chrome\content (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Mysearchdial (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\bh (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\YoutubeAdblocker (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 105 C:\Users\Pc\AppData\Local\Temp\ba58Installer.exe (PUP.Optional.Vittalia) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\msxcjos.exe (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\50Coeuupons\gKoa.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\FuNDeaulls\DD2qL.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz15FC.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz16DA.tmp (Trojan.ExploitDrop.BV) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz1DE9.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz25E6.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz2DE3.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz2E12.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz35DF.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz360F.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz3E0C.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz4608.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz4E24.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz5611.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz5E0E.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz603.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz660A.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz6E07.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz7613.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz7E10.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz861C.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz8E19.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz9615.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trz9E31.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzA62E.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzAE2A.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzB637.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzBE24.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzC630.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzCE1D.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzD619.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzDE16.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzE00.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzE613.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzE7BF.tmp (Trojan.ExploitDrop.BV) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzEE00.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\trzFE7.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\50Coeuupons\gKoa.exe (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\50Coeuupons\gKoa.x64.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\FuNDeaulls\DD2qL.x64.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\InstallMate\{FA676CA0-EE7A-4B03-A9E8-A65821844E56}\Custom.dll (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\libcurl-4.dll (Trojan.Miner) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe (PUP.Optional.DigitalSites.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Temp\instloffer.exe (PUP.Optional.Vittalia) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\msntoz.exe (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\aoajz\vfYREdWoH.exe (Misused.Legit.AI) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\Blade_.exe (PUP.Optional.ToolBarInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\Europa Universalis IV-FLT.exe (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\LOL Replay provided through GetNow.exe (PUP.Optional.LiveSoftAction.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\Lord_of_the_Rings-Battle_for_Middle-Earth_II_secure.exe (PUP.Optional.Topmedia) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\My flower collection(1).rar (Hacktool.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\My flower collection.rar (Hacktool.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe (PUP.Optional.FilePile.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\Rust_hack steam undetected by VAC.zip (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\SoftonicDownloader_for_instagram-downloader.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\SoftonicDownloader_fuer_pc-tools-spyware-doctor-mit-antivirus-2011.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\SoftonicDownloader_fuer_rome-total-war-barbarian-invasion.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\SoftonicDownloader_per_yu-gi-oh-online-3.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\swords and sandals 3 multiplae ultratus setup.exe (PUP.Optional.AdBundle) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Downloads\YTDSetup_3.9.3.exe (PUP.Optional.MyEmoticons.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\xripb\UPlCliaaJ.exe (Misused.Legit.AI) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Installer\875b1.msi (PUP.Optional.SmartBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.exe (Trojan.Dropper.SFX) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\Unitech LLC\sqlite3.dll (PUP.Optional.Unitech.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter11.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\config.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\info.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\phatk121016.cl (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\scrypt130511.cl (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\mysearchdial_speedial_v9.0.2.crx (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\Documents\PCSpeedUp\App.log (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey\chrome.manifest (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey\FF\chrome.manifest (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey\FF\install.rdf (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey\FF\chrome\content\icon.png (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\LyricsMonkey\FF\chrome\content\overlay.xul (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Mysearchdial\uninst.dat (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividi.crx (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividiApp.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividiEng.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividisrv.exe (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\uninstall.exe (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\bh\ividi.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\appCntrl.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\bg.html (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\bg.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\CrmAdpt.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\ct.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\CTB.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\dpk.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\hprtkMsg.htm (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\hprtkMsg.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\json2.min.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\logo.png (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\manifest.json (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\pref.json (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\YoutubeAdblocker\3ooCV2jP.dat (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\YoutubeAdblocker\3ooCV2jP.tlb (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter 2014/02/11 20:59:27 +0100 PC-PC Pc MESSAGE Starting protection
2014/02/11 20:59:27 +0100 PC-PC Pc MESSAGE Protection started successfully
2014/02/11 20:59:27 +0100 PC-PC Pc MESSAGE Starting IP protection
2014/02/11 20:59:39 +0100 PC-PC Pc MESSAGE IP Protection started successfully
2014/02/11 20:59:47 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49302, Process: cvtres.exe)
2014/02/11 20:59:47 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 28769, Process: svchost.exe)
2014/02/11 20:59:47 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 20:59:56 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 20:59:56 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50335, Process: cvtres.exe)
2014/02/11 20:59:56 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 20:59:56 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50336, Process: cvtres.exe)
2014/02/11 20:59:56 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 21:00:00 +0100 PC-PC Pc MESSAGE Starting database refresh
2014/02/11 21:00:00 +0100 PC-PC Pc MESSAGE Stopping IP protection
2014/02/11 21:00:02 +0100 PC-PC Pc MESSAGE IP Protection stopped successfully
2014/02/11 21:00:07 +0100 PC-PC Pc MESSAGE Database refreshed successfully
2014/02/11 21:00:07 +0100 PC-PC Pc MESSAGE Starting IP protection
2014/02/11 21:00:09 +0100 PC-PC Pc MESSAGE IP Protection started successfully
2014/02/11 21:01:11 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50343, Process: cvtres.exe)
2014/02/11 21:01:12 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50373, Process: cvtres.exe)
2014/02/11 21:01:12 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50381, Process: cvtres.exe)
2014/02/11 21:01:20 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50385, Process: cvtres.exe)
2014/02/11 21:01:36 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50396, Process: cvtres.exe)
2014/02/11 21:02:08 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50405, Process: cvtres.exe)
2014/02/11 21:03:03 +0100 PC-PC Pc MESSAGE Executing scheduled update: Daily
2014/02/11 21:03:08 +0100 PC-PC Pc MESSAGE Database already up-to-date
2014/02/11 21:03:12 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50413, Process: cvtres.exe)
2014/02/11 21:05:22 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50425, Process: cvtres.exe)
2014/02/11 21:06:11 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 21:06:59 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 50343, Process: svchost.exe)
2014/02/11 21:08:44 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50446, Process: cvtres.exe)
2014/02/11 21:11:54 +0100 PC-PC Pc DETECTION C:\ProgramData\msxcjos.exe Spyware.Zbot.ED QUARANTINE
2014/02/11 21:12:07 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50474, Process: cvtres.exe)
2014/02/11 21:12:07 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)
2014/02/11 21:12:56 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: incoming, Port: 50343, Process: svchost.exe)
2014/02/11 21:15:23 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50480, Process: cvtres.exe)
2014/02/11 21:18:46 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50507, Process: cvtres.exe)
2014/02/11 21:22:03 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50523, Process: cvtres.exe)
2014/02/11 21:25:27 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50535, Process: cvtres.exe)
2014/02/11 21:28:40 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 50550, Process: cvtres.exe)
2014/02/11 21:31:09 +0100 PC-PC Pc DETECTION C:\ProgramData\msxcjos.exe Spyware.Zbot.ED QUARANTINE
2014/02/11 21:35:58 +0100 PC-PC Pc MESSAGE Starting protection
2014/02/11 21:35:58 +0100 PC-PC Pc MESSAGE Protection started successfully
2014/02/11 21:35:58 +0100 PC-PC Pc MESSAGE Starting IP protection
2014/02/11 21:35:59 +0100 PC-PC Pc MESSAGE IP Protection started successfully
2014/02/11 21:38:57 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49180, Process: cvtres.exe)
2014/02/11 21:38:57 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49181, Process: cvtres.exe)
2014/02/11 21:39:05 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49182, Process: cvtres.exe)
2014/02/11 21:39:13 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49183, Process: cvtres.exe)
2014/02/11 21:39:30 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49184, Process: cvtres.exe)
2014/02/11 21:40:59 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49215, Process: cvtres.exe)
2014/02/11 21:43:09 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49250, Process: cvtres.exe)
2014/02/11 21:45:27 +0100 PC-PC Pc DETECTION C:\Users\Pc\Downloads\installer_spyware_doctor_9_0_0_2308_Deutsch.exe PUP.Optional.Vittalia QUARANTINE
2014/02/11 21:46:16 +0100 PC-PC Pc DETECTION c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe PUP.Optional.Vittalia QUARANTINE
2014/02/11 21:46:16 +0100 PC-PC Pc ERROR Quarantine failed: SDKQuarantine failed with error code 2
2014/02/11 21:46:24 +0100 PC-PC Pc DETECTION c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe PUP.Optional.Vittalia QUARANTINE
2014/02/11 21:46:24 +0100 PC-PC Pc ERROR Quarantine failed: SDKQuarantine failed with error code 2
2014/02/11 21:46:30 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49273, Process: cvtres.exe)
2014/02/11 21:47:20 +0100 PC-PC Pc DETECTION c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe PUP.Optional.Vittalia QUARANTINE
2014/02/11 21:47:20 +0100 PC-PC Pc ERROR Quarantine failed: SDKQuarantine failed with error code 2
2014/02/11 21:48:30 +0100 PC-PC Pc DETECTION c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe PUP.Optional.Vittalia QUARANTINE
2014/02/11 21:48:31 +0100 PC-PC Pc ERROR Quarantine failed: SDKQuarantine failed with error code 2
2014/02/11 21:49:51 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49302, Process: cvtres.exe)
2014/02/11 22:06:12 +0100 PC-PC Pc DETECTION C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe HackTool.Wpakill QUARANTINE
2014/02/11 22:06:29 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49434, Process: cvtres.exe)
2014/02/11 22:08:40 +0100 PC-PC Pc DETECTION C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe HackTool.Wpakill QUARANTINE
2014/02/11 22:09:23 +0100 PC-PC Pc DETECTION C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe HackTool.Wpakill QUARANTINE
2014/02/11 22:09:49 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49455, Process: cvtres.exe)
2014/02/11 22:13:10 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49524, Process: cvtres.exe)
2014/02/11 22:16:30 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49610, Process: cvtres.exe)
2014/02/11 22:19:51 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49708, Process: cvtres.exe)
2014/02/11 22:23:11 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49726, Process: cvtres.exe)
2014/02/11 22:26:32 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49732, Process: cvtres.exe)
2014/02/11 22:29:53 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49739, Process: cvtres.exe)
2014/02/11 22:33:14 +0100 PC-PC Pc IP-BLOCK 37.221.163.19 (Type: outgoing, Port: 49743, Process: cvtres.exe)
2014/02/11 22:34:34 +0100 PC-PC Pc MESSAGE Stopping protection
2014/02/11 22:34:34 +0100 PC-PC Pc MESSAGE Protection stopped successfully
2014/02/11 22:34:34 +0100 PC-PC Pc MESSAGE Stopping IP protection
2014/02/11 22:34:35 +0100 PC-PC Pc MESSAGE IP Protection stopped successfully
2014/02/11 22:34:36 +0100 PC-PC Pc MESSAGE Protection stopped
|
|
12.02.2014, 18:39
| #4 |
| /// Malwareteam | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Lesestoff:Banking-Trojaner Wenn du mit diesem Computer beispielsweise Onlinebanking machst, dann solltest du zumindest dein Passwort von deiner Bank ändern lassen, wenn du ein ansonsten sicheres Verfahren wie beispielsweise "chip-TAN-comfort" nutzt. Hast du noch alte TAN-Bögen auf Papierbasis? Dann ist es höchste Zeit dich bei deiner Bank zu melden und notfalls das Konto temporär sperren zu lassen. Der Sperrnotruf 116 116 von www.sperr-notruf.de kann Tag und Nacht dafür benutzt werden. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter cmd: type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs"
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Scan mit Combofix
Schritt 3 Downloade dir bitte  Farbar Service Scanner
Poste bitte den Inhalt hier. Poste folgende Logfiles in deiner nächsten Antwort:
__________________ Gruß, Jonas |
|
12.02.2014, 22:22
| #5 |
| | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Ich hatte Probleme bei Combofix. Immer wenn 50% erreicht wurden, erhielt ich einen Bluescreen und der Pc wurde neu gestartet. Also habe ich die Anwendung im abgesicherten Modus gestartet und dann ging es auch. Folgendes hat sich verbessert: -Taskmanager lässt sich nun starten -Sicherheitscenter bleibt aktiviert -Cvtres.exe stellt keine Verbindung mehr auf Websiten her -Läuft Spürbar schneller Folgende Probleme bestehen noch: -Windows Defender lässt sich weiterhin nicht starten -hohe CPU Auslastung wenn es anspruchsvoller wird, z.B wenn ich youtube öffne, wo man Flash benutzt. Der Browser hängt sich auf und möchte anschließend ein Skript beenden. -svchost.exe hat permanent 150.000 K und Firefox 250.000 K. Ob das unnormal ist, weiß ich nicht. Nun die Logs: Fixlog Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-02-2014 01
Ran by Pc at 2014-02-12 18:54:45 Run:1
Running from C:\Users\Pc\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
cmd: type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs"
*****************
========= type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs" =========
const Hidden = 0
const WaitOnReturn = true
File ="C:\Users\Pc\cc4j5zs76kd2kj\87080.cmd"
set WshShell = CreateObject("WScript.Shell")
WshShell.Run file, Hidden, WaitOnReturn
wscript.quit
========= End of CMD: =========
==== End of Fixlog ====
Code:
ATTFilter ComboFix 14-02-12.01 - Pc 12.02.2014 19:47:01.1.6 - x64 MINIMAL
Microsoft Windows 7 Enterprise 6.1.7601.1.1252.49.1031.18.8174.7341 [GMT 1:00]
ausgeführt von:: c:\users\Pc\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
c:\cflog\EPLog.txt
C:\install.exe
c:\program files (x86)\VLC Media Player DB Toolbar Toolbar\tbHElper.dll
c:\programdata\cefbaeacdccceac.cfg
c:\programdata\cefbaeacdccceasacfsfdsf.exe
c:\programdata\libnspr4.dll
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json
c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json
c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\background.html
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\content.js
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\E4Apsx8.js
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\lsdb.js
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\manifest.json
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eimkiigpdkahjnigfhahhebfencphpll_0.localstorage
c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Pc\AppData\Roaming\Microsoft\Wcenter42.exe
c:\users\Pc\AppData\Roaming\Microsoft\Wcenter9.exe
c:\users\Pc\AppData\Roaming\poclbm130302.cl
c:\windows\SysWow64\frapsvid.dll
c:\windows\SysWow64\SET7022.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-01-12 bis 2014-02-12 ))))))))))))))))))))))))))))))
.
.
2014-02-12 18:59 . 2014-02-12 18:59 -------- d-----w- c:\users\hedev\AppData\Local\temp
2014-02-12 18:59 . 2014-02-12 18:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-12 13:12 . 2014-02-12 13:12 -------- d-----w- c:\program files (x86)\DLLSuite
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\users\Pc\AppData\Roaming\DriverCure
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\users\Pc\AppData\Roaming\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\program files (x86)\Common Files\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\programdata\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\program files (x86)\ParetoLogic
2014-02-11 21:23 . 2014-02-12 17:54 -------- d-----w- C:\FRST
2014-02-11 20:23 . 2014-02-11 21:00 -------- d-----w- c:\programdata\SecTaskMan
2014-02-11 20:22 . 2014-02-11 20:23 -------- d-----w- c:\program files (x86)\Security Task Manager
2014-02-11 20:03 . 2014-02-11 20:03 -------- d-----w- c:\users\Pc\AppData\Roaming\TestApp
2014-02-11 16:50 . 2014-02-11 16:54 -------- d-----w- c:\programdata\PC Tools
2014-02-11 15:54 . 2014-02-11 15:54 -------- d-----w- c:\programdata\SMR410
2014-02-11 15:50 . 2014-02-11 16:34 -------- d-----w- c:\users\Pc\AppData\Local\NPE
2014-02-11 15:35 . 2014-02-12 18:44 -------- d-----w- c:\program files (x86)\Norton Internet Security
2014-02-11 15:35 . 2014-02-11 20:23 -------- d-----w- c:\users\Pc\AppData\Roaming\DigitalSites
2014-02-11 15:34 . 2014-02-11 15:34 -------- d-s---w- c:\windows\SysWow64\Microsoft
2014-02-11 15:30 . 2013-12-18 20:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-11 14:59 . 2014-02-11 14:59 -------- d-----w- c:\users\Pc\AppData\Roaming\Oxy
2014-02-11 14:34 . 2014-02-11 14:34 -------- d-sh--r- c:\users\Pc\cc4j5zs76kd2kj
2014-02-04 15:14 . 2013-06-12 14:15 119888 ----a-w- c:\users\Pc\AppData\Roaming\pthreadGC2.dll
2014-02-04 15:14 . 2013-06-12 14:15 100864 ----a-w- c:\users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 14:05 . 2014-02-11 20:23 -------- d-sh--r- c:\users\Pc\aoajz
2014-02-04 12:09 . 2014-02-04 12:12 -------- d-----w- c:\users\Pc\AppData\Roaming\Riot Games
2014-02-04 11:08 . 2014-02-11 20:23 -------- d-sh--r- c:\users\Pc\xripb
2014-01-31 09:18 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BA7BA143-B6AE-460D-B6C1-7DFC7B384AA7}\mpengine.dll
2014-01-21 09:23 . 2014-02-04 11:20 -------- d-----w- c:\users\Pc\AppData\Local\CyberGhost
2014-01-21 09:22 . 2014-01-21 09:23 -------- d-----w- c:\program files\TAP-Windows
2014-01-21 09:22 . 2014-01-21 09:27 -------- d-----w- c:\program files\CyberGhost 5
2014-01-15 12:29 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 12:29 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 12:29 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 12:29 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 12:29 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 12:29 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 12:29 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 12:29 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-15 12:29 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-12 07:31 . 2012-10-19 16:25 419840 ----a-w- c:\windows\system32\systemcpl.dll
2014-02-12 07:31 . 2012-10-19 16:25 14848 ----a-w- c:\windows\system32\slwga.dll
2014-02-12 07:31 . 2012-10-19 16:25 13824 ----a-w- c:\windows\SysWow64\slwga.dll
2014-02-12 07:31 . 2012-10-19 16:25 1008640 ----a-w- c:\windows\system32\user32.dll
2014-02-12 07:31 . 2012-10-19 16:25 833024 ----a-w- c:\windows\SysWow64\user32.dll
2014-02-07 13:59 . 2012-12-10 17:25 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-07 13:59 . 2012-12-10 17:25 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-05 11:36 . 2013-12-28 10:49 291128 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2014-02-05 11:36 . 2013-08-18 16:42 291128 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-02-04 14:46 . 2013-08-18 16:42 291128 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2014-01-24 21:17 . 2013-08-18 16:42 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2014-01-16 13:24 . 2012-10-18 04:30 86054176 ----a-w- c:\windows\system32\MRT.exe
2013-12-30 13:47 . 2013-12-30 13:47 283064 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-12-18 05:13 . 2012-11-06 16:48 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-06 22:07 . 2013-12-06 22:07 78432 ----a-w- c:\windows\system32\atimpc64.dll
2013-12-06 22:07 . 2013-12-06 22:07 78432 ----a-w- c:\windows\system32\amdpcom64.dll
2013-12-06 22:07 . 2013-12-06 22:07 71704 ----a-w- c:\windows\SysWow64\atimpc32.dll
2013-12-06 22:07 . 2013-12-06 22:07 71704 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2013-12-06 22:04 . 2011-05-25 20:07 143304 ----a-w- c:\windows\system32\atiuxp64.dll
2013-12-06 22:03 . 2013-12-06 22:03 126336 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2013-12-06 22:03 . 2011-07-08 02:46 115512 ----a-w- c:\windows\system32\atiu9p64.dll
2013-12-06 22:02 . 2011-07-08 02:45 98496 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2013-12-06 22:01 . 2011-07-08 03:28 1318552 ----a-w- c:\windows\system32\aticfx64.dll
2013-12-06 22:01 . 2011-07-08 03:29 1100216 ----a-w- c:\windows\SysWow64\aticfx32.dll
2013-12-06 22:00 . 2011-07-08 03:10 9753752 ----a-w- c:\windows\system32\atidxx64.dll
2013-12-06 21:59 . 2013-12-06 21:59 8406024 ----a-w- c:\windows\SysWow64\atidxx32.dll
2013-12-06 21:59 . 2011-07-08 02:55 8287008 ----a-w- c:\windows\SysWow64\atiumdva.dll
2013-12-06 21:58 . 2011-07-08 03:00 6630232 ----a-w- c:\windows\SysWow64\atiumdag.dll
2013-12-06 21:57 . 2013-12-06 21:57 8927704 ----a-w- c:\windows\system32\atiumd6a.dll
2013-12-06 21:56 . 2013-12-06 21:56 7751920 ----a-w- c:\windows\system32\atiumd64.dll
2013-12-06 21:52 . 2013-12-06 21:52 13207552 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2013-12-06 21:38 . 2013-12-06 21:38 230912 ----a-w- c:\windows\system32\clinfo.exe
2013-12-06 21:38 . 2013-12-06 21:38 1187342 ----a-w- c:\windows\system32\amdocl_as64.exe
2013-12-06 21:38 . 2013-12-06 21:38 1061902 ----a-w- c:\windows\system32\amdocl_ld64.exe
2013-12-06 21:38 . 2013-12-06 21:38 995342 ----a-w- c:\windows\SysWow64\amdocl_as32.exe
2013-12-06 21:38 . 2013-12-06 21:38 798734 ----a-w- c:\windows\SysWow64\amdocl_ld32.exe
2013-12-06 21:38 . 2013-12-06 21:38 99840 ----a-w- c:\windows\system32\OpenVideo64.dll
2013-12-06 21:38 . 2013-12-06 21:38 83968 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2013-12-06 21:38 . 2013-12-06 21:38 86528 ----a-w- c:\windows\system32\OVDecode64.dll
2013-12-06 21:38 . 2013-12-06 21:38 73728 ----a-w- c:\windows\SysWow64\OVDecode.dll
2013-12-06 21:37 . 2013-12-06 21:37 29382144 ----a-w- c:\windows\system32\amdocl64.dll
2013-12-06 21:35 . 2013-12-06 21:35 24860160 ----a-w- c:\windows\SysWow64\amdocl.dll
2013-12-06 21:33 . 2013-12-06 21:33 63488 ----a-w- c:\windows\system32\OpenCL.dll
2013-12-06 21:33 . 2013-12-06 21:33 57344 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-12-06 21:26 . 2013-12-06 21:26 129536 ----a-w- c:\windows\system32\coinst_13.251.dll
2013-12-06 21:16 . 2013-12-06 21:16 26352128 ----a-w- c:\windows\system32\atio6axx.dll
2013-12-06 21:13 . 2013-12-06 21:13 368640 ----a-w- c:\windows\system32\atiapfxx.exe
2013-12-06 21:12 . 2013-12-06 21:12 62464 ----a-w- c:\windows\system32\aticalrt64.dll
2013-12-06 21:12 . 2013-12-06 21:12 52224 ----a-w- c:\windows\SysWow64\aticalrt.dll
2013-12-06 21:12 . 2013-12-06 21:12 55808 ----a-w- c:\windows\system32\aticalcl64.dll
2013-12-06 21:12 . 2013-12-06 21:12 49152 ----a-w- c:\windows\SysWow64\aticalcl.dll
2013-12-06 21:12 . 2013-12-06 21:12 15716352 ----a-w- c:\windows\system32\aticaldd64.dll
2013-12-06 21:09 . 2013-12-06 21:09 14302208 ----a-w- c:\windows\SysWow64\aticaldd.dll
2013-12-06 20:58 . 2013-12-06 20:58 22157824 ----a-w- c:\windows\SysWow64\atioglxx.dll
2013-12-06 20:53 . 2013-12-06 20:53 442368 ----a-w- c:\windows\system32\atidemgy.dll
2013-12-06 20:53 . 2013-12-06 20:53 31232 ----a-w- c:\windows\system32\atimuixx.dll
2013-12-06 20:53 . 2013-12-06 20:53 588288 ----a-w- c:\windows\system32\atieclxx.exe
2013-12-06 20:52 . 2013-12-06 20:52 239616 ----a-w- c:\windows\system32\atiesrxx.exe
2013-12-06 20:50 . 2013-12-06 20:50 190976 ----a-w- c:\windows\system32\atitmm64.dll
2013-12-06 20:22 . 2013-12-06 20:22 1144320 ----a-w- c:\windows\system32\atiadlxx.dll
2013-12-06 20:22 . 2013-12-06 20:22 825344 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2013-12-06 20:22 . 2013-12-06 20:22 74752 ----a-w- c:\windows\system32\atig6pxx.dll
2013-12-06 20:22 . 2013-12-06 20:22 69632 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2013-12-06 20:22 . 2013-12-06 20:22 69632 ----a-w- c:\windows\system32\atiglpxx.dll
2013-12-06 20:22 . 2013-12-06 20:22 100352 ----a-w- c:\windows\system32\atig6txx.dll
2013-12-06 20:21 . 2013-12-06 20:21 96768 ----a-w- c:\windows\SysWow64\atigktxx.dll
2013-12-06 20:21 . 2013-12-06 20:21 626176 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2013-12-06 20:18 . 2013-12-06 20:18 43520 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2013-12-06 15:49 . 2013-12-06 15:49 51200 ----a-w- c:\windows\system32\kdbsdk64.dll
2013-12-06 15:44 . 2013-12-06 15:44 38912 ----a-w- c:\windows\SysWow64\kdbsdk32.dll
2013-11-26 11:54 . 2013-12-11 23:02 23183360 ----a-w- c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-11 23:02 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-11 23:02 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-11 23:02 66048 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-11 23:02 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-11 23:02 2764288 ----a-w- c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-11 23:02 53760 ----a-w- c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-11 23:02 33792 ----a-w- c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-11 23:02 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-11 23:02 574976 ----a-w- c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-11 23:02 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-11 23:02 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-11 23:02 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-11 23:02 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-11 23:02 5769216 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-11 23:02 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-11 23:02 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-11 23:02 1995264 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-11 23:02 12996608 ----a-w- c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-11 23:02 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-11 23:02 2334208 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-11 23:02 1395200 ----a-w- c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-11 23:02 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-11 23:02 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2013-11-23 18:26 . 2013-12-11 14:34 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-11 14:34 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-19 21:07 . 2013-11-19 21:07 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-19 21:07 . 2013-11-19 21:07 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-19 21:07 . 2013-11-19 21:07 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-19 21:07 . 2013-11-19 21:07 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2010-11-05 01:58 32768 --sh--w- c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[-] 2014-02-12 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
[-] 2014-02-12 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HydraVisionMDEngine"="c:\program files (x86)\ATI Technologies\HydraVision\HydraMD.exe" [2011-07-07 569344]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-07-07 393216]
"Load"="c:\users\Pc\AppData\Roaming\vbc.exe" [2010-11-05 1169224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]
"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"PCTools FGuard"="c:\program files (x86)\PC Tools Security\BDT\FGuard.exe" [2011-09-01 247760]
.
c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
start.lnk - c:\users\Pc\cc4j5zs76kd2kj\92050.vbs [2014-2-11 190]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys;c:\windows\SYSNATIVE\Drivers\PCTSD64.sys [x]
R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
R2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]
R2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files (x86)\PC Tools Security\BDT\BDTUpdateService.exe;c:\program files (x86)\PC Tools Security\BDT\BDTUpdateService.exe [x]
R2 CGVPNCliService;CyberGhost 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 e81a9dc1;GS-Supporter;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]
R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
R2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [x]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 ArcService;Arc Service;c:\users\Pc\Desktop\ArcService.exe;c:\users\Pc\Desktop\ArcService.exe [x]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 hxctlflt;hxctlflt;c:\windows\system32\Drivers\hxctlflt.sys;c:\windows\SYSNATIVE\Drivers\hxctlflt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 RTL85n64;Realtek 8180/8185 Extensible 802.11-Drahtlosgerätetreiber;c:\windows\system32\DRIVERS\RTL85n64.sys;c:\windows\SYSNATIVE\DRIVERS\RTL85n64.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]
R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]
R3 X6va015;X6va015;c:\windows\SysWOW64\Drivers\X6va015;c:\windows\SysWOW64\Drivers\X6va015 [x]
R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]
R4 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]
R4 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R4 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys;c:\windows\SYSNATIVE\drivers\PCTCore64.sys [x]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys;c:\windows\SYSNATIVE\drivers\pctDS64.sys [x]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys;c:\windows\SYSNATIVE\drivers\pctEFA64.sys [x]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S4 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1501000.012\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMDS64.SYS [x]
S4 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1501000.012\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMEFA64.SYS [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 15:20 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-05 13:59]
.
2014-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]
.
2014-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]
.
2014-02-12 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2014-02-12 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:51]
.
2014-02-12 c:\windows\Tasks\PC Health Advisor Defrag.job
- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
2014-02-12 c:\windows\Tasks\PC Health Advisor.job
- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-04-11 03:35 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-04-11 03:35 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-20 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-20 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-20 418328]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
IE: Mit Mipony herunterladen - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: aeriagames.com
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} -
FF - ProfilePath - c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-12-18 17:14; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - user.js: extensions.ividi.tlbrSrchUrl - hxxp://search.ividi.org/?src=tbsp&id=2895594900000000000000240103dca8&affilt=3&q=
FF - user.js: extensions.ividi.id - 2895594900000000000000240103dca8
FF - user.js: extensions.ividi.appId - {685F23D9-FCFD-475C-B56A-362645945C5A}
FF - user.js: extensions.ividi.instlDay - 15989
FF - user.js: extensions.ividi.vrsn - 1.8.23.0
FF - user.js: extensions.ividi.vrsni - 1.8.23.0
FF - user.js: extensions.ividi.vrsnTs - 1.8.23.014:19
FF - user.js: extensions.ividi.prtnrId - ividi
FF - user.js: extensions.ividi.prdct - ividi
FF - user.js: extensions.ividi.aflt - 3
FF - user.js: extensions.ividi.smplGrp - none
FF - user.js: extensions.ividi.tlbrId - base
FF - user.js: extensions.ividi.instlRef -
FF - user.js: extensions.ividi.dfltLng -
FF - user.js: extensions.ividi.excTlbr - true
FF - user.js: extensions.ividi.ffxUnstlRst - false
FF - user.js: extensions.ividi.admin - false
FF - user.js: extensions.ividi.autoRvrt - false
FF - user.js: extensions.ividi.rvrt - false
FF - user.js: extensions.ividi.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\Pc\AppData\Local\Akamai\netsession_win.exe
Wow6432Node-HKCU-Run-Wcenter - c:\users\Pc\AppData\Roaming\Microsoft\Wcenter9.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - c:\programdata\FuNDeaulls\DD2qL.x64.dll
BHO-{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - c:\programdata\50Coeuupons\gKoa.x64.dll
AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.8.3.8\uninstall.exe
AddRemove-BattleForGraxia - c:\users\Pc\Desktop\uninstall.exe
AddRemove-Roma Surrectum Deutsch 1.1.0.5 - c:\program files (x86)\Activision\Rome - Total War\Mods\Uninstall.exe
AddRemove-Roma Surrectum II - c:\program files (x86)\Activision\Rome - Total War\Mods\uninst.exe
AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe
AddRemove-Special Force 2 Beta_is1 - c:\program files (x86)\SpecialForce2Beta\unins000.exe
AddRemove-YTKaraoke@DacSoft.org - c:\program files (x86)\YTKaraoke\uninstall.exe
AddRemove-{478472F9-9E09-492A-BDAB-42EE595EF1AD} - c:\programdata\FuNDeaulls\DD2qL.exe
AddRemove-{4820778D-AB0D-6D18-C316-52A6A0E1D507} - c:\programdata\YoutubeAdblocker\TWJ1VQCit.exe
AddRemove-{5F189DF5-2D05-472B-9091-84D9848AE48B}{e81a9dc1} - c:\progra~2\GS-ENA~1\Browsafe.dll
AddRemove-{74A84478-70A5-4F7A-966C-FA2771FF91A5}_is1 - c:\users\Pc\Desktop\Downloads\Cracks\Die Gilde\Die Gilde 2 - King Edition\unins000.exe
AddRemove-{A35CA8FF-CB7D-8361-1CB9-83219CD11C78} - c:\programdata\surf aand kEEp\3Lwcvkkk.exe
AddRemove-3942161475.portal.qtrax.com - c:\program files (x86)\Microsoft Silverlight\5.1.20513.0\Silverlight.Configuration.exe
AddRemove-ExpressFiles - c:\program files (x86)\ExpressFiles\uninstall.exe
AddRemove-Qtrax Connection Manager - c:\users\Pc\Qtrax\Player\uninstallnotification.exe
AddRemove-{56837588-F559-40CF-91D9-D439D405FB28} - c:\users\Pc\AppData\Local\Temp\Download_B1D1\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va012]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va013]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va013"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va015]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va015"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\SecuROM\License information*]
"datasecu"=hex:43,48,2f,01,a8,3f,a0,25,9e,c0,d9,1e,5e,c3,db,5d,ba,eb,05,e2,2e,
74,eb,bc,e8,2e,42,2e,69,b5,96,e7,8d,49,8b,bc,8b,14,15,6d,cb,54,62,ae,12,f4,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}]
@DACL=(02 0000)
@="Pokki"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-02-12 20:03:01
ComboFix-quarantined-files.txt 2014-02-12 19:03
.
Vor Suchlauf: 22 Verzeichnis(se), 271.743.991.808 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 273.505.619.968 Bytes frei
.
- - End Of File - - 830E141AC8CF0E9AC9EBF08F048DC385
A36C5E4F47E84449FF07ED3517B43A31
Code:
ATTFilter Farbar Service Scanner Version: 02-02-2014
Ran by Pc (administrator) on 12-02-2014 at 20:14:06
Running from "C:\Users\Pc\Desktop"
Microsoft Windows 7 Enterprise Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is set to Disabled. The default start type is Auto.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
 Immerhin sind viele der Fehler nun verschwunden.Mir ist gerade auch aufgefallen, das svchost.exe laut Taskmanager 15 Mal geöffnet ist. Das kann doch nicht normal sein oder? |
|
13.02.2014, 07:01
| #6 | |
| /// Malwareteam | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung.Zitat:
.Schritt 1 Combofix-Skript
Schritt 2 Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
Schritt 3 Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
Schritt 4 Starte noch einmal FRST.
Poste folgende Logfiles in deiner nächsten Antwort:
__________________ --> TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. |
|
13.02.2014, 14:55
| #7 |
| | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. FRST-log FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2014 01
Ran by Pc (administrator) on PC-PC on 13-02-2014 14:50:23
Running from C:\Users\Pc\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2013-12-20] (APN)
HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=f0e6090c-d942-4ce4-94f4-095b9a73bb7a&searchtype=ds&q={searchTerms}&installDate=07/04/2013
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=289500240103DCA8&affID=121963&tsp=4980
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.0.0\ViProtocol.dll No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566
FF user.js: detected! => C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js
FF NewTab: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\\npsitesafety.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
FF HKLM\...\Firefox\Extensions: [{77BEC163-D389-42c1-91A4-C758846296A5}] - C:\Program Files\Video downloader\Firefox
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]
CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]
CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]
CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]
CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [fmfnfnpmhcllokmkepffndflpnadjmma] - C:\Program Files (x86)\DealPly\DealPly.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Pc\AppData\Local\Wajam\Chrome\wajam.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [khialnikbocfgkohdegnebhmmaifoglp] - C:\Program Files (x86)\LyricsMonkey\Chrome.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx [2013-02-10]
CHR HKLM-x32\...\Chrome\Extension: [pcoohmdcpejoeggdnihdfhohjgdbllgm] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7C\CRX\ToolbarCR.crx [2013-12-20]
CHR HKLM-x32\...\Chrome\Extension: [pggagllhehfjjfgnfnfkjedjlmbchamf] - C:\Users\Pc\AppData\Roaming\SeeSimilar\SeeSimilar.crx [2013-06-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
S2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)
R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-13 14:50 - 2014-02-13 14:50 - 00022053 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-13 14:50 - 2014-02-13 14:50 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-13 14:30 - 2014-02-13 14:30 - 00043125 _____ () C:\Users\Pc\Desktop\ComboFix.txt.txt
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\APN
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:18 - 2014-02-13 14:17 - 00109188 _____ () C:\Windows\PFRO.log
2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 21:00 - 2014-02-13 14:17 - 00003808 _____ () C:\Windows\setupact.log
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox
2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt
2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:51 - 2014-02-12 19:01 - 00000436 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job
2014-02-12 13:51 - 2014-02-12 19:01 - 00000394 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job
2014-02-12 13:51 - 2014-02-12 19:01 - 00000376 _____ () C:\Windows\Tasks\PC Health Advisor.job
2014-02-12 13:51 - 2014-02-12 18:00 - 00000462 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-02-12 13:51 - 2014-02-12 13:51 - 00003284 _____ () C:\Windows\System32\Tasks\PC Health Advisor
2014-02-12 13:51 - 2014-02-12 13:51 - 00003264 _____ () C:\Windows\System32\Tasks\PC Health Advisor Defrag
2014-02-12 13:51 - 2014-02-12 13:51 - 00003246 _____ () C:\Windows\System32\Tasks\ParetoLogic Update Version3
2014-02-12 13:51 - 2014-02-12 13:51 - 00003120 _____ () C:\Windows\System32\Tasks\ParetoLogic Registration3
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DriverCure
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\ProgramData\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Program Files (x86)\ParetoLogic
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-11 22:27 - 2014-02-13 13:49 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:23 - 2014-02-13 14:50 - 00000000 ____D () C:\FRST
2014-02-11 22:22 - 2014-02-13 14:50 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-04 13:09 - 2014-02-04 13:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
2014-02-13 14:50 - 2014-02-13 14:50 - 00022053 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-13 14:50 - 2014-02-13 14:50 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 14:50 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST
2014-02-13 14:50 - 2014-02-11 22:22 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:30 - 2014-02-13 14:30 - 00043125 _____ () C:\Users\Pc\Desktop\ComboFix.txt.txt
2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 14:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-13 14:21 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-13 14:17 - 2014-02-12 21:18 - 00109188 _____ () C:\Windows\PFRO.log
2014-02-13 14:17 - 2014-02-12 21:00 - 00003808 _____ () C:\Windows\setupact.log
2014-02-13 14:17 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-13 14:17 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt
2014-02-13 14:16 - 2011-05-10 01:27 - 01970707 _____ () C:\Windows\WindowsUpdate.log
2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-13 13:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-13 13:49 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\APN
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-12 21:07 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat
2014-02-12 21:07 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat
2014-02-12 21:07 - 2009-07-14 06:13 - 01625030 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe
2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-12 20:52 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0
2014-02-12 20:52 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps
2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar
2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-12 19:01 - 2014-02-12 13:51 - 00000436 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job
2014-02-12 19:01 - 2014-02-12 13:51 - 00000394 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job
2014-02-12 19:01 - 2014-02-12 13:51 - 00000376 _____ () C:\Windows\Tasks\PC Health Advisor.job
2014-02-12 18:00 - 2014-02-12 13:51 - 00000462 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job
2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames
2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:51 - 2014-02-12 13:51 - 00003284 _____ () C:\Windows\System32\Tasks\PC Health Advisor
2014-02-12 13:51 - 2014-02-12 13:51 - 00003264 _____ () C:\Windows\System32\Tasks\PC Health Advisor Defrag
2014-02-12 13:51 - 2014-02-12 13:51 - 00003246 _____ () C:\Windows\System32\Tasks\ParetoLogic Update Version3
2014-02-12 13:51 - 2014-02-12 13:51 - 00003120 _____ () C:\Windows\System32\Tasks\ParetoLogic Registration3
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DriverCure
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\ProgramData\ParetoLogic
2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Program Files (x86)\ParetoLogic
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband
2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2
2014-02-12 08:37 - 2013-07-30 17:38 - 00000000 ____D () C:\Program Files (x86)\ExpressFiles
2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:21 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc
2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 21:23 - 2014-02-04 15:05 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-11 21:23 - 2014-02-04 12:08 - 00000000 _RSHD () C:\Users\Pc\xripb
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\50Coeuupons
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki
2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG
2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite
2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent
2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype
2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt
2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:12 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-04 13:11 - 2012-10-28 14:16 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele
2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}
2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment
2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify
2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify
2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler
2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Pc\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-11 14:00
==================== End Of Log ============================
--- --- --- |
|
13.02.2014, 14:56
| #8 |
| | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. TDSS Killer Code:
ATTFilter 14:36:53.0573 0x0a60 TDSS rootkit removing tool 3.0.0.23 Feb 10 2014 23:32:41
14:36:59.0508 0x0a60 ============================================================
14:36:59.0508 0x0a60 Current date / time: 2014/02/13 14:36:59.0508
14:36:59.0508 0x0a60 SystemInfo:
14:36:59.0509 0x0a60
14:36:59.0509 0x0a60 OS Version: 6.1.7601 ServicePack: 1.0
14:36:59.0509 0x0a60 Product type: Workstation
14:36:59.0509 0x0a60 ComputerName: PC-PC
14:36:59.0509 0x0a60 UserName: Pc
14:36:59.0509 0x0a60 Windows directory: C:\Windows
14:36:59.0509 0x0a60 System windows directory: C:\Windows
14:36:59.0509 0x0a60 Running under WOW64
14:36:59.0509 0x0a60 Processor architecture: Intel x64
14:36:59.0509 0x0a60 Number of processors: 6
14:36:59.0509 0x0a60 Page size: 0x1000
14:36:59.0509 0x0a60 Boot type: Normal boot
14:36:59.0509 0x0a60 ============================================================
14:37:01.0406 0x0a60 KLMD registered as C:\Windows\system32\drivers\51328195.sys
14:37:01.0680 0x0a60 System UUID: {DEC507E8-EDE3-9F56-1156-8E1600A46CA9}
14:37:02.0858 0x0a60 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
14:37:02.0873 0x0a60 ============================================================
14:37:02.0873 0x0a60 \Device\Harddisk0\DR0:
14:37:02.0874 0x0a60 MBR partitions:
14:37:02.0874 0x0a60 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
14:37:02.0874 0x0a60 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D4000
14:37:02.0874 0x0a60 ============================================================
14:37:02.0898 0x0a60 C: <-> \Device\Harddisk0\DR0\Partition2
14:37:02.0899 0x0a60 ============================================================
14:37:02.0899 0x0a60 Initialize success
14:37:02.0899 0x0a60 ============================================================
14:38:06.0932 0x09b4 ============================================================
14:38:06.0932 0x09b4 Scan started
14:38:06.0932 0x09b4 Mode: Manual; SigCheck; TDLFS;
14:38:06.0932 0x09b4 ============================================================
14:38:06.0932 0x09b4 KSN ping started
14:38:20.0801 0x09b4 KSN ping finished: true
14:38:21.0705 0x09b4 ================ Scan system memory ========================
14:38:21.0705 0x09b4 System memory - ok
14:38:21.0705 0x09b4 ================ Scan services =============================
14:38:21.0893 0x09b4 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
14:38:22.0064 0x09b4 1394ohci - ok
14:38:22.0142 0x09b4 [ A3769020F7E8A70FD3E824C050F33306, BAAB18DD28C753EC90E9552BD5FFC316AD8815505A7998BCE51D21448B373D86 ] acedrv11 C:\Windows\system32\drivers\acedrv11.sys
14:38:22.0220 0x09b4 acedrv11 - ok
14:38:22.0267 0x09b4 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
14:38:22.0314 0x09b4 ACPI - ok
14:38:22.0345 0x09b4 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
14:38:22.0407 0x09b4 AcpiPmi - ok
14:38:22.0532 0x09b4 [ ADDA5E1951B90D3D23C56D3CF0622ADC, E85E7BFD29F00ED34BF5BE8BD4DA93CBB14278E16809BB55406875F0DA88551E ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
14:38:22.0563 0x09b4 AdobeARMservice - ok
14:38:22.0735 0x09b4 [ C8C6C0D659734FDBF63F6F421A5416BC, 11C452D77D0A8A5E430D0D0C9949797FFC03D2E3DADB8FBB9B63EDA868AFF83C ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
14:38:22.0766 0x09b4 AdobeFlashPlayerUpdateSvc - ok
14:38:22.0813 0x09b4 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
14:38:22.0891 0x09b4 adp94xx - ok
14:38:22.0938 0x09b4 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
14:38:22.0985 0x09b4 adpahci - ok
14:38:23.0031 0x09b4 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
14:38:23.0063 0x09b4 adpu320 - ok
14:38:23.0109 0x09b4 [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
14:38:23.0203 0x09b4 AeLookupSvc - ok
14:38:23.0265 0x09b4 [ 79059559E89D06E8B80CE2944BE20228, 6E041D2FED2D0C3D8E16E56CB61D3245F9144EA92F5BDC9A4AA30598D1C8E6EE ] AFD C:\Windows\system32\drivers\afd.sys
14:38:23.0375 0x09b4 AFD - ok
14:38:23.0406 0x09b4 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
14:38:23.0437 0x09b4 agp440 - ok
14:38:23.0765 0x09b4 [ BBE9054FDADC8D49D29C5DA4FB84A803, 4315C1D7DBD35A80E25F15B45587AA76F6E9FCDC617B5ABF62301570771066AF ] Akamai c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll
14:38:23.0765 0x09b4 Suspicious file ( Hidden ): c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll. md5: BBE9054FDADC8D49D29C5DA4FB84A803, sha256: 4315C1D7DBD35A80E25F15B45587AA76F6E9FCDC617B5ABF62301570771066AF
14:38:23.0780 0x09b4 Akamai - detected HiddenFile.Multi.Generic ( 1 )
14:38:24.0014 0x09b4 Akamai ( HiddenFile.Multi.Generic ) - warning
14:38:26.0853 0x09b4 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
14:38:26.0931 0x09b4 ALG - ok
14:38:26.0963 0x09b4 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
14:38:26.0994 0x09b4 aliide - ok
14:38:27.0087 0x09b4 [ 66B54471B5856E314947881E28263A6D, 2D60706B52A2CE98FF806337D62CD010C1DEB2AEDDF899C7B67173928B2D7C4C ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
14:38:27.0165 0x09b4 AMD External Events Utility - ok
14:38:27.0259 0x09b4 AMD FUEL Service - ok
14:38:27.0306 0x09b4 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
14:38:27.0337 0x09b4 amdide - ok
14:38:27.0384 0x09b4 [ 6A2EEB0C4133B20773BB3DD0B7B377B4, E4CB35C6937C70A145A13E5AE5B34A271B49101DA623171ACBFDA8601E5A70EA ] amdiox64 C:\Windows\system32\DRIVERS\amdiox64.sys
14:38:27.0415 0x09b4 amdiox64 - ok
14:38:27.0446 0x09b4 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
14:38:27.0509 0x09b4 AmdK8 - ok
14:38:28.0320 0x09b4 [ FBB35875FEFE53D4280259842069ED72, B1A1B5799A6C50C244182CD201A1E9FCB7BE3B5ED4BB2E2E6BCF8E1BF53B75DB ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys
14:38:29.0287 0x09b4 amdkmdag - ok
14:38:29.0427 0x09b4 [ A32BCAD9377E3B75D034CAFBA463A0AE, F504895D9C9CD1B4607806BCAF15A1CBFBAC2E5824903277A1350C9F35045602 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys
14:38:29.0521 0x09b4 amdkmdap - ok
14:38:29.0552 0x09b4 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
14:38:29.0599 0x09b4 AmdPPM - ok
14:38:29.0646 0x09b4 [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\Windows\system32\drivers\amdsata.sys
14:38:29.0693 0x09b4 amdsata - ok
14:38:29.0724 0x09b4 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
14:38:29.0771 0x09b4 amdsbs - ok
14:38:29.0802 0x09b4 [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\Windows\system32\drivers\amdxata.sys
14:38:29.0817 0x09b4 amdxata - ok
14:38:29.0895 0x09b4 [ B9C95291F5EA1072CEC2BA690E07F29F, 1FC75E20B31680667A5FE4E0AB5ADD6CFE7016A3B9E975E92EAA192689684E54 ] AMD_RAIDXpert C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
14:38:29.0942 0x09b4 AMD_RAIDXpert - detected UnsignedFile.Multi.Generic ( 1 )
14:38:29.0942 0x09b4 AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - warning
14:38:32.0781 0x09b4 [ 4DE0D5D747A73797C95A97DCCE5018B5, 17EC669675C2E43515EFE2D8BCC9DDFFBE64F99EBFB9A6DAB429F65A2B504560 ] androidusb C:\Windows\system32\Drivers\ssadadb.sys
14:38:32.0828 0x09b4 androidusb - ok
14:38:33.0047 0x09b4 [ 67402A0D0554DAF40E421DE34F5E295A, FDCE8B04DFABAC428636533F5A446C47607DC8F8DC04E3156450FBF0696B85AB ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
14:38:33.0109 0x09b4 AntiVirMailService - ok
14:38:33.0187 0x09b4 [ FE79366FECD444A16CCA9979134DBEA8, 91D2301E35C89B9FAD5680124EA51DC346159DC78556ACCD935F9B236B9FDCBC ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
14:38:33.0234 0x09b4 AntiVirSchedulerService - ok
14:38:33.0281 0x09b4 [ FDE9C7030FB1E9E2715E113EE6A10F90, 541F278D743C34C6D9940FC1250B90674EB88EC429D481012F27817DAB1B557A ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
14:38:33.0327 0x09b4 AntiVirService - ok
14:38:33.0405 0x09b4 [ 8D69B1551F51E18AE12E01DE6A2050EA, E1BF3E1AB82E90DC32811C934933D761340DAE44B7ACDF3B9C19725465BE3590 ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
14:38:33.0483 0x09b4 AntiVirWebService - ok
14:38:33.0546 0x09b4 [ E8CCB797DAF80779C768BD3A9FC8FCAF, 781BD878CA34D8B6D2FE238439CD173E95449260428859BEA92866D41B1284F4 ] AODDriver4.2.0 C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
14:38:33.0577 0x09b4 AODDriver4.2.0 - ok
14:38:33.0655 0x09b4 [ B342CD9AA44E4AE99E2368EBDBC2E17A, C3081358313A982F53CAD54C214AFECAD9660A59FB4A3DDFE068724E83041AF8 ] APNMCP C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
14:38:33.0686 0x09b4 APNMCP - ok
14:38:33.0733 0x09b4 [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID C:\Windows\system32\drivers\appid.sys
14:38:33.0842 0x09b4 AppID - ok
14:38:33.0873 0x09b4 [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc C:\Windows\System32\appidsvc.dll
14:38:33.0983 0x09b4 AppIDSvc - ok
14:38:34.0014 0x09b4 [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
14:38:34.0061 0x09b4 Appinfo - ok
14:38:34.0107 0x09b4 [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt C:\Windows\System32\appmgmts.dll
14:38:34.0170 0x09b4 AppMgmt - ok
14:38:34.0201 0x09b4 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\DRIVERS\arc.sys
14:38:34.0248 0x09b4 arc - ok
14:38:34.0263 0x09b4 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
14:38:34.0310 0x09b4 arcsas - ok
14:38:34.0373 0x09b4 ArcService - ok
14:38:34.0482 0x09b4 [ FEF9DD9EA587F8886ADE43C1BEFBDAFE, DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8 ] AsIO C:\Windows\syswow64\drivers\AsIO.sys
14:38:34.0513 0x09b4 AsIO - ok
14:38:34.0575 0x09b4 [ 718692FFF22D6AF47EBA0A741A924921, 01E462C868B9DB635F8D0D6FCA1B312FF4C3BE8EE9E4103B4B0406329767D02D ] asmthub3 C:\Windows\system32\DRIVERS\asmthub3.sys
14:38:34.0653 0x09b4 asmthub3 - ok
14:38:34.0716 0x09b4 [ BAD70A5AC534C108F680A33C654BC626, 994FC917A2C737EAAD5A5F98056D56800AD8C0F3B43C7227B9888DE4DC3428CE ] asmtxhci C:\Windows\system32\DRIVERS\asmtxhci.sys
14:38:34.0778 0x09b4 asmtxhci - ok
14:38:34.0919 0x09b4 [ 108FB6DDB69E537A2EA53F425363FAE5, B12A9F5338D39805E08A44A335FF7AA77F2266F535A2F5C8412CC746C75E5B1D ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
14:38:34.0965 0x09b4 aspnet_state - ok
14:38:35.0043 0x09b4 [ 954FFBFF05B0B60EB63B52AF561436C4, 40228A2B688E827815B5A567584FCF99BF661696DB8CC8BB455393B3CEE35094 ] AsSysCtrlService C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
14:38:35.0075 0x09b4 AsSysCtrlService - ok
14:38:35.0090 0x09b4 [ 26D66E32E78D3059715B3A17BC679CD9, 5039CB81CE0829C5F3DED16A4005FEB10141C6C9B473CC319E81BAF6D1DA33E3 ] AsUpIO C:\Windows\syswow64\drivers\AsUpIO.sys
14:38:35.0121 0x09b4 AsUpIO - ok
14:38:35.0153 0x09b4 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
14:38:35.0246 0x09b4 AsyncMac - ok
14:38:35.0277 0x09b4 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
14:38:35.0309 0x09b4 atapi - ok
14:38:35.0355 0x09b4 [ 770A3B0D78232B0C1054495392A1FBA3, 733BB08BAFE42E848F3A3CDFD80A2C37DB829CAD2E18B3D6299FDEE6EF30C9CD ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
14:38:35.0418 0x09b4 AtiHDAudioService - ok
14:38:35.0449 0x09b4 [ C07A040D6B5A42DD41EE386CF90974C8, 8D47815F99C79B795504C3172B5FBBDBA6AFACC004B17AA3954A06BE713FACAE ] AtiPcie C:\Windows\system32\DRIVERS\AtiPcie.sys
14:38:35.0465 0x09b4 AtiPcie - ok
14:38:35.0543 0x09b4 [ 4AEF9EC86818375495FB78CA58DF4E18, 0565888F798FAB86091E7A7D8E1D583DF3CC5756A12ACF04987C67C14E360DFB ] atksgt C:\Windows\system32\DRIVERS\atksgt.sys
14:38:35.0589 0x09b4 atksgt - detected UnsignedFile.Multi.Generic ( 1 )
14:38:35.0589 0x09b4 atksgt ( UnsignedFile.Multi.Generic ) - warning
14:38:38.0725 0x09b4 [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:38:38.0850 0x09b4 AudioEndpointBuilder - ok
14:38:38.0881 0x09b4 [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv C:\Windows\System32\Audiosrv.dll
14:38:39.0006 0x09b4 AudioSrv - ok
14:38:39.0084 0x09b4 [ 7806BFCD1D7FA5EC23F7324D4EAFD25B, 4EDFD9DE520728AF6578BED0054ED6A4976A7F020F3329EA6681D6E361D9DB2D ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
14:38:39.0115 0x09b4 avgntflt - ok
14:38:39.0162 0x09b4 [ 4A175D2D30D31F7DF46F09B9A108E089, 6167D4E319B47C9759231EDEDF7F4199196CCDD332E8DB2137872FB15699B9F8 ] avgtp C:\Windows\system32\drivers\avgtpx64.sys
14:38:39.0193 0x09b4 avgtp - ok
14:38:39.0240 0x09b4 [ C3A58DBD18786C338126D30BF8C33D72, 4DF4D37AB5139548C2DA4B4C8D6B933A7F4ED001BCA089EFBC8C57EEDE8785A6 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
14:38:39.0271 0x09b4 avipbb - ok
14:38:39.0302 0x09b4 [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
14:38:39.0318 0x09b4 avkmgr - ok
14:38:39.0349 0x09b4 [ 3DE0EBA0BF4771C897F544CBF7CB8973, 6A032503561414EDCE0D123947AECACBAFE4BBF7D9849BA2DF010E28235973AB ] avnetflt C:\Windows\system32\DRIVERS\avnetflt.sys
14:38:39.0380 0x09b4 avnetflt - ok
14:38:39.0427 0x09b4 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
14:38:39.0521 0x09b4 AxInstSV - ok
14:38:39.0567 0x09b4 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
14:38:39.0661 0x09b4 b06bdrv - ok
14:38:39.0692 0x09b4 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
14:38:39.0770 0x09b4 b57nd60a - ok
14:38:39.0817 0x09b4 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
14:38:39.0879 0x09b4 BDESVC - ok
14:38:39.0895 0x09b4 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
14:38:39.0989 0x09b4 Beep - ok
14:38:40.0082 0x09b4 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
14:38:40.0160 0x09b4 BFE - ok
14:38:40.0238 0x09b4 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\system32\qmgr.dll
14:38:40.0379 0x09b4 BITS - ok
14:38:40.0410 0x09b4 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
14:38:40.0472 0x09b4 blbdrive - ok
14:38:40.0488 0x09b4 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
14:38:40.0535 0x09b4 bowser - ok
14:38:40.0566 0x09b4 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
14:38:40.0628 0x09b4 BrFiltLo - ok
14:38:40.0659 0x09b4 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
14:38:40.0691 0x09b4 BrFiltUp - ok
14:38:40.0722 0x09b4 [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
14:38:40.0815 0x09b4 BridgeMP - ok
14:38:40.0847 0x09b4 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
14:38:40.0878 0x09b4 Browser - ok
14:38:40.0909 0x09b4 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
14:38:40.0987 0x09b4 Brserid - ok
14:38:41.0018 0x09b4 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
14:38:41.0081 0x09b4 BrSerWdm - ok
14:38:41.0096 0x09b4 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
14:38:41.0143 0x09b4 BrUsbMdm - ok
14:38:41.0174 0x09b4 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
14:38:41.0205 0x09b4 BrUsbSer - ok
14:38:41.0252 0x09b4 [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum C:\Windows\system32\DRIVERS\BthEnum.sys
14:38:41.0315 0x09b4 BthEnum - ok
14:38:41.0330 0x09b4 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
14:38:41.0393 0x09b4 BTHMODEM - ok
14:38:41.0439 0x09b4 [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
14:38:41.0486 0x09b4 BthPan - ok
14:38:41.0549 0x09b4 [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT C:\Windows\system32\Drivers\BTHport.sys
14:38:41.0642 0x09b4 BTHPORT - ok
14:38:41.0689 0x09b4 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
14:38:41.0798 0x09b4 bthserv - ok
14:38:41.0829 0x09b4 [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB C:\Windows\system32\Drivers\BTHUSB.sys
14:38:41.0876 0x09b4 BTHUSB - ok
14:38:41.0892 0x09b4 catchme - ok
14:38:41.0923 0x09b4 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
14:38:42.0017 0x09b4 cdfs - ok
14:38:42.0079 0x09b4 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
14:38:42.0141 0x09b4 cdrom - ok
14:38:42.0188 0x09b4 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
14:38:42.0282 0x09b4 CertPropSvc - ok
14:38:42.0407 0x09b4 [ 7B4AA3F4435950130BC0D9AC6F32DF36, 72EA4DC369145F00F45CC3D0BD3821DBBF0B46E59CDC7FE5C0E2C829C603BB8F ] CGVPNCliService C:\Program Files\CyberGhost 5\Service.exe
14:38:42.0422 0x09b4 CGVPNCliService - ok
14:38:42.0469 0x09b4 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
14:38:42.0516 0x09b4 circlass - ok
14:38:42.0563 0x09b4 [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS C:\Windows\system32\CLFS.sys
14:38:42.0609 0x09b4 CLFS - ok
14:38:42.0656 0x09b4 [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:38:42.0687 0x09b4 clr_optimization_v2.0.50727_32 - ok
14:38:42.0719 0x09b4 [ D1CEEA2B47CB998321C579651CE3E4F8, 654013B8FD229A50017B08DEC6CA19C7DDA8CE0771260E057A92625201D539B1 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
14:38:42.0765 0x09b4 clr_optimization_v2.0.50727_64 - ok
14:38:42.0843 0x09b4 [ 6D7C8A951AF6AD6835C029B3CB88D333, 66F3D79887B2449B4C6912D1A258D1A96056888F51A8AA24FEDF37942AD5BDBB ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:38:42.0875 0x09b4 clr_optimization_v4.0.30319_32 - ok
14:38:42.0937 0x09b4 [ 86329C35FF23CFEF0FB6C0023BA06BCE, D915CE7AD564F97A1C3B047D5248B7EF67ADDC59687FBC90F1776C21DAA0D3FD ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
14:38:42.0984 0x09b4 clr_optimization_v4.0.30319_64 - ok
14:38:43.0015 0x09b4 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
14:38:43.0062 0x09b4 CmBatt - ok
14:38:43.0109 0x09b4 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
14:38:43.0140 0x09b4 cmdide - ok
14:38:43.0218 0x09b4 [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG C:\Windows\system32\Drivers\cng.sys
14:38:43.0280 0x09b4 CNG - ok
14:38:43.0296 0x09b4 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
14:38:43.0327 0x09b4 Compbatt - ok
14:38:43.0374 0x09b4 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
14:38:43.0436 0x09b4 CompositeBus - ok
14:38:43.0452 0x09b4 COMSysApp - ok
14:38:43.0577 0x09b4 [ 3CA734CE373E5675FBC15CA2C45228E5, A6C6E9FABDE5EA18D266DB71C0CC6B51D682116D1898CCB4E9BA730F15C44B32 ] cpudrv64 C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys
14:38:43.0608 0x09b4 cpudrv64 - ok
14:38:43.0639 0x09b4 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
14:38:43.0670 0x09b4 crcdisk - ok
14:38:43.0717 0x09b4 [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc C:\Windows\system32\cryptsvc.dll
14:38:43.0764 0x09b4 CryptSvc - ok
14:38:43.0826 0x09b4 [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC C:\Windows\system32\drivers\csc.sys
14:38:43.0904 0x09b4 CSC - ok
14:38:43.0982 0x09b4 [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService C:\Windows\System32\cscsvc.dll
14:38:44.0076 0x09b4 CscService - ok
14:38:44.0154 0x09b4 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
14:38:44.0279 0x09b4 DcomLaunch - ok
14:38:44.0310 0x09b4 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
14:38:44.0435 0x09b4 defragsvc - ok
14:38:44.0497 0x09b4 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
14:38:44.0575 0x09b4 DfsC - ok
14:38:44.0622 0x09b4 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
14:38:44.0684 0x09b4 Dhcp - ok
14:38:44.0700 0x09b4 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
14:38:44.0840 0x09b4 discache - ok
14:38:44.0934 0x09b4 [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\DRIVERS\disk.sys
14:38:44.0965 0x09b4 Disk - ok
14:38:45.0012 0x09b4 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
14:38:45.0059 0x09b4 Dnscache - ok
14:38:45.0105 0x09b4 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
14:38:45.0230 0x09b4 dot3svc - ok
14:38:45.0293 0x09b4 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
14:38:45.0386 0x09b4 DPS - ok
14:38:45.0433 0x09b4 [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
14:38:45.0480 0x09b4 drmkaud - ok
14:38:45.0542 0x09b4 [ 6A0E850DDCB136AA3D2FB7234382DF12, C01863E95F45E1B74AC65C9CD12C8DC769299218255B3C94E3EBF58C4D79FEF3 ] dtsoftbus01 C:\Windows\system32\DRIVERS\dtsoftbus01.sys
14:38:45.0573 0x09b4 dtsoftbus01 - ok
14:38:45.0683 0x09b4 [ 88612F1CE3BF42256913BF6E61C70D52, 7CF190F83FA8F15C33008EB381D3E345CEF37CBC046227DED26B36799EF4D9A7 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
14:38:45.0776 0x09b4 DXGKrnl - ok
14:38:45.0807 0x09b4 [ DD81D91FF3B0763C392422865C9AC12E, F5691B8F200E3196E6808E932630E862F8F26F31CD949981373F23C9D87DB8B9 ] e81a9dc1 C:\Windows\system32\rundll32.exe
14:38:45.0854 0x09b4 e81a9dc1 - ok
14:38:45.0885 0x09b4 EagleX64 - ok
14:38:45.0932 0x09b4 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
14:38:46.0026 0x09b4 EapHost - ok
14:38:46.0244 0x09b4 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
14:38:46.0541 0x09b4 ebdrv - ok
14:38:46.0572 0x09b4 [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] EFS C:\Windows\System32\lsass.exe
14:38:46.0619 0x09b4 EFS - ok
14:38:46.0681 0x09b4 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
14:38:46.0790 0x09b4 ehRecvr - ok
14:38:46.0821 0x09b4 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
14:38:46.0884 0x09b4 ehSched - ok
14:38:46.0931 0x09b4 [ A05FC7ECA0966EBB70E4D17B855A853B, 16A0C8138A3BBD8BE2658261131F9777940CFB1431018A10710E5C1A88AB70EA ] ElbyCDIO C:\Windows\system32\Drivers\ElbyCDIO.sys
14:38:46.0962 0x09b4 ElbyCDIO - ok
14:38:47.0024 0x09b4 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
14:38:47.0102 0x09b4 elxstor - ok
14:38:47.0133 0x09b4 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
14:38:47.0180 0x09b4 ErrDev - ok
14:38:47.0243 0x09b4 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
14:38:47.0352 0x09b4 EventSystem - ok
14:38:47.0383 0x09b4 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
14:38:47.0492 0x09b4 exfat - ok
14:38:47.0523 0x09b4 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
14:38:47.0633 0x09b4 fastfat - ok
14:38:47.0711 0x09b4 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
14:38:47.0804 0x09b4 Fax - ok
14:38:47.0835 0x09b4 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\DRIVERS\fdc.sys
14:38:47.0867 0x09b4 fdc - ok
14:38:47.0882 0x09b4 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
14:38:47.0991 0x09b4 fdPHost - ok
14:38:48.0007 0x09b4 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
14:38:48.0101 0x09b4 FDResPub - ok
14:38:48.0132 0x09b4 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
14:38:48.0163 0x09b4 FileInfo - ok
14:38:48.0179 0x09b4 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
14:38:48.0272 0x09b4 Filetrace - ok
14:38:48.0272 0x09b4 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
14:38:48.0319 0x09b4 flpydisk - ok
14:38:48.0335 0x09b4 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
14:38:48.0381 0x09b4 FltMgr - ok
14:38:48.0491 0x09b4 [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache C:\Windows\system32\FntCache.dll
14:38:48.0615 0x09b4 FontCache - ok
14:38:48.0662 0x09b4 [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
14:38:48.0693 0x09b4 FontCache3.0.0.0 - ok
14:38:48.0787 0x09b4 [ 76FCBFD0C78DE110468B356F85EC6DB3, 38C71EF8C194982CA352D5B30F78F6FE6C2BC4CD3B8C318A90139332AEBEE073 ] ForceWare Intelligent Application Manager (IAM) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
14:38:48.0834 0x09b4 ForceWare Intelligent Application Manager (IAM) - ok
14:38:48.0849 0x09b4 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
14:38:48.0896 0x09b4 FsDepends - ok
14:38:48.0927 0x09b4 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
14:38:48.0943 0x09b4 Fs_Rec - ok
14:38:49.0005 0x09b4 [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
14:38:49.0037 0x09b4 fvevol - ok
14:38:49.0068 0x09b4 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
14:38:49.0115 0x09b4 gagp30kx - ok
14:38:49.0161 0x09b4 [ 16C2A6BCDDA8952C2035DEC861492A19, 9023CD3A2C1009786A48EF7FBCC97ED1724C836279424A4D465CCE1AFA2DBDDA ] ggflt C:\Windows\system32\DRIVERS\ggflt.sys
14:38:49.0193 0x09b4 ggflt - ok
14:38:49.0208 0x09b4 [ 6B503DF845EABF3457E49FBBDA26C10E, A1553E3822EDEA26D8E67FCC7F9EA40DFBED49EC92FD5674AAF938F2D58CF964 ] ggsemc C:\Windows\system32\DRIVERS\ggsemc.sys
14:38:49.0239 0x09b4 ggsemc - ok
14:38:49.0317 0x09b4 [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
14:38:49.0473 0x09b4 gpsvc - ok
14:38:49.0583 0x09b4 [ F02A533F517EB38333CB12A9E8963773, 1F72CD1CF660766FA8F912E40B7323A0192A300B376186C10F6803DC5EFE28DF ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
14:38:49.0614 0x09b4 gupdate - ok
14:38:49.0629 0x09b4 [ F02A533F517EB38333CB12A9E8963773, 1F72CD1CF660766FA8F912E40B7323A0192A300B376186C10F6803DC5EFE28DF ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
14:38:49.0661 0x09b4 gupdatem - ok
14:38:49.0707 0x09b4 [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
14:38:49.0754 0x09b4 gusvc - ok
14:38:49.0785 0x09b4 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
14:38:49.0832 0x09b4 hcw85cir - ok
14:38:49.0895 0x09b4 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:38:49.0973 0x09b4 HdAudAddService - ok
14:38:50.0035 0x09b4 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
14:38:50.0082 0x09b4 HDAudBus - ok
14:38:50.0113 0x09b4 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
14:38:50.0144 0x09b4 HidBatt - ok
14:38:50.0160 0x09b4 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
14:38:50.0222 0x09b4 HidBth - ok
14:38:50.0238 0x09b4 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
14:38:50.0285 0x09b4 HidIr - ok
14:38:50.0331 0x09b4 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\System32\hidserv.dll
14:38:50.0409 0x09b4 hidserv - ok
14:38:50.0456 0x09b4 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\drivers\hidusb.sys
14:38:50.0487 0x09b4 HidUsb - ok
14:38:50.0565 0x09b4 [ B30B655AF441263BF2F4FE9B623EFD1E, 46C412F4066FAD8500A9184CA30401366A360A0C0A4AAFAAC1645EA74DD21E98 ] HiPatchService C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
14:38:50.0581 0x09b4 HiPatchService - detected UnsignedFile.Multi.Generic ( 1 )
14:38:50.0581 0x09b4 HiPatchService ( UnsignedFile.Multi.Generic ) - warning
14:38:53.0483 0x09b4 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
14:38:53.0576 0x09b4 hkmsvc - ok
14:38:53.0623 0x09b4 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:38:53.0685 0x09b4 HomeGroupListener - ok
14:38:53.0748 0x09b4 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:38:53.0795 0x09b4 HomeGroupProvider - ok
14:38:53.0841 0x09b4 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
14:38:53.0873 0x09b4 HpSAMD - ok
14:38:53.0982 0x09b4 [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP C:\Windows\system32\drivers\HTTP.sys
14:38:54.0153 0x09b4 HTTP - ok
14:38:54.0185 0x09b4 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
14:38:54.0200 0x09b4 hwpolicy - ok
14:38:54.0263 0x09b4 [ 4B7423FCC37664954460AC3E71752B62, D334D1C72691C1BF24A4D8133F61AD51B058A080F4501F05F12C673DCFE081F9 ] hxctlflt C:\Windows\system32\Drivers\hxctlflt.sys
14:38:54.0309 0x09b4 hxctlflt - ok
14:38:54.0372 0x09b4 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
14:38:54.0403 0x09b4 i8042prt - ok
14:38:54.0465 0x09b4 [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
14:38:54.0528 0x09b4 iaStorV - ok
14:38:54.0637 0x09b4 [ 1CF03C69B49ACB70C722DF92755C0C8C, C227850C133F29BB9DED91A26A22AE077FD69629CEF35B67D305F016C4BDAA81 ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
14:38:54.0653 0x09b4 IDriverT - detected UnsignedFile.Multi.Generic ( 1 )
14:38:54.0653 0x09b4 IDriverT ( UnsignedFile.Multi.Generic ) - warning
14:38:57.0585 0x09b4 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD, 2B9512324DBA4A97F6AC34E8067EE08E3B6874CD60F6CB4209AFC22A34D2BE99 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
14:38:57.0695 0x09b4 idsvc - ok
14:38:57.0726 0x09b4 IEEtwCollectorService - ok
14:38:58.0490 0x09b4 [ 8CB8667F5A3B5515F2585F3254F3AAF7, 068E3E513AFF0ADAAB5EB5C019F13DD6D0BF4E8D69B98CFFCBA0368E04674CA8 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
14:38:59.0457 0x09b4 igfx - ok
14:38:59.0504 0x09b4 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
14:38:59.0535 0x09b4 iirsp - ok
14:38:59.0629 0x09b4 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
14:38:59.0738 0x09b4 IKEEXT - ok
14:39:00.0081 0x09b4 [ 150AC23F21DBDBF8488408BA944B0D65, 77A3A0FB5208AA061224CFACC4D136A260132CC4BA01D105AE1532B749968708 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
14:39:00.0393 0x09b4 IntcAzAudAddService - ok
14:39:00.0440 0x09b4 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
14:39:00.0456 0x09b4 intelide - ok
14:39:00.0471 0x09b4 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
14:39:00.0534 0x09b4 intelppm - ok
14:39:00.0565 0x09b4 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
14:39:00.0674 0x09b4 IPBusEnum - ok
14:39:00.0721 0x09b4 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:39:00.0815 0x09b4 IpFilterDriver - ok
14:39:00.0877 0x09b4 [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
14:39:00.0939 0x09b4 iphlpsvc - ok
14:39:00.0986 0x09b4 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
14:39:01.0017 0x09b4 IPMIDRV - ok
14:39:01.0049 0x09b4 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
14:39:01.0142 0x09b4 IPNAT - ok
14:39:01.0189 0x09b4 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
14:39:01.0236 0x09b4 IRENUM - ok
14:39:01.0283 0x09b4 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
14:39:01.0314 0x09b4 isapnp - ok
14:39:01.0361 0x09b4 [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
14:39:01.0423 0x09b4 iScsiPrt - ok
14:39:01.0454 0x09b4 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
14:39:01.0485 0x09b4 kbdclass - ok
14:39:01.0532 0x09b4 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
14:39:01.0579 0x09b4 kbdhid - ok
14:39:01.0610 0x09b4 [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] KeyIso C:\Windows\system32\lsass.exe
14:39:01.0641 0x09b4 KeyIso - ok
14:39:01.0673 0x09b4 [ 8F489706472F7E9A06BAAA198703FA64, F020406690FB38EABD82D63B91D33039CC93ED52A5497AE12BAF475F22D0B08A ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
14:39:01.0704 0x09b4 KSecDD - ok
14:39:01.0719 0x09b4 [ 868A2CAAB12EFC7A021682BCA0EEC54C, 12C4925B5B3D6EA7B6410C01F33158C6EAB50CBD6AF445F8B04ED9899720C2DD ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
14:39:01.0751 0x09b4 KSecPkg - ok
14:39:01.0766 0x09b4 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
14:39:01.0860 0x09b4 ksthunk - ok
14:39:01.0922 0x09b4 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
14:39:02.0047 0x09b4 KtmRm - ok
14:39:02.0078 0x09b4 [ 2AC603C3188C704CFCE353659AA7AD71, 0DAC2E8858221145FA35883BAE0D6484E60EB624158DE9F063FF209951CD1CDF ] L1E C:\Windows\system32\DRIVERS\L1E62x64.sys
14:39:02.0125 0x09b4 L1E - ok
14:39:02.0187 0x09b4 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\System32\srvsvc.dll
14:39:02.0297 0x09b4 LanmanServer - ok
14:39:02.0343 0x09b4 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:39:02.0421 0x09b4 LanmanWorkstation - ok
14:39:02.0468 0x09b4 [ B658B7076B1ACAA5876524595630F183, 3B800B81D0966C2B988857847F35FCA5BB446B368063B10094FB4483A1508B8E ] lirsgt C:\Windows\system32\DRIVERS\lirsgt.sys
14:39:02.0499 0x09b4 lirsgt - detected UnsignedFile.Multi.Generic ( 1 )
14:39:02.0499 0x09b4 lirsgt ( UnsignedFile.Multi.Generic ) - warning
14:39:05.0339 0x09b4 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
14:39:05.0432 0x09b4 lltdio - ok
14:39:05.0463 0x09b4 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
14:39:05.0588 0x09b4 lltdsvc - ok
14:39:05.0619 0x09b4 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
14:39:05.0697 0x09b4 lmhosts - ok
14:39:05.0760 0x09b4 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
14:39:05.0807 0x09b4 LSI_FC - ok
14:39:05.0822 0x09b4 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
14:39:05.0869 0x09b4 LSI_SAS - ok
14:39:05.0885 0x09b4 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
14:39:05.0916 0x09b4 LSI_SAS2 - ok
14:39:05.0947 0x09b4 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
14:39:05.0978 0x09b4 LSI_SCSI - ok
14:39:06.0009 0x09b4 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
14:39:06.0103 0x09b4 luafv - ok
14:39:06.0150 0x09b4 [ 0BB97D43299910CBFBA59C461B99B910, 27C22D9D9EE8A410D7396960DA93E9E260D4DCDD38DCE06E85E45C5E24C067DE ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
14:39:06.0181 0x09b4 MBAMProtector - ok
14:39:06.0243 0x09b4 [ 65085456FD9A74D7F1A999520C299ECB, EA564BC913EF1B8A4CAA9242FC70F525B68CF1F3CA462F63B0B7215B93FE8530 ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
14:39:06.0290 0x09b4 MBAMScheduler - ok
14:39:06.0353 0x09b4 [ E0D7732F2D2E24B2DB3F67B6750295B8, AA5CA86AF1ACEC900F60339016B3DC55472DB40ADB99186005A7ABE67B7D66FC ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
14:39:06.0415 0x09b4 MBAMService - ok
14:39:06.0540 0x09b4 [ 968BFF74AEB683C962960ECE0CAE4135, 3E08B39DE27FE27A27BD3E81486F0FCA1947D4B50BFE0167A0C27CE48DD56793 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe
14:39:06.0587 0x09b4 McComponentHostService - ok
14:39:06.0633 0x09b4 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
14:39:06.0696 0x09b4 Mcx2Svc - ok
14:39:06.0727 0x09b4 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
14:39:06.0758 0x09b4 megasas - ok
14:39:06.0789 0x09b4 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
14:39:06.0836 0x09b4 MegaSR - ok
14:39:06.0883 0x09b4 [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
14:39:06.0914 0x09b4 MEIx64 - ok
14:39:06.0945 0x09b4 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
14:39:07.0039 0x09b4 MMCSS - ok
14:39:07.0070 0x09b4 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
14:39:07.0148 0x09b4 Modem - ok
14:39:07.0195 0x09b4 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
14:39:07.0242 0x09b4 monitor - ok
14:39:07.0289 0x09b4 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\drivers\mouclass.sys
14:39:07.0335 0x09b4 mouclass - ok
14:39:07.0367 0x09b4 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
14:39:07.0413 0x09b4 mouhid - ok
14:39:07.0476 0x09b4 [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
14:39:07.0507 0x09b4 mountmgr - ok
14:39:07.0585 0x09b4 [ 3B9398E0146855B1DC0E3D9769C80F01, DF69DB5CA30A5577648635C27DD468AF98515D07DF379B3FFDCC6B40744EDE66 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
14:39:07.0632 0x09b4 MozillaMaintenance - ok
14:39:07.0663 0x09b4 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
14:39:07.0710 0x09b4 mpio - ok
14:39:07.0757 0x09b4 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
14:39:07.0850 0x09b4 mpsdrv - ok
14:39:07.0959 0x09b4 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
14:39:08.0100 0x09b4 MpsSvc - ok
14:39:08.0147 0x09b4 [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
14:39:08.0193 0x09b4 MRxDAV - ok
14:39:08.0240 0x09b4 [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
14:39:08.0287 0x09b4 mrxsmb - ok
14:39:08.0334 0x09b4 [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:39:08.0412 0x09b4 mrxsmb10 - ok
14:39:08.0443 0x09b4 [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:39:08.0474 0x09b4 mrxsmb20 - ok
14:39:08.0521 0x09b4 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
14:39:08.0552 0x09b4 msahci - ok
14:39:08.0568 0x09b4 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
14:39:08.0615 0x09b4 msdsm - ok
14:39:08.0646 0x09b4 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
14:39:08.0693 0x09b4 MSDTC - ok
14:39:08.0724 0x09b4 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
14:39:08.0802 0x09b4 Msfs - ok
14:39:08.0817 0x09b4 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
14:39:08.0911 0x09b4 mshidkmdf - ok
14:39:08.0942 0x09b4 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
14:39:08.0973 0x09b4 msisadrv - ok
14:39:09.0020 0x09b4 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
14:39:09.0129 0x09b4 MSiSCSI - ok
14:39:09.0145 0x09b4 msiserver - ok
14:39:09.0176 0x09b4 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
14:39:09.0270 0x09b4 MSKSSRV - ok
14:39:09.0301 0x09b4 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
14:39:09.0379 0x09b4 MSPCLOCK - ok
14:39:09.0395 0x09b4 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
14:39:09.0488 0x09b4 MSPQM - ok
14:39:09.0535 0x09b4 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
14:39:09.0582 0x09b4 MsRPC - ok
14:39:09.0613 0x09b4 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
14:39:09.0629 0x09b4 mssmbios - ok
14:39:09.0644 0x09b4 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
14:39:09.0738 0x09b4 MSTEE - ok
14:39:09.0753 0x09b4 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
14:39:09.0800 0x09b4 MTConfig - ok
14:39:09.0847 0x09b4 [ 19B006B181E3875FD254F7B67ACF1E7C, 1D68D19522E71F16B8B50F8CCFBC9D884CF2DAC40CC409BD5A40A4D4223ABC61 ] MTsensor C:\Windows\system32\DRIVERS\ASACPI.sys
14:39:09.0863 0x09b4 MTsensor - ok
14:39:09.0894 0x09b4 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
14:39:09.0909 0x09b4 Mup - ok
14:39:09.0987 0x09b4 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
14:39:10.0097 0x09b4 napagent - ok
14:39:10.0159 0x09b4 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
14:39:10.0284 0x09b4 NativeWifiP - ok
14:39:10.0455 0x09b4 [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS C:\Windows\system32\drivers\ndis.sys
14:39:10.0533 0x09b4 NDIS - ok
14:39:10.0565 0x09b4 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
14:39:10.0658 0x09b4 NdisCap - ok
14:39:10.0689 0x09b4 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
14:39:10.0783 0x09b4 NdisTapi - ok
14:39:10.0830 0x09b4 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
14:39:10.0908 0x09b4 Ndisuio - ok
14:39:10.0955 0x09b4 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
14:39:11.0064 0x09b4 NdisWan - ok
14:39:11.0095 0x09b4 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
14:39:11.0204 0x09b4 NDProxy - ok
14:39:11.0329 0x09b4 [ B90E093E7A7250906F1054418B5339C0, F9A0BAC5B4B29F14B5CACA1047F8928A495EFD56E485492BF71C856B296476D6 ] Nero BackItUp Scheduler 4.0 C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
14:39:11.0438 0x09b4 Nero BackItUp Scheduler 4.0 - ok
14:39:11.0454 0x09b4 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
14:39:11.0547 0x09b4 NetBIOS - ok
14:39:11.0579 0x09b4 [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
14:39:11.0688 0x09b4 NetBT - ok
14:39:11.0703 0x09b4 [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] Netlogon C:\Windows\system32\lsass.exe
14:39:11.0735 0x09b4 Netlogon - ok
14:39:11.0766 0x09b4 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
14:39:11.0875 0x09b4 Netman - ok
14:39:11.0937 0x09b4 [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:39:12.0000 0x09b4 NetMsmqActivator - ok
14:39:12.0031 0x09b4 [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:39:12.0078 0x09b4 NetPipeActivator - ok
14:39:12.0109 0x09b4 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
14:39:12.0234 0x09b4 netprofm - ok
14:39:12.0327 0x09b4 [ F3A1D8B7317939813568992D1BFDDE37, 816829E4B8DF5C6A2B09685ED45E844D8DE2C2721C90490A2957227025D057A0 ] netr7364 C:\Windows\system32\DRIVERS\netr7364.sys
14:39:12.0390 0x09b4 netr7364 - ok
14:39:12.0421 0x09b4 [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:39:12.0452 0x09b4 NetTcpActivator - ok
14:39:12.0468 0x09b4 [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:39:12.0499 0x09b4 NetTcpPortSharing - ok
14:39:12.0546 0x09b4 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
14:39:12.0577 0x09b4 nfrd960 - ok
14:39:12.0639 0x09b4 [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc C:\Windows\System32\nlasvc.dll
14:39:12.0702 0x09b4 NlaSvc - ok
14:39:12.0733 0x09b4 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
14:39:12.0827 0x09b4 Npfs - ok
14:39:12.0842 0x09b4 npggsvc - ok
14:39:12.0873 0x09b4 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
14:39:12.0967 0x09b4 nsi - ok
14:39:12.0983 0x09b4 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
14:39:13.0076 0x09b4 nsiproxy - ok
14:39:13.0139 0x09b4 [ 13C0D9CBA38FFA6D0C9E721B5E7212A0, 41F38AA6111FCE5D0CF63E7CC289645C7B51BCD353690700B8ECBFC03CF51FA9 ] nSvcIp C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
14:39:13.0170 0x09b4 nSvcIp - ok
14:39:13.0295 0x09b4 [ B98F8C6E31CD07B2E6F71F7F648E38C0, 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
14:39:13.0419 0x09b4 Ntfs - ok
14:39:13.0435 0x09b4 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
14:39:13.0513 0x09b4 Null - ok
14:39:13.0560 0x09b4 [ 0EBC9D13CD96C15B1B18D8678A609E4B, B10896DE16B0C102DFB3E73A6C11A1982C5B428015DAE1F8776BCEF94A0F75C6 ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
14:39:13.0591 0x09b4 nusb3hub - ok
14:39:13.0622 0x09b4 [ 7BDEC000D56D485021D9C1E63C2F81CA, 7F1303FD0371AF8715BFC38433B730C797170AEF10C7DB845B7B547DA8DBB5D5 ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
14:39:13.0669 0x09b4 nusb3xhc - ok
14:39:13.0731 0x09b4 [ A85B4F2EF3A7304A5399EF0526423040, E45854691BA6AE36E53C2922CC93FF13DC2D84CBE7FE13A2F0B1CE1C16D1D158 ] NVENETFD C:\Windows\system32\DRIVERS\nvm62x64.sys
14:39:13.0809 0x09b4 NVENETFD - ok
14:39:13.0856 0x09b4 [ F2662FDC20518EE8A8EED4F61BA42349, 4E8810345AA7D878DC21AE0A2E6ED201FC90EE112D6D13961A8D697A98716B3F ] NVHDA C:\Windows\system32\drivers\nvhda64v.sys
14:39:13.0887 0x09b4 NVHDA - ok
14:39:14.0714 0x09b4 [ A963C2C276A97B088DED5D7A83BE8052, 1D3A238380C33D0668970C72B0AF842050AE9A12865D117FEDA1E2F6F7BFC715 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
14:39:15.0603 0x09b4 nvlddmkm - ok
14:39:15.0681 0x09b4 [ BD25E03EAD63AC3365F25175B4DBD56A, 503AB5D064672E1F1A56BBF1339909BDE641ADAA05C6FA6794ED7E045C557062 ] NVNET C:\Windows\system32\DRIVERS\nvmf6264.sys
14:39:15.0744 0x09b4 NVNET - ok
14:39:15.0791 0x09b4 [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\Windows\system32\drivers\nvraid.sys
14:39:15.0837 0x09b4 nvraid - ok
14:39:15.0869 0x09b4 [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\Windows\system32\drivers\nvstor.sys
14:39:15.0900 0x09b4 nvstor - ok
14:39:15.0931 0x09b4 [ 71B6ECD3C56FBF12FB1968DA3953B703, 47E39FBC336C9BFC159AA0FF9D8DEE950724ABB782102858E397A7EF87112584 ] nvstor64 C:\Windows\system32\DRIVERS\nvstor64.sys
14:39:15.0978 0x09b4 nvstor64 - ok
14:39:16.0087 0x09b4 [ DD9D86051B8F7669AABF693530F380FE, 22AE65C82F29330DAD1856857AC0458347CACE445E2088D6ABEB74BA24C1F528 ] NVSvc C:\Windows\system32\nvvsvc.exe
14:39:16.0165 0x09b4 NVSvc - ok
14:39:16.0196 0x09b4 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
14:39:16.0227 0x09b4 nv_agp - ok
14:39:16.0274 0x09b4 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
14:39:16.0337 0x09b4 ohci1394 - ok
14:39:16.0383 0x09b4 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
14:39:16.0446 0x09b4 p2pimsvc - ok
14:39:16.0493 0x09b4 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
14:39:16.0571 0x09b4 p2psvc - ok
14:39:16.0617 0x09b4 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\DRIVERS\parport.sys
14:39:16.0664 0x09b4 Parport - ok
14:39:16.0711 0x09b4 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
14:39:16.0742 0x09b4 partmgr - ok
14:39:16.0773 0x09b4 [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc C:\Windows\System32\pcasvc.dll
14:39:16.0836 0x09b4 PcaSvc - ok
14:39:16.0867 0x09b4 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
14:39:16.0898 0x09b4 pci - ok
14:39:16.0929 0x09b4 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
14:39:16.0961 0x09b4 pciide - ok
14:39:16.0992 0x09b4 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
14:39:17.0039 0x09b4 pcmcia - ok
14:39:17.0054 0x09b4 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
14:39:17.0085 0x09b4 pcw - ok
14:39:17.0132 0x09b4 [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
14:39:17.0288 0x09b4 PEAUTH - ok
14:39:17.0382 0x09b4 [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
14:39:17.0522 0x09b4 PeerDistSvc - ok
14:39:17.0600 0x09b4 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
14:39:17.0647 0x09b4 PerfHost - ok
14:39:17.0772 0x09b4 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
14:39:17.0990 0x09b4 pla - ok
14:39:18.0037 0x09b4 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
14:39:18.0115 0x09b4 PlugPlay - ok
14:39:18.0146 0x09b4 PnkBstrA - ok
14:39:18.0162 0x09b4 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
14:39:18.0224 0x09b4 PNRPAutoReg - ok
14:39:18.0255 0x09b4 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
14:39:18.0302 0x09b4 PNRPsvc - ok
14:39:18.0349 0x09b4 [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
14:39:18.0474 0x09b4 PolicyAgent - ok
14:39:18.0521 0x09b4 [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
14:39:18.0614 0x09b4 Power - ok
14:39:18.0677 0x09b4 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
14:39:18.0786 0x09b4 PptpMiniport - ok
14:39:18.0801 0x09b4 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\DRIVERS\processr.sys
14:39:18.0848 0x09b4 Processor - ok
14:39:18.0895 0x09b4 [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc C:\Windows\system32\profsvc.dll
14:39:18.0942 0x09b4 ProfSvc - ok
14:39:18.0973 0x09b4 [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] ProtectedStorage C:\Windows\system32\lsass.exe
14:39:19.0004 0x09b4 ProtectedStorage - ok
14:39:19.0051 0x09b4 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
14:39:19.0145 0x09b4 Psched - ok
14:39:19.0285 0x09b4 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
14:39:19.0410 0x09b4 ql2300 - ok
14:39:19.0425 0x09b4 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
14:39:19.0472 0x09b4 ql40xx - ok
14:39:19.0503 0x09b4 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
14:39:19.0566 0x09b4 QWAVE - ok
14:39:19.0597 0x09b4 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
14:39:19.0644 0x09b4 QWAVEdrv - ok
14:39:19.0659 0x09b4 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
14:39:19.0737 0x09b4 RasAcd - ok
14:39:19.0769 0x09b4 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
14:39:19.0862 0x09b4 RasAgileVpn - ok
14:39:19.0878 0x09b4 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
14:39:19.0987 0x09b4 RasAuto - ok
14:39:20.0049 0x09b4 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
14:39:20.0143 0x09b4 Rasl2tp - ok
14:39:20.0205 0x09b4 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
14:39:20.0315 0x09b4 RasMan - ok
14:39:20.0346 0x09b4 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
14:39:20.0455 0x09b4 RasPppoe - ok
14:39:20.0549 0x09b4 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
14:39:20.0658 0x09b4 RasSstp - ok
14:39:20.0689 0x09b4 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
14:39:20.0798 0x09b4 rdbss - ok
14:39:20.0814 0x09b4 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
14:39:20.0861 0x09b4 rdpbus - ok
14:39:20.0892 0x09b4 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
14:39:20.0970 0x09b4 RDPCDD - ok
14:39:21.0017 0x09b4 [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
14:39:21.0063 0x09b4 RDPDR - ok
14:39:21.0110 0x09b4 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
14:39:21.0204 0x09b4 RDPENCDD - ok
14:39:21.0219 0x09b4 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
14:39:21.0297 0x09b4 RDPREFMP - ok
14:39:21.0344 0x09b4 [ 70CBA1A0C98600A2AA1863479B35CB90, 91A133297921B4955817176251AFC5283DA3C7D2099700C4C92ECC94DBE9A99E ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
14:39:21.0391 0x09b4 RdpVideoMiniport - ok
14:39:21.0422 0x09b4 [ E61608AA35E98999AF9AAEEEA6114B0A, F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
14:39:21.0469 0x09b4 RDPWD - ok
14:39:21.0516 0x09b4 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
14:39:21.0563 0x09b4 rdyboost - ok
14:39:21.0594 0x09b4 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
14:39:21.0703 0x09b4 RemoteAccess - ok
14:39:21.0734 0x09b4 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
14:39:21.0843 0x09b4 RemoteRegistry - ok
14:39:21.0906 0x09b4 [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
14:39:21.0968 0x09b4 RFCOMM - ok
14:39:21.0999 0x09b4 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
14:39:22.0093 0x09b4 RpcEptMapper - ok
14:39:22.0124 0x09b4 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
14:39:22.0171 0x09b4 RpcLocator - ok
14:39:22.0233 0x09b4 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
14:39:22.0343 0x09b4 RpcSs - ok
14:39:22.0389 0x09b4 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
14:39:22.0483 0x09b4 rspndr - ok
14:39:22.0561 0x09b4 [ 3B5809E9D3B8995FB65A82CB92745072, 6316AB7AD76B46AEF83E20FDF04BF2C592A7A9D43E9D618973D19CC2A9B81E8A ] RT73 C:\Windows\system32\DRIVERS\Dr71WU.sys
14:39:22.0639 0x09b4 RT73 - ok
14:39:22.0733 0x09b4 [ 8181B5E7BFC040E0B26349C73E719335, EBB244A7E8E2CDC51041B2C2A78DCB77324F9E3746942C84902FCD928ADED897 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
14:39:22.0795 0x09b4 RTL8167 - ok
14:39:22.0873 0x09b4 [ 9269EF78A780A3161087DF1BEC117DC8, 4DABD74C2918213147B81FC5C26B2140D4FED0D8F741388A14393AD47D293632 ] RTL85n64 C:\Windows\system32\DRIVERS\RTL85n64.sys
14:39:22.0935 0x09b4 RTL85n64 - ok
14:39:22.0982 0x09b4 [ E16B7C030A05EF649B18FAB0A93D871F, 0F532D534A93D71650E2F7AF677419A6B38CE3142C98983565F1D759E544A4ED ] RtNdPt60 C:\Windows\system32\DRIVERS\RtNdPt60.sys
14:39:23.0013 0x09b4 RtNdPt60 - ok
14:39:23.0045 0x09b4 [ 1DE78F5008120CD79B34C12394DCD493, 58C59BEEE2F1C1C6CE810BA433C0D5789B4E6F218A074868137960663CB54802 ] RTTEAMPT C:\Windows\system32\DRIVERS\RtTeam60.sys
14:39:23.0076 0x09b4 RTTEAMPT - ok
14:39:23.0107 0x09b4 [ ED0624ED83121E1BC141F49B1316CAA0, 322CA21FE679910827F39CFCD3511400CABDA1133F5E0B5031186C94741FAF1E ] RTVLANPT C:\Windows\system32\DRIVERS\RtVlan620.sys
14:39:23.0138 0x09b4 RTVLANPT - ok
14:39:23.0185 0x09b4 [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap C:\Windows\system32\drivers\vms3cap.sys
14:39:23.0232 0x09b4 s3cap - ok
14:39:23.0247 0x09b4 [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] SamSs C:\Windows\system32\lsass.exe
14:39:23.0279 0x09b4 SamSs - ok
14:39:23.0325 0x09b4 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
14:39:23.0357 0x09b4 sbp2port - ok
14:39:23.0403 0x09b4 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
14:39:23.0513 0x09b4 SCardSvr - ok
14:39:23.0591 0x09b4 [ 3A09F31454DFEFBB124BAF378F90B636, ACDDD348CEE5147AD3A6EFE5A1C7576AC9CE699011F843BE93F800B1D2BD8F46 ] SCDEmu C:\Windows\system32\drivers\SCDEmu.sys
14:39:23.0622 0x09b4 SCDEmu - ok
14:39:23.0669 0x09b4 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
14:39:23.0762 0x09b4 scfilter - ok
14:39:23.0856 0x09b4 [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
14:39:24.0027 0x09b4 Schedule - ok
14:39:24.0059 0x09b4 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
14:39:24.0137 0x09b4 SCPolicySvc - ok
14:39:24.0183 0x09b4 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
14:39:24.0230 0x09b4 SDRSVC - ok
14:39:24.0261 0x09b4 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
14:39:24.0371 0x09b4 secdrv - ok
14:39:24.0402 0x09b4 [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
14:39:24.0495 0x09b4 seclogon - ok
14:39:24.0527 0x09b4 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\system32\sens.dll
14:39:24.0605 0x09b4 SENS - ok
14:39:24.0620 0x09b4 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
14:39:24.0683 0x09b4 SensrSvc - ok
14:39:24.0714 0x09b4 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
14:39:24.0761 0x09b4 Serenum - ok
14:39:24.0776 0x09b4 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
14:39:24.0839 0x09b4 Serial - ok
14:39:24.0885 0x09b4 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
14:39:24.0917 0x09b4 sermouse - ok
14:39:24.0979 0x09b4 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
14:39:25.0073 0x09b4 SessionEnv - ok
14:39:25.0119 0x09b4 [ 4FCACE92BB0345D58BB96ADBD69F5237, 958067CFE2DC0BE0BC407E1309EE8859652A293F0F914DC7511B2F391FE8DF7F ] sfdrv01 C:\Windows\system32\drivers\sfdrv01.sys
14:39:25.0151 0x09b4 sfdrv01 - ok
14:39:25.0182 0x09b4 [ ADDC96399ACDF3C4DD690C74B835082E, 4CB28EE2B507C0F519C5DD529DEE2AD24DB123DE8BAE589351A11A33543E2616 ] sfdrv01a C:\Windows\system32\drivers\sfdrv01a.sys
14:39:25.0213 0x09b4 sfdrv01a - ok
14:39:25.0244 0x09b4 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
14:39:25.0291 0x09b4 sffdisk - ok
14:39:25.0322 0x09b4 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
14:39:25.0369 0x09b4 sffp_mmc - ok
14:39:25.0400 0x09b4 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
14:39:25.0447 0x09b4 sffp_sd - ok
14:39:25.0463 0x09b4 [ 17F6BD95BF04B924F4C05CE78BEF8AE6, 68D38DC04349DA476B62F853B165EE6B6F42054BCAF2B8F615A6E6BAACD35EB4 ] sfhlp02 C:\Windows\system32\drivers\sfhlp02.sys
14:39:25.0494 0x09b4 sfhlp02 - ok
14:39:25.0509 0x09b4 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
14:39:25.0556 0x09b4 sfloppy - ok
14:39:25.0572 0x09b4 [ B02C284AAC97C61B707AD7400F36A067, 9235C5CD6BBC94A9CD516C523DDD5E34642198CF092C30914F6070C8B85BF45C ] sfsync04 C:\Windows\system32\drivers\sfsync04.sys
14:39:25.0603 0x09b4 sfsync04 - ok
14:39:25.0619 0x09b4 [ F3B72568A6FA36E5D63D30B8186D1C48, 8B6A7C8595182356F5B5B9F8DE4AC1F8926DBF0EEB68DA196FCF3512F1FD24FA ] sfvfs02 C:\Windows\system32\drivers\sfvfs02.sys
14:39:25.0650 0x09b4 sfvfs02 - ok
14:39:25.0712 0x09b4 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
14:39:25.0821 0x09b4 SharedAccess - ok
14:39:25.0853 0x09b4 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:39:25.0946 0x09b4 ShellHWDetection - ok
14:39:25.0977 0x09b4 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
14:39:26.0009 0x09b4 SiSRaid2 - ok
14:39:26.0024 0x09b4 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
14:39:26.0071 0x09b4 SiSRaid4 - ok
14:39:26.0149 0x09b4 [ F5BBEDF602C310B00036EB2DBF4348A5, AC2712E639F0C54BCF00EB4E90E805335871EA27AE8A45DFC53EDF28822318C4 ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
14:39:26.0180 0x09b4 SkypeUpdate - ok
14:39:26.0196 0x09b4 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
14:39:26.0305 0x09b4 Smb - ok
14:39:26.0352 0x09b4 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
14:39:26.0399 0x09b4 SNMPTRAP - ok
14:39:26.0664 0x09b4 [ BA2E864CDC01731A4F144019FB3BF598, BFBD8650C860C1F42DF4EFD610FF39773D2A30E30F4D26A88EC1797540B32A3B ] SNP2UVC C:\Windows\system32\DRIVERS\snp2uvc.sys
14:39:26.0945 0x09b4 SNP2UVC - ok
14:39:27.0038 0x09b4 [ 3A4F2C0BB87A0895ABEBA341AA1E341B, 4DADEEF3C5D181502D6F4A00FBBF3B001FA626E49569FB330D7AE2955CC7DE08 ] Sony PC Companion C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
14:39:27.0085 0x09b4 Sony PC Companion - ok
14:39:27.0101 0x09b4 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
14:39:27.0132 0x09b4 spldr - ok
14:39:27.0194 0x09b4 [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\Windows\System32\spoolsv.exe
14:39:27.0272 0x09b4 Spooler - ok
14:39:27.0522 0x09b4 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
14:39:27.0865 0x09b4 sppsvc - ok
14:39:27.0896 0x09b4 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
14:39:27.0990 0x09b4 sppuinotify - ok
14:39:28.0052 0x09b4 [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
14:39:28.0115 0x09b4 srv - ok
14:39:28.0161 0x09b4 [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
14:39:28.0224 0x09b4 srv2 - ok
14:39:28.0255 0x09b4 [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
14:39:28.0317 0x09b4 srvnet - ok
14:39:28.0364 0x09b4 [ 8F8324ED1DE63FFC7B1A02CD2D963C72, E58603F81DEAFF1D45CB83FB6E625E6A13868741B833B1C9E60D672179D18EE0 ] ssadbus C:\Windows\system32\DRIVERS\ssadbus.sys
14:39:28.0427 0x09b4 ssadbus - ok
14:39:28.0473 0x09b4 [ 58221EFCB74167B73667F0024C661CE0, D9B67A8897B4DC3E4729187F17ABEB4710CF57440D718E17ED828439198D34DB ] ssadmdfl C:\Windows\system32\DRIVERS\ssadmdfl.sys
14:39:28.0505 0x09b4 ssadmdfl - ok
14:39:28.0551 0x09b4 [ 4DA7C71BFAC5AD71255B7E4CAB980163, 4CC0F9C8E96ECEF36EEB021E448A9734B63512D030516DC38B1A2EEAA1043AEC ] ssadmdm C:\Windows\system32\DRIVERS\ssadmdm.sys
14:39:28.0614 0x09b4 ssadmdm - ok
14:39:28.0661 0x09b4 [ D33D1BD3EC0E766211A234F56A12726D, 53EEAA94865554F8422D111D717B548DF553B5B8647D2A45F3718BF4AEEBEC27 ] ssadserd C:\Windows\system32\DRIVERS\ssadserd.sys
14:39:28.0707 0x09b4 ssadserd - ok
14:39:28.0739 0x09b4 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
14:39:28.0832 0x09b4 SSDPSRV - ok
14:39:28.0848 0x09b4 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
14:39:28.0941 0x09b4 SstpSvc - ok
14:39:29.0051 0x09b4 [ C3D855CC0A8E5E373FDFCF4F743C5C9D, 8DFDD2470DCCC63FCF1621B6B3A996285C75EE330BE8AC905B2176E5DE52C150 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
14:39:29.0129 0x09b4 Steam Client Service - ok
14:39:29.0207 0x09b4 [ A2ABC52CD8A5B60262B220A17A92EB31, 357A1E5E6151B92F49FB6493D38DC0D1D25E53BDB097F0E2494916EDFA57AA9D ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
14:39:29.0253 0x09b4 Stereo Service - ok
14:39:29.0269 0x09b4 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
14:39:29.0300 0x09b4 stexstor - ok
14:39:29.0394 0x09b4 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
14:39:29.0487 0x09b4 stisvc - ok
14:39:29.0519 0x09b4 [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt C:\Windows\system32\drivers\vmstorfl.sys
14:39:29.0550 0x09b4 storflt - ok
14:39:29.0565 0x09b4 [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc C:\Windows\system32\storsvc.dll
14:39:29.0612 0x09b4 StorSvc - ok
14:39:29.0628 0x09b4 [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc C:\Windows\system32\drivers\storvsc.sys
14:39:29.0659 0x09b4 storvsc - ok
14:39:29.0675 0x09b4 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\drivers\swenum.sys
14:39:29.0706 0x09b4 swenum - ok
14:39:29.0753 0x09b4 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
14:39:29.0893 0x09b4 swprv - ok
14:39:29.0924 0x09b4 Synth3dVsc - ok
14:39:30.0065 0x09b4 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
14:39:30.0236 0x09b4 SysMain - ok
14:39:30.0283 0x09b4 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
14:39:30.0345 0x09b4 TabletInputService - ok
14:39:30.0408 0x09b4 [ 3C32FF010F869BC184DF71290477384E, 55CFCEC7F026C6E2E96A2FBE846AB513BB12BB0348735274FE1B71AF019C837B ] tap0901 C:\Windows\system32\DRIVERS\tap0901.sys
14:39:30.0439 0x09b4 tap0901 - ok
14:39:30.0486 0x09b4 [ B08740047145B9BCE15BF75CA0F9718A, 3E2A8A5A2A4DC4D0F05E22EA2C0EBD85AA5C7C6854E873D53538D1F54B8F7C63 ] tap0901t C:\Windows\system32\DRIVERS\tap0901t.sys
14:39:30.0517 0x09b4 tap0901t - detected UnsignedFile.Multi.Generic ( 1 )
14:39:30.0517 0x09b4 tap0901t ( UnsignedFile.Multi.Generic ) - warning
14:39:44.0385 0x09b4 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
14:39:44.0495 0x09b4 TapiSrv - ok
14:39:44.0526 0x09b4 [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
14:39:44.0619 0x09b4 TBS - ok
14:39:44.0775 0x09b4 [ 40AF23633D197905F03AB5628C558C51, 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C ] Tcpip C:\Windows\system32\drivers\tcpip.sys
14:39:44.0900 0x09b4 Tcpip - ok
14:39:45.0041 0x09b4 [ 40AF23633D197905F03AB5628C558C51, 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
14:39:45.0165 0x09b4 TCPIP6 - ok
14:39:45.0197 0x09b4 [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
14:39:45.0243 0x09b4 tcpipreg - ok
14:39:45.0275 0x09b4 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
14:39:45.0321 0x09b4 TDPIPE - ok
14:39:45.0353 0x09b4 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
14:39:45.0399 0x09b4 TDTCP - ok
14:39:45.0431 0x09b4 [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
14:39:45.0524 0x09b4 tdx - ok
14:39:45.0540 0x09b4 [ 1DE78F5008120CD79B34C12394DCD493, 58C59BEEE2F1C1C6CE810BA433C0D5789B4E6F218A074868137960663CB54802 ] TEAM C:\Windows\system32\DRIVERS\RtTeam60.sys
14:39:45.0555 0x09b4 TEAM - ok
14:39:45.0602 0x09b4 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\drivers\termdd.sys
14:39:45.0633 0x09b4 TermDD - ok
14:39:45.0711 0x09b4 [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService C:\Windows\System32\termsrv.dll
14:39:45.0852 0x09b4 TermService - ok
14:39:45.0883 0x09b4 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
14:39:45.0930 0x09b4 Themes - ok
14:39:45.0961 0x09b4 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
14:39:46.0039 0x09b4 THREADORDER - ok
14:39:46.0133 0x09b4 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
14:39:46.0226 0x09b4 TrkWks - ok
14:39:46.0351 0x09b4 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
14:39:46.0445 0x09b4 TrustedInstaller - ok
14:39:46.0491 0x09b4 [ 4CE278FC9671BA81A138D70823FCAA09, CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
14:39:46.0523 0x09b4 tssecsrv - ok
14:39:46.0569 0x09b4 [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
14:39:46.0616 0x09b4 TsUsbFlt - ok
14:39:46.0632 0x09b4 tsusbhub - ok
14:39:46.0694 0x09b4 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
14:39:46.0772 0x09b4 tunnel - ok
14:39:46.0866 0x09b4 [ 2FD0FE0A0C721C8E47C5A3AE16E519B1, C0DE61AF32F01CF9BDA3E325F5F15D249C0FA4BB5FF720ED1916214907B4AF55 ] TunngleService C:\Program Files (x86)\Tunngle\TnglCtrl.exe
14:39:46.0975 0x09b4 TunngleService - detected UnsignedFile.Multi.Generic ( 1 )
14:39:46.0975 0x09b4 TunngleService ( UnsignedFile.Multi.Generic ) - warning
14:39:49.0814 0x09b4 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
14:39:49.0861 0x09b4 uagp35 - ok
14:39:49.0924 0x09b4 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
14:39:50.0048 0x09b4 udfs - ok
14:39:50.0095 0x09b4 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
14:39:50.0142 0x09b4 UI0Detect - ok
14:39:50.0189 0x09b4 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
14:39:50.0220 0x09b4 uliagpkx - ok
14:39:50.0267 0x09b4 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\drivers\umbus.sys
14:39:50.0329 0x09b4 umbus - ok
14:39:50.0345 0x09b4 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
14:39:50.0376 0x09b4 UmPass - ok
14:39:50.0423 0x09b4 [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService C:\Windows\System32\umrdp.dll
14:39:50.0485 0x09b4 UmRdpService - ok
14:39:50.0532 0x09b4 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
14:39:50.0657 0x09b4 upnphost - ok
14:39:50.0719 0x09b4 [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
14:39:50.0782 0x09b4 usbaudio - ok
14:39:50.0828 0x09b4 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
14:39:50.0860 0x09b4 usbccgp - ok
14:39:50.0891 0x09b4 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
14:39:50.0938 0x09b4 usbcir - ok
14:39:50.0969 0x09b4 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
14:39:51.0016 0x09b4 usbehci - ok
14:39:51.0078 0x09b4 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
14:39:51.0140 0x09b4 usbhub - ok
14:39:51.0187 0x09b4 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
14:39:51.0218 0x09b4 usbohci - ok
14:39:51.0250 0x09b4 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
14:39:51.0296 0x09b4 usbprint - ok
14:39:51.0328 0x09b4 [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:39:51.0406 0x09b4 USBSTOR - ok
14:39:51.0468 0x09b4 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
14:39:51.0484 0x09b4 usbuhci - ok
14:39:51.0562 0x09b4 [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
14:39:51.0624 0x09b4 usbvideo - ok
14:39:51.0655 0x09b4 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
14:39:51.0733 0x09b4 UxSms - ok
14:39:51.0749 0x09b4 [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] VaultSvc C:\Windows\system32\lsass.exe
14:39:51.0780 0x09b4 VaultSvc - ok
14:39:51.0811 0x09b4 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
14:39:51.0842 0x09b4 vdrvroot - ok
14:39:51.0920 0x09b4 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
14:39:52.0061 0x09b4 vds - ok
14:39:52.0092 0x09b4 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
14:39:52.0123 0x09b4 vga - ok
14:39:52.0139 0x09b4 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
14:39:52.0232 0x09b4 VgaSave - ok
14:39:52.0248 0x09b4 VGPU - ok
14:39:52.0295 0x09b4 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
14:39:52.0357 0x09b4 vhdmp - ok
14:39:52.0466 0x09b4 [ BA1DA5CD689E9473D99731A2E1FF2FB5, 10DC100D4723058E6DBB26679E9DA4E46C90367D11C221636236300C2BB45CCD ] VIAHdAudAddService C:\Windows\system32\drivers\viahduaa.sys
14:39:52.0638 0x09b4 VIAHdAudAddService - ok
14:39:52.0685 0x09b4 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
14:39:52.0716 0x09b4 viaide - ok
14:39:52.0763 0x09b4 [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus C:\Windows\system32\drivers\vmbus.sys
14:39:52.0794 0x09b4 vmbus - ok
14:39:52.0810 0x09b4 [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
14:39:52.0856 0x09b4 VMBusHID - ok
14:39:52.0888 0x09b4 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
14:39:52.0919 0x09b4 volmgr - ok
14:39:52.0981 0x09b4 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
14:39:53.0028 0x09b4 volmgrx - ok
14:39:53.0059 0x09b4 [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
14:39:53.0090 0x09b4 volsnap - ok
14:39:53.0137 0x09b4 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
14:39:53.0184 0x09b4 vsmraid - ok
14:39:53.0324 0x09b4 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
14:39:53.0527 0x09b4 VSS - ok
14:39:53.0558 0x09b4 vToolbarUpdater15.0.0 - ok
14:39:53.0590 0x09b4 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
14:39:53.0636 0x09b4 vwifibus - ok
14:39:53.0668 0x09b4 [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
14:39:53.0730 0x09b4 vwififlt - ok
14:39:53.0761 0x09b4 [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
14:39:53.0824 0x09b4 vwifimp - ok
14:39:53.0917 0x09b4 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
14:39:54.0026 0x09b4 W32Time - ok
14:39:54.0058 0x09b4 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
14:39:54.0120 0x09b4 WacomPen - ok
14:39:54.0167 0x09b4 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
14:39:54.0260 0x09b4 WANARP - ok
14:39:54.0276 0x09b4 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
14:39:54.0354 0x09b4 Wanarpv6 - ok
14:39:54.0479 0x09b4 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
14:39:54.0619 0x09b4 wbengine - ok
14:39:54.0697 0x09b4 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
14:39:54.0775 0x09b4 WbioSrvc - ok
14:39:54.0838 0x09b4 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
14:39:54.0916 0x09b4 wcncsvc - ok
14:39:54.0931 0x09b4 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
14:39:54.0994 0x09b4 WcsPlugInService - ok
14:39:55.0025 0x09b4 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\DRIVERS\wd.sys
14:39:55.0056 0x09b4 Wd - ok
14:39:55.0134 0x09b4 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
14:39:55.0212 0x09b4 Wdf01000 - ok
14:39:55.0243 0x09b4 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost C:\Windows\system32\wdi.dll
14:39:55.0290 0x09b4 WdiServiceHost - ok
14:39:55.0306 0x09b4 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost C:\Windows\system32\wdi.dll
14:39:55.0352 0x09b4 WdiSystemHost - ok
14:39:55.0415 0x09b4 [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient C:\Windows\System32\webclnt.dll
14:39:55.0477 0x09b4 WebClient - ok
14:39:55.0508 0x09b4 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
14:39:55.0633 0x09b4 Wecsvc - ok
14:39:55.0664 0x09b4 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
14:39:55.0742 0x09b4 wercplsupport - ok
14:39:55.0758 0x09b4 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
14:39:55.0852 0x09b4 WerSvc - ok
14:39:55.0867 0x09b4 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
14:39:55.0945 0x09b4 WfpLwf - ok
14:39:55.0961 0x09b4 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
14:39:55.0992 0x09b4 WIMMount - ok
14:39:56.0023 0x09b4 WinDefend - ok
14:39:56.0039 0x09b4 WinHttpAutoProxySvc - ok
14:39:56.0117 0x09b4 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
14:39:56.0226 0x09b4 Winmgmt - ok
14:39:56.0382 0x09b4 [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM C:\Windows\system32\WsmSvc.dll
14:39:56.0632 0x09b4 WinRM - ok
14:39:56.0725 0x09b4 [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
14:39:56.0756 0x09b4 WinUsb - ok
14:39:56.0834 0x09b4 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
14:39:56.0944 0x09b4 Wlansvc - ok
14:39:57.0193 0x09b4 [ 357CABBF155AFD1D3926E62539D2A3A7, C43CFF84E7D930B4999DC061AB0766B57AAD7540B3E6EE54605B10ECE90825F5 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
14:39:57.0365 0x09b4 wlidsvc - ok
14:39:57.0412 0x09b4 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
14:39:57.0458 0x09b4 WmiAcpi - ok
14:39:57.0490 0x09b4 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
14:39:57.0552 0x09b4 wmiApSrv - ok
14:39:57.0568 0x09b4 WMPNetworkSvc - ok
14:39:57.0677 0x09b4 [ 83B6CA03C846FCD47F9883D77D1EB27B, 1616DBBC95085B6618B7F884383507E2A54D561A41288E79FA6DC99218C02802 ] WMZuneComm C:\Program Files\Zune\WMZuneComm.exe
14:39:57.0724 0x09b4 WMZuneComm - ok
14:39:57.0755 0x09b4 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
14:39:57.0802 0x09b4 WPCSvc - ok
14:39:57.0848 0x09b4 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
14:39:57.0895 0x09b4 WPDBusEnum - ok
14:39:57.0911 0x09b4 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
14:39:58.0004 0x09b4 ws2ifsl - ok
14:39:58.0036 0x09b4 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\system32\wscsvc.dll
14:39:58.0082 0x09b4 wscsvc - ok
14:39:58.0098 0x09b4 WSearch - ok
14:39:58.0285 0x09b4 [ D9EF901DCA379CFE914E9FA13B73B4C4, 3BE9693B7B2AFEE23D72AF5DA211379724D752F0EC18ACB7D3DE3DDFC5AE0004 ] wuauserv C:\Windows\system32\wuaueng.dll
14:39:58.0457 0x09b4 wuauserv - ok
14:39:58.0504 0x09b4 [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
14:39:58.0566 0x09b4 WudfPf - ok
14:39:58.0613 0x09b4 [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
14:39:58.0675 0x09b4 WUDFRd - ok
14:39:58.0706 0x09b4 [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
14:39:58.0753 0x09b4 wudfsvc - ok
14:39:58.0800 0x09b4 [ FE90B750AB808FB9DD8FBB428B5FF83B, 3F8F592EC813BE292D305A87C5BA852F8BC3D7CE610612D9871F209A17326AA8 ] WwanSvc C:\Windows\System32\wwansvc.dll
14:39:58.0878 0x09b4 WwanSvc - ok
14:39:58.0940 0x09b4 X6va011 - ok
14:39:58.0972 0x09b4 X6va012 - ok
14:39:58.0987 0x09b4 X6va013 - ok
14:39:59.0018 0x09b4 X6va015 - ok
14:39:59.0018 0x09b4 xhunter1 - ok
14:39:59.0580 0x09b4 [ 67B787C34FB2888D01B130AE007042D8, E44878E53F265C89F271B08B81C129105E42D1C78C14467B2D96E28A9A428B1A ] ZuneNetworkSvc C:\Program Files\Zune\ZuneNss.exe
14:40:00.0173 0x09b4 ZuneNetworkSvc - ok
14:40:00.0220 0x09b4 [ 4D89FC1C20CF655739EFAC5DA81A67BC, 788D0A5B9972ED6D80242C0C5E80AB0FAB44A708B896D5F724AC1559A291C8DD ] ZuneWlanCfgSvc C:\Program Files\Zune\ZuneWlanCfgSvc.exe
14:40:00.0298 0x09b4 ZuneWlanCfgSvc - ok
14:40:00.0422 0x09b4 ================ Scan global ===============================
14:40:00.0454 0x09b4 [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
14:40:00.0516 0x09b4 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
14:40:00.0547 0x09b4 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
14:40:00.0578 0x09b4 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
14:40:00.0610 0x09b4 [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
14:40:00.0641 0x09b4 [ Global ] - ok
14:40:00.0641 0x09b4 ================ Scan MBR ==================================
14:40:00.0656 0x09b4 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
14:40:00.0859 0x09b4 \Device\Harddisk0\DR0 - ok
14:40:00.0859 0x09b4 ================ Scan VBR ==================================
14:40:00.0875 0x09b4 [ 2ED5F64087D874D22C41BF932B0F9078 ] \Device\Harddisk0\DR0\Partition1
14:40:00.0890 0x09b4 \Device\Harddisk0\DR0\Partition1 - ok
14:40:00.0906 0x09b4 [ DA5FBF969D3027178E6997B09776F9D0 ] \Device\Harddisk0\DR0\Partition2
14:40:00.0937 0x09b4 \Device\Harddisk0\DR0\Partition2 - ok
14:40:01.0249 0x09b4 AV detected via SS2: Avira Desktop, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 14.0.2.234 ), 0x40000 ( disabled : updated )
14:40:01.0327 0x09b4 Win FW state via NFP2: enabled
14:40:04.0135 0x09b4 ============================================================
14:40:04.0135 0x09b4 Scan finished
14:40:04.0135 0x09b4 ============================================================
14:40:04.0151 0x0b18 Detected object count: 8
14:40:04.0151 0x0b18 Actual detected object count: 8
14:40:20.0827 0x0b18 Akamai ( HiddenFile.Multi.Generic ) - skipped by user
14:40:20.0827 0x0b18 Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip
14:40:20.0827 0x0b18 AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0827 0x0b18 AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:40:20.0843 0x0b18 atksgt ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18 atksgt ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:40:20.0843 0x0b18 HiPatchService ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18 HiPatchService ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:40:20.0843 0x0b18 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:40:20.0843 0x0b18 lirsgt ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18 lirsgt ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:40:20.0843 0x0b18 tap0901t ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0843 0x0b18 tap0901t ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:40:20.0858 0x0b18 TunngleService ( UnsignedFile.Multi.Generic ) - skipped by user
14:40:20.0858 0x0b18 TunngleService ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:44:38.0551 0x1150 Deinitialize success
|
|
13.02.2014, 14:58
| #9 |
| | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Combofix Code:
ATTFilter ComboFix 14-02-12.01 - Pc 13.02.2014 14:00:53.2.6 - x64
Microsoft Windows 7 Enterprise 6.1.7601.1.1252.49.1031.18.8174.6283 [GMT 1:00]
ausgeführt von:: c:\users\Pc\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Pc\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk"
"c:\users\Pc\AppData\Roaming\vbc.exe"
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk
c:\users\Pc\AppData\Roaming\pthreadGC2.dll
c:\users\Pc\AppData\Roaming\vbc.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-01-13 bis 2014-02-13 ))))))))))))))))))))))))))))))
.
.
2014-02-13 13:16 . 2014-02-13 13:16 -------- d-----w- c:\users\HomeGroupUser$\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16 -------- d-----w- c:\users\hedev\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16 -------- d-----w- c:\users\Gast\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16 -------- d-----w- c:\users\ASPNET\AppData\Local\temp
2014-02-13 13:16 . 2014-02-13 13:16 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-02-12 21:27 . 2014-02-12 21:27 -------- d-----w- c:\users\Pc\AppData\Roaming\Avira
2014-02-12 21:27 . 2014-02-12 21:27 -------- d-----w- c:\users\Pc\AppData\Local\VNT
2014-02-12 21:26 . 2014-02-12 21:26 -------- d-----w- c:\programdata\AskPartnerNetwork
2014-02-12 21:26 . 2014-02-12 21:26 -------- d-----w- c:\program files (x86)\VNT
2014-02-12 21:26 . 2014-02-12 21:26 -------- d-----w- c:\program files (x86)\AskPartnerNetwork
2014-02-12 21:26 . 2014-02-12 21:26 -------- d-----w- c:\programdata\APN
2014-02-12 21:23 . 2013-12-09 10:45 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-02-12 21:23 . 2013-12-09 10:45 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2014-02-12 21:23 . 2013-12-09 10:45 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-02-12 21:23 . 2013-12-09 10:45 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-02-12 21:23 . 2014-02-12 21:23 -------- d-----w- c:\programdata\Avira
2014-02-12 21:23 . 2014-02-12 21:23 -------- d-----w- c:\program files (x86)\Avira
2014-02-12 21:05 . 2014-02-12 21:05 -------- d-----w- c:\program files (x86)\FileHippo.com
2014-02-12 20:04 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-02-12 20:04 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-02-12 19:57 . 2013-12-04 02:16 658432 ----a-w- c:\windows\system32\RMActivate_isv.exe
2014-02-12 13:12 . 2014-02-12 13:12 -------- d-----w- c:\program files (x86)\DLLSuite
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\users\Pc\AppData\Roaming\DriverCure
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\users\Pc\AppData\Roaming\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\program files (x86)\Common Files\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\programdata\ParetoLogic
2014-02-12 12:51 . 2014-02-12 12:51 -------- d-----w- c:\program files (x86)\ParetoLogic
2014-02-11 21:23 . 2014-02-12 17:54 -------- d-----w- C:\FRST
2014-02-11 20:23 . 2014-02-11 21:00 -------- d-----w- c:\programdata\SecTaskMan
2014-02-11 20:22 . 2014-02-11 20:23 -------- d-----w- c:\program files (x86)\Security Task Manager
2014-02-11 20:03 . 2014-02-11 20:03 -------- d-----w- c:\users\Pc\AppData\Roaming\TestApp
2014-02-11 16:50 . 2014-02-12 19:59 -------- d-----w- c:\programdata\PC Tools
2014-02-11 15:54 . 2014-02-11 15:54 -------- d-----w- c:\programdata\SMR410
2014-02-11 15:50 . 2014-02-11 16:34 -------- d-----w- c:\users\Pc\AppData\Local\NPE
2014-02-11 15:35 . 2014-02-11 20:23 -------- d-----w- c:\users\Pc\AppData\Roaming\DigitalSites
2014-02-11 15:34 . 2014-02-11 15:34 -------- d-s---w- c:\windows\SysWow64\Microsoft
2014-02-11 15:30 . 2013-12-18 20:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-11 14:59 . 2014-02-11 14:59 -------- d-----w- c:\users\Pc\AppData\Roaming\Oxy
2014-02-11 14:34 . 2014-02-11 14:34 -------- d-sh--r- c:\users\Pc\cc4j5zs76kd2kj
2014-02-04 15:14 . 2013-06-12 14:15 100864 ----a-w- c:\users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 14:05 . 2014-02-11 20:23 -------- d-sh--r- c:\users\Pc\aoajz
2014-02-04 12:09 . 2014-02-04 12:12 -------- d-----w- c:\users\Pc\AppData\Roaming\Riot Games
2014-02-04 11:08 . 2014-02-11 20:23 -------- d-sh--r- c:\users\Pc\xripb
2014-01-21 09:23 . 2014-02-04 11:20 -------- d-----w- c:\users\Pc\AppData\Local\CyberGhost
2014-01-21 09:22 . 2014-01-21 09:23 -------- d-----w- c:\program files\TAP-Windows
2014-01-21 09:22 . 2014-01-21 09:27 -------- d-----w- c:\program files\CyberGhost 5
2014-01-15 12:29 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 12:29 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 12:29 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 12:29 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 12:29 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 12:29 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 12:29 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 12:29 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-15 12:29 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-12 20:10 . 2012-10-18 04:30 88567024 ----a-w- c:\windows\system32\MRT.exe
2014-02-12 19:55 . 2012-12-10 17:25 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-12 19:55 . 2012-12-10 17:25 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-12 07:31 . 2012-10-19 16:25 419840 ----a-w- c:\windows\system32\systemcpl.dll
2014-02-12 07:31 . 2012-10-19 16:25 14848 ----a-w- c:\windows\system32\slwga.dll
2014-02-12 07:31 . 2012-10-19 16:25 13824 ----a-w- c:\windows\SysWow64\slwga.dll
2014-02-12 07:31 . 2012-10-19 16:25 1008640 ----a-w- c:\windows\system32\user32.dll
2014-02-12 07:31 . 2012-10-19 16:25 833024 ----a-w- c:\windows\SysWow64\user32.dll
2014-02-05 11:36 . 2013-12-28 10:49 291128 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2014-02-05 11:36 . 2013-08-18 16:42 291128 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-02-04 14:46 . 2013-08-18 16:42 291128 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2014-01-24 21:17 . 2013-08-18 16:42 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-12-30 13:47 . 2013-12-30 13:47 283064 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-12-18 05:13 . 2012-11-06 16:48 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-06 22:07 . 2013-12-06 22:07 78432 ----a-w- c:\windows\system32\atimpc64.dll
2013-12-06 22:07 . 2013-12-06 22:07 78432 ----a-w- c:\windows\system32\amdpcom64.dll
2013-12-06 22:07 . 2013-12-06 22:07 71704 ----a-w- c:\windows\SysWow64\atimpc32.dll
2013-12-06 22:07 . 2013-12-06 22:07 71704 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2013-12-06 22:04 . 2011-05-25 20:07 143304 ----a-w- c:\windows\system32\atiuxp64.dll
2013-12-06 22:03 . 2013-12-06 22:03 126336 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2013-12-06 22:03 . 2011-07-08 02:46 115512 ----a-w- c:\windows\system32\atiu9p64.dll
2013-12-06 22:02 . 2011-07-08 02:45 98496 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2013-12-06 22:01 . 2011-07-08 03:28 1318552 ----a-w- c:\windows\system32\aticfx64.dll
2013-12-06 22:01 . 2011-07-08 03:29 1100216 ----a-w- c:\windows\SysWow64\aticfx32.dll
2013-12-06 22:00 . 2011-07-08 03:10 9753752 ----a-w- c:\windows\system32\atidxx64.dll
2013-12-06 21:59 . 2013-12-06 21:59 8406024 ----a-w- c:\windows\SysWow64\atidxx32.dll
2013-12-06 21:59 . 2011-07-08 02:55 8287008 ----a-w- c:\windows\SysWow64\atiumdva.dll
2013-12-06 21:58 . 2011-07-08 03:00 6630232 ----a-w- c:\windows\SysWow64\atiumdag.dll
2013-12-06 21:57 . 2013-12-06 21:57 8927704 ----a-w- c:\windows\system32\atiumd6a.dll
2013-12-06 21:56 . 2013-12-06 21:56 7751920 ----a-w- c:\windows\system32\atiumd64.dll
2013-12-06 21:52 . 2013-12-06 21:52 13207552 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2013-12-06 21:38 . 2013-12-06 21:38 230912 ----a-w- c:\windows\system32\clinfo.exe
2013-12-06 21:38 . 2013-12-06 21:38 1187342 ----a-w- c:\windows\system32\amdocl_as64.exe
2013-12-06 21:38 . 2013-12-06 21:38 1061902 ----a-w- c:\windows\system32\amdocl_ld64.exe
2013-12-06 21:38 . 2013-12-06 21:38 995342 ----a-w- c:\windows\SysWow64\amdocl_as32.exe
2013-12-06 21:38 . 2013-12-06 21:38 798734 ----a-w- c:\windows\SysWow64\amdocl_ld32.exe
2013-12-06 21:38 . 2013-12-06 21:38 99840 ----a-w- c:\windows\system32\OpenVideo64.dll
2013-12-06 21:38 . 2013-12-06 21:38 83968 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2013-12-06 21:38 . 2013-12-06 21:38 86528 ----a-w- c:\windows\system32\OVDecode64.dll
2013-12-06 21:38 . 2013-12-06 21:38 73728 ----a-w- c:\windows\SysWow64\OVDecode.dll
2013-12-06 21:37 . 2013-12-06 21:37 29382144 ----a-w- c:\windows\system32\amdocl64.dll
2013-12-06 21:35 . 2013-12-06 21:35 24860160 ----a-w- c:\windows\SysWow64\amdocl.dll
2013-12-06 21:33 . 2013-12-06 21:33 63488 ----a-w- c:\windows\system32\OpenCL.dll
2013-12-06 21:33 . 2013-12-06 21:33 57344 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-12-06 21:26 . 2013-12-06 21:26 129536 ----a-w- c:\windows\system32\coinst_13.251.dll
2013-12-06 21:16 . 2013-12-06 21:16 26352128 ----a-w- c:\windows\system32\atio6axx.dll
2013-12-06 21:13 . 2013-12-06 21:13 368640 ----a-w- c:\windows\system32\atiapfxx.exe
2013-12-06 21:12 . 2013-12-06 21:12 62464 ----a-w- c:\windows\system32\aticalrt64.dll
2013-12-06 21:12 . 2013-12-06 21:12 52224 ----a-w- c:\windows\SysWow64\aticalrt.dll
2013-12-06 21:12 . 2013-12-06 21:12 55808 ----a-w- c:\windows\system32\aticalcl64.dll
2013-12-06 21:12 . 2013-12-06 21:12 49152 ----a-w- c:\windows\SysWow64\aticalcl.dll
2013-12-06 21:12 . 2013-12-06 21:12 15716352 ----a-w- c:\windows\system32\aticaldd64.dll
2013-12-06 21:09 . 2013-12-06 21:09 14302208 ----a-w- c:\windows\SysWow64\aticaldd.dll
2013-12-06 20:58 . 2013-12-06 20:58 22157824 ----a-w- c:\windows\SysWow64\atioglxx.dll
2013-12-06 20:53 . 2013-12-06 20:53 442368 ----a-w- c:\windows\system32\atidemgy.dll
2013-12-06 20:53 . 2013-12-06 20:53 31232 ----a-w- c:\windows\system32\atimuixx.dll
2013-12-06 20:53 . 2013-12-06 20:53 588288 ----a-w- c:\windows\system32\atieclxx.exe
2013-12-06 20:52 . 2013-12-06 20:52 239616 ----a-w- c:\windows\system32\atiesrxx.exe
2013-12-06 20:50 . 2013-12-06 20:50 190976 ----a-w- c:\windows\system32\atitmm64.dll
2013-12-06 20:22 . 2013-12-06 20:22 1144320 ----a-w- c:\windows\system32\atiadlxx.dll
2013-12-06 20:22 . 2013-12-06 20:22 825344 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2013-12-06 20:22 . 2013-12-06 20:22 74752 ----a-w- c:\windows\system32\atig6pxx.dll
2013-12-06 20:22 . 2013-12-06 20:22 69632 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2013-12-06 20:22 . 2013-12-06 20:22 69632 ----a-w- c:\windows\system32\atiglpxx.dll
2013-12-06 20:22 . 2013-12-06 20:22 100352 ----a-w- c:\windows\system32\atig6txx.dll
2013-12-06 20:21 . 2013-12-06 20:21 96768 ----a-w- c:\windows\SysWow64\atigktxx.dll
2013-12-06 20:21 . 2013-12-06 20:21 626176 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2013-12-06 20:18 . 2013-12-06 20:18 43520 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2013-12-06 15:49 . 2013-12-06 15:49 51200 ----a-w- c:\windows\system32\kdbsdk64.dll
2013-12-06 15:44 . 2013-12-06 15:44 38912 ----a-w- c:\windows\SysWow64\kdbsdk32.dll
2013-12-04 03:28 . 2014-02-13 12:43 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CF91F9F6-1A6E-48C6-BC8A-0B4769C5A378}\mpengine.dll
2013-11-23 18:26 . 2013-12-11 14:34 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-11 14:34 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-19 21:07 . 2013-11-19 21:07 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-19 21:07 . 2013-11-19 21:07 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-19 21:07 . 2013-11-19 21:07 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-19 21:07 . 2013-11-19 21:07 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-19 21:07 . 2013-11-19 21:07 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-19 21:07 . 2013-11-19 21:07 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-19 21:07 . 2013-11-19 21:07 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-19 21:07 . 2013-11-19 21:07 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-19 21:07 . 2013-11-19 21:07 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-19 21:07 . 2013-11-19 21:07 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-19 21:07 . 2013-11-19 21:07 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-19 21:07 . 2013-11-19 21:07 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-19 21:07 . 2013-11-19 21:07 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-19 21:07 . 2013-11-19 21:07 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-19 21:07 . 2013-11-19 21:07 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-19 21:07 . 2013-11-19 21:07 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-19 21:07 . 2013-11-19 21:07 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-19 21:07 . 2013-11-19 21:07 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-19 21:07 . 2013-11-19 21:07 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-19 21:07 . 2013-11-19 21:07 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-19 21:07 . 2013-11-19 21:07 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-19 21:07 . 2013-11-19 21:07 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-19 21:07 . 2013-11-19 21:07 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-19 21:07 . 2013-11-19 21:07 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-19 21:07 . 2013-11-19 21:07 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-19 21:07 . 2013-11-19 21:07 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-19 21:07 . 2013-11-19 21:07 774144 ----a-w- c:\windows\system32\jscript.dll
2010-11-05 01:58 32768 --sh--w- c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2014-02-12 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}]
2013-12-20 21:02 12240 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-4300-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll" [2013-12-20 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-4300-7a786e7484d7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HydraVisionMDEngine"="c:\program files (x86)\ATI Technologies\HydraVision\HydraMD.exe" [2011-07-07 569344]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-07-07 393216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]
"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-09 684600]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-12-20 1778640]
"VNT"="c:\program files (x86)\VNT\vntldr.exe" [2013-12-20 202192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 CGVPNCliService;CyberGhost 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]
R2 e81a9dc1;GS-Supporter;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]
R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [x]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 ArcService;Arc Service;c:\users\Pc\Desktop\ArcService.exe;c:\users\Pc\Desktop\ArcService.exe [x]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL85n64;Realtek 8180/8185 Extensible 802.11-Drahtlosgerätetreiber;c:\windows\system32\DRIVERS\RTL85n64.sys;c:\windows\SYSNATIVE\DRIVERS\RTL85n64.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]
R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]
R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]
R3 X6va015;X6va015;c:\windows\SysWOW64\Drivers\X6va015;c:\windows\SysWOW64\Drivers\X6va015 [x]
R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]
R4 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]
R4 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R4 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]
S2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 hxctlflt;hxctlflt;c:\windows\system32\Drivers\hxctlflt.sys;c:\windows\SYSNATIVE\Drivers\hxctlflt.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 15:20 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-05 19:55]
.
2014-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]
.
2014-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]
.
2014-02-12 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2014-02-12 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:51]
.
2014-02-12 c:\windows\Tasks\PC Health Advisor Defrag.job
- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
2014-02-12 c:\windows\Tasks\PC Health Advisor.job
- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}]
2013-12-20 21:02 13776 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20}]
c:\programdata\FuNDeaulls\DD2qL.x64.dll [BU]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4}]
c:\programdata\50Coeuupons\gKoa.x64.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-4300-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" [2013-12-20 13776]
.
[HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-4300-7A786E7484D7}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-04-11 03:35 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-04-11 03:35 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-20 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-20 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-20 418328]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
IE: Mit Mipony herunterladen - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
Trusted Zone: aeriagames.com
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} -
FF - ProfilePath - c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-12-18 17:14; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - user.js: extensions.ividi.tlbrSrchUrl - hxxp://search.ividi.org/?src=tbsp&id=2895594900000000000000240103dca8&affilt=3&q=
FF - user.js: extensions.ividi.id - 2895594900000000000000240103dca8
FF - user.js: extensions.ividi.appId - {685F23D9-FCFD-475C-B56A-362645945C5A}
FF - user.js: extensions.ividi.instlDay - 15989
FF - user.js: extensions.ividi.vrsn - 1.8.23.0
FF - user.js: extensions.ividi.vrsni - 1.8.23.0
FF - user.js: extensions.ividi.vrsnTs - 1.8.23.014:19
FF - user.js: extensions.ividi.prtnrId - ividi
FF - user.js: extensions.ividi.prdct - ividi
FF - user.js: extensions.ividi.aflt - 3
FF - user.js: extensions.ividi.smplGrp - none
FF - user.js: extensions.ividi.tlbrId - base
FF - user.js: extensions.ividi.instlRef -
FF - user.js: extensions.ividi.dfltLng -
FF - user.js: extensions.ividi.excTlbr - true
FF - user.js: extensions.ividi.ffxUnstlRst - false
FF - user.js: extensions.ividi.admin - false
FF - user.js: extensions.ividi.autoRvrt - false
FF - user.js: extensions.ividi.rvrt - false
FF - user.js: extensions.ividi.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Load - c:\users\Pc\AppData\Roaming\vbc.exe
AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.8.3.8\uninstall.exe
AddRemove-BattleForGraxia - c:\users\Pc\Desktop\uninstall.exe
AddRemove-Roma Surrectum Deutsch 1.1.0.5 - c:\program files (x86)\Activision\Rome - Total War\Mods\Uninstall.exe
AddRemove-Roma Surrectum II - c:\program files (x86)\Activision\Rome - Total War\Mods\uninst.exe
AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe
AddRemove-Special Force 2 Beta_is1 - c:\program files (x86)\SpecialForce2Beta\unins000.exe
AddRemove-YTKaraoke@DacSoft.org - c:\program files (x86)\YTKaraoke\uninstall.exe
AddRemove-{478472F9-9E09-492A-BDAB-42EE595EF1AD} - c:\programdata\FuNDeaulls\DD2qL.exe
AddRemove-{4820778D-AB0D-6D18-C316-52A6A0E1D507} - c:\programdata\YoutubeAdblocker\TWJ1VQCit.exe
AddRemove-{5F189DF5-2D05-472B-9091-84D9848AE48B}{e81a9dc1} - c:\progra~2\GS-ENA~1\Browsafe.dll
AddRemove-{74A84478-70A5-4F7A-966C-FA2771FF91A5}_is1 - c:\users\Pc\Desktop\Downloads\Cracks\Die Gilde\Die Gilde 2 - King Edition\unins000.exe
AddRemove-{A35CA8FF-CB7D-8361-1CB9-83219CD11C78} - c:\programdata\surf aand kEEp\3Lwcvkkk.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va012]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va013]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va013"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va015]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va015"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\SecuROM\License information*]
"datasecu"=hex:43,48,2f,01,a8,3f,a0,25,9e,c0,d9,1e,5e,c3,db,5d,ba,eb,05,e2,2e,
74,eb,bc,e8,2e,42,2e,69,b5,96,e7,8d,49,8b,bc,8b,14,15,6d,cb,54,62,ae,12,f4,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}]
@DACL=(02 0000)
@="Pokki"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-02-13 14:29:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-02-13 13:29
.
Vor Suchlauf: 25 Verzeichnis(se), 274.137.358.336 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 273.541.971.968 Bytes frei
.
- - End Of File - - 19B7400F2714F0917436FB662D22E1B9
A36C5E4F47E84449FF07ED3517B43A31
Und das ist der Link: https://www.virustotal.com/de/file/b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e/analysis/1392299159/ |
|
13.02.2014, 21:13
| #10 |
| /// Malwareteam | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter 2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb
C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Bitte deinstalliere folgende Programme:
Windows XP: Start -> Systemsteuerung -> Kategorieansicht auswählen (falls nicht voreingestellt) -> Softwareund wähle die angegeben Programme aus. Drücke Entfernen (Windows XP) oder Deinstallieren (Windows Vista/7). Schritt 3 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 5 Starte noch einmal FRST.
Poste folgende Logfiles in deiner nächsten Antwort:
__________________ Gruß, Jonas |
|
13.02.2014, 22:44
| #11 |
| | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Ich konnte nicht den GS-Supporter 1.80 und Quickshare löschen. Ich habe gemerkt, das eine der svchost.exe Prozesse folgenden Pfad hat: C:\windows\sysWOW64\svchost.exe . Der Dienst ist Akamai NetSession Interface (Akamai) Nun zu den Logs: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-02-2014 01
Ran by Pc at 2014-02-13 21:36:11 Run:2
Running from C:\Users\Pc\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj
2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz
2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb
C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll
*****************
C:\Users\Pc\cc4j5zs76kd2kj => Moved successfully.
C:\Users\Pc\aoajz => Moved successfully.
C:\Users\Pc\xripb => Moved successfully.
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll" => File/Directory not found.
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll" => File/Directory not found.
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll" => File/Directory not found.
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll" => File/Directory not found.
==== End of Fixlog ====
Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 13/02/2014 um 22:05:06
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Enterprise Service Pack 1 (64 bits)
# Benutzername : Pc - PC-PC
# Gestartet von : C:\Users\Pc\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\ParetoLogic
Ordner Gelöscht : C:\ProgramData\50Coeuupons
Ordner Gelöscht : C:\Program Files (x86)\BabylonToolbar
Ordner Gelöscht : C:\Program Files (x86)\Delta
Ordner Gelöscht : C:\Program Files (x86)\ExpressFiles
Ordner Gelöscht : C:\Program Files (x86)\Movie2KDownloader.com
Ordner Gelöscht : C:\Program Files (x86)\ParetoLogic
Ordner Gelöscht : C:\Program Files (x86)\Yontoo
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Program Files (x86)\Common Files\ParetoLogic
Ordner Gelöscht : C:\Windows\SysWOW64\Searchprotect
Ordner Gelöscht : C:\Users\Pc\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\Pc\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\Pc\AppData\Local\Searchprotect
Ordner Gelöscht : C:\Users\Pc\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\Pc\AppData\Local\torch
Ordner Gelöscht : C:\Users\Pc\AppData\Local\Wajam
Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Toolbar4
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\DriverCure
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\ExpressFiles
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\ParetoLogic
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\SeeSimilar
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Movie2KDownloader.com
Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qtrax Player.lnk
Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml
Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Dealply
Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyUpdate
Datei Gelöscht : C:\Windows\System32\Tasks\DSite
Datei Gelöscht : C:\Windows\System32\Tasks\EPUpdater
Datei Gelöscht : C:\Windows\Tasks\paretologic registration3.job
Datei Gelöscht : C:\Windows\System32\Tasks\paretologic registration3
Datei Gelöscht : C:\Windows\Tasks\paretologic update version3.job
Datei Gelöscht : C:\Windows\System32\Tasks\paretologic update version3
Datei Gelöscht : C:\Windows\Tasks\PC Health Advisor Defrag.job
Datei Gelöscht : C:\Windows\System32\Tasks\PC Health Advisor Defrag
Datei Gelöscht : C:\Windows\Tasks\PC Health Advisor.job
Datei Gelöscht : C:\Windows\System32\Tasks\PC Health Advisor
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{77BEC163-D389-42c1-91A4-C758846296A5}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fmfnfnpmhcllokmkepffndflpnadjmma
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\khialnikbocfgkohdegnebhmmaifoglp
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHost.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Movie2KDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Movie2KDownloader_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Movie2KDownloader_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater
Schlüssel Gelöscht : HKCU\Software\59ed7dcb135e848
Schlüssel Gelöscht : HKCU\Software\cefbaeacdccceac
Schlüssel Gelöscht : HKCU\Software\cefbaeacdccceasacfsfdsf
Schlüssel Gelöscht : HKLM\SOFTWARE\59ed7dcb135e848
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SMTTB2009.IEToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SMTTB2009.IEToolbar.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SMTTB2009
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SMTTB2009.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_instagram-downloader_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_instagram-downloader_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_per_yu-gi-oh-online-3_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_per_yu-gi-oh-online-3_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{8D5CFE57-B0FD-4396-97A2-DFD0B7DA935B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{338B4DFE-2E2C-4338-9E41-E176D497299E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{77BEC163-D389-42C1-91A4-C758846296A5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E4A994B0-5550-4680-A4C6-B9470B888069}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\ExpressFiles
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\ParetoLogic
Schlüssel Gelöscht : HKCU\Software\PIP
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Somoto Toolbar
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\ExpressFiles
Schlüssel Gelöscht : HKLM\Software\ParetoLogic
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\Video downloader
Schlüssel Gelöscht : HKLM\Software\Vittalia
Schlüssel Gelöscht : HKLM\Software\Wajam
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3CBF3EBB-235D-4c29-A68B-2BB1F428586E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Video downloader
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77BEC163-D389-42c1-91A4-C758846296A5}_is1
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16518
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E");
Zeile gelöscht : user_pref("extensions.b_20JjldW7E.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self.location.protocol.indexOf('hxxp')>-1 && window.self==window.t[...]
Zeile gelöscht : user_pref("extensions.p_8p2k.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);var d=[...]
Zeile gelöscht : user_pref("extensions.yaioi78idq.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self==window.top){var script=document.createElement('script');scrip[...]
Zeile gelöscht : user_pref("extensions.zfhkTz8.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);var d[...]
*************************
AdwCleaner[R0].txt - [40189 octets] - [13/02/2014 21:51:58]
AdwCleaner[R1].txt - [40309 octets] - [13/02/2014 22:03:14]
AdwCleaner[S0].txt - [335 octets] - [13/02/2014 21:53:21]
AdwCleaner[S1].txt - [38887 octets] - [13/02/2014 22:05:06]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [38948 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Enterprise x64
Ran by Pc on 13.02.2014 at 22:16:46,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\\Default
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\qtrax
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricsmonkey
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\video downloader
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsMonkeyUpdater_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsMonkeyUpdater_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsPal_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsPal_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_130001_1001_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_130001_1001_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsMonkeyUpdater_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsMonkeyUpdater_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsPal_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsPal_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_130001_1001_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_130001_1001_RASMANCS
~~~ Files
Successfully deleted: [File] "C:\Users\Pc\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\ProgramData\youtubeadblocker"
Successfully deleted: [Folder] "C:\Users\Pc\AppData\Roaming\zip opener packages"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Folder] "C:\Users\Pc\music\qtrax media library"
~~~ FireFox
Successfully deleted the following from C:\Users\Pc\AppData\Roaming\mozilla\firefox\profiles\hxtwke4k.default-1377615578566\prefs.js
user_pref("extensions.yaioi78idq.url", "hxxp://getjpi77.info/sync2/?q=hfZ9ofV9CShEAen0rja4rihTB6lKDzt4okmxtNtVh7n0rjrFrTs5rjr9pdaEtMFHhd9FrHwGrHaFrHr9qjkMDMlGojUMAe4Uojr8rHUEq
Emptied folder: C:\Users\Pc\AppData\Roaming\mozilla\firefox\profiles\hxtwke4k.default-1377615578566\minidumps [104 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.02.2014 at 22:29:38,32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-02-2014 01
Ran by Pc (administrator) on PC-PC on 13-02-2014 22:35:18
Running from C:\Users\Pc\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]
CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]
CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]
CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]
CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]
CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]
CHR HKLM-x32\...\Chrome\Extension: [pcoohmdcpejoeggdnihdfhohjgdbllgm] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7C\CRX\ToolbarCR.crx [2013-12-20]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)
R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-13 22:35 - 2014-02-13 22:35 - 00019443 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-13 22:29 - 2014-02-13 22:29 - 00003725 _____ () C:\Users\Pc\Desktop\JRT.txt
2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT
2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe
2014-02-13 22:09 - 2014-02-13 22:09 - 00039497 _____ () C:\Users\Pc\Desktop\AdwCleaner[S1].txt
2014-02-13 21:51 - 2014-02-13 22:05 - 00000000 ____D () C:\AdwCleaner
2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe
2014-02-13 21:35 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip
2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-13 16:40 - 2014-02-13 16:41 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe
2014-02-13 16:40 - 2014-02-13 16:41 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe
2014-02-13 15:18 - 2014-02-13 15:40 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar
2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar
2014-02-13 15:16 - 2014-02-13 15:19 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip
2014-02-13 15:11 - 2014-02-13 15:43 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:18 - 2014-02-13 21:59 - 00110882 _____ () C:\Windows\PFRO.log
2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 21:00 - 2014-02-13 22:07 - 00017808 _____ () C:\Windows\setupact.log
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox
2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt
2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-11 22:27 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:23 - 2014-02-13 22:35 - 00000000 ____D () C:\FRST
2014-02-11 22:22 - 2014-02-13 21:35 - 02152960 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:09 - 2014-02-13 16:47 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
2014-02-13 22:35 - 2014-02-13 22:35 - 00019443 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-13 22:35 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST
2014-02-13 22:32 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0
2014-02-13 22:29 - 2014-02-13 22:29 - 00003725 _____ () C:\Users\Pc\Desktop\JRT.txt
2014-02-13 22:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT
2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe
2014-02-13 22:13 - 2011-05-10 01:27 - 01991375 _____ () C:\Windows\WindowsUpdate.log
2014-02-13 22:11 - 2013-05-21 18:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Codec Pack Packages
2014-02-13 22:09 - 2014-02-13 22:09 - 00039497 _____ () C:\Users\Pc\Desktop\AdwCleaner[S1].txt
2014-02-13 22:08 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-13 22:07 - 2014-02-12 21:00 - 00017808 _____ () C:\Windows\setupact.log
2014-02-13 22:07 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-13 22:07 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-13 22:05 - 2014-02-13 21:51 - 00000000 ____D () C:\AdwCleaner
2014-02-13 22:04 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files
2014-02-13 21:59 - 2014-02-12 21:18 - 00110882 _____ () C:\Windows\PFRO.log
2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe
2014-02-13 21:36 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc
2014-02-13 21:35 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 21:35 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-13 21:35 - 2014-02-11 22:22 - 02152960 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip
2014-02-13 20:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-13 19:45 - 2013-12-30 14:50 - 00000000 ____D () C:\Program Files (x86)\Wargame AirLand Battle
2014-02-13 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-13 16:47 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-13 16:41 - 2014-02-13 16:40 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe
2014-02-13 16:41 - 2014-02-13 16:40 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe
2014-02-13 15:43 - 2014-02-13 15:11 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar
2014-02-13 15:40 - 2014-02-13 15:18 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar
2014-02-13 15:19 - 2014-02-13 15:16 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip
2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt
2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-12 21:07 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat
2014-02-12 21:07 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat
2014-02-12 21:07 - 2009-07-14 06:13 - 01625030 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe
2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-12 20:52 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps
2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar
2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames
2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband
2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2
2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki
2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG
2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite
2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent
2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype
2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt
2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele
2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}
2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment
2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify
2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify
2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler
2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Pc\AppData\Local\Temp\avgnt.exe
C:\Users\Pc\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-11 14:00
==================== End Of Log ============================
--- --- --- --- --- --- |
|
15.02.2014, 15:34
| #12 |
| /// Malwareteam | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
C:\Program Files (x86)\AskPartnerNetwork
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
c:\progra~2\gs-ena~1
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)
C:\Program Files (x86)\VNT
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
C:\Users\Pc\AppData\Local\Pokki
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
C:\Program Files (x86)\YTKaraoke
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
C:\Windows\Tasks\Digital Sites.job
C:\Windows\Tasks\DSite.job
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
Reg: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Bitte deinstalliere Google Chrome vollständig und installiere ihn wieder (je nachdem, ob du diesen verwendest). Schritt 3 ESET Online Scanner
Schritt 4 Starte noch einmal FRST.
Treten noch von dir genannte Probleme auf? Gibt es noch weitere Unstimmigkeiten mit deinem Rechner? Poste folgende Logfiles in deiner nächsten Antwort:
__________________ Gruß, Jonas |
|
17.02.2014, 16:56
| #13 |
| | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Ich habe Eset 8 Stunden lang laufen gelassen und es erreichte 95 %. Danach wurde es beendet und ich hatte um ehrlich zu sein, keine Lust mehr es erneut zu starten. Wenn es nötig ist, kann ich den Vorgang nochmal wiederholen.Es wurden zwar 5 Infektionen gefunden, aber ich hatte nicht die Möglichkeit diese zu entfernen. Außerdem bestehen die beschriebenen Probleme weiterhin (Siehe Anhang). Logs: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-02-2014 01
Ran by Pc at 2014-02-15 20:32:43 Run:3
Running from C:\Users\Pc\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)
C:\Program Files (x86)\AskPartnerNetwork
S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service
c:\progra~2\gs-ena~1
S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)
C:\Program Files (x86)\VNT
SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File
BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]
FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
C:\Users\Pc\AppData\Local\Pokki
FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\
FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
C:\Program Files (x86)\YTKaraoke
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT
2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork
2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar
2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk
2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe
2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites
2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites
2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls
2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp
2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp
C:\Windows\Tasks\Digital Sites.job
C:\Windows\Tasks\DSite.job
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
Reg: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f
*****************
APNMCP => Service deleted successfully.
C:\Program Files (x86)\AskPartnerNetwork => Moved successfully.
e81a9dc1 => Service deleted successfully.
c:\progra~2\gs-ena~1 => Moved successfully.
vToolbarUpdater15.0.0 => Service deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\VNT => Value deleted successfully.
C:\Program Files (x86)\VNT => Moved successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\ToolbarSearchProviderProgress => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.
HKCR\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} => Key deleted successfully.
HKCR\CLSID\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} => Key deleted successfully.
HKCR\CLSID\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-4300-7A786E7484D7} => Value deleted successfully.
HKCR\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-4300-7A786E7484D7} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key not found.
C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi => Moved successfully.
HKCU\Software\MozillaPlugins\pokki.com/PokkiDownloadHelper => Key deleted successfully.
C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll => Moved successfully.
C:\Users\Pc\AppData\Local\Pokki => Moved successfully.
HKCU\Software\Mozilla\Firefox\Extensions\\lyricsmonkey@mendoni.net => Value deleted successfully.
HKCU\Software\Mozilla\Firefox\Extensions\\YTKaraoke@DacSoft.org => Value deleted successfully.
"C:\Program Files (x86)\YTKaraoke" => File/Directory not found.
HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
C:\Users\Pc\AppData\Local\VNT => Moved successfully.
C:\ProgramData\AskPartnerNetwork => Moved successfully.
C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar => Moved successfully.
C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk => Moved successfully.
C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe => Moved successfully.
C:\Users\Pc\AppData\Roaming\DigitalSites => Moved successfully.
C:\Windows\System32\Tasks\Digital Sites => Moved successfully.
C:\ProgramData\FuNDeaulls => Moved successfully.
C:\Program Files (x86)\Unitech LLC => Moved successfully.
C:\ProgramData\surf aand kEEp => Moved successfully.
C:\Program Files (x86)\surf aand kEEp => Moved successfully.
"C:\Windows\Tasks\Digital Sites.job" => File/Directory not found.
"C:\Windows\Tasks\DSite.job" => File/Directory not found.
C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.
C:\ProgramData\TEMP => ":430C6D84" ADS removed successfully.
C:\ProgramData\TEMP => ":DFC5A2B2" ADS removed successfully.
========= reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
The system needs a manual reboot.
==== End of Fixlog ====
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc
# engine=17090
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-15 07:56:52
# local_time=2014-02-15 08:56:52 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=771 16777214 16 1 363676 363676 0 0
# compatibility_mode=5893 16776573 100 94 79912 144124062 0 0
# scanned=1696
# found=1
# cleaned=0
# scan_time=939
sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc
# engine=17090
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-15 08:00:27
# local_time=2014-02-15 09:00:27 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=771 16777214 16 1 360291 360291 0 0
# compatibility_mode=5893 16776573 100 94 76527 144124277 0 0
# scanned=1696
# found=1
# cleaned=0
# scan_time=135
sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc
# engine=17093
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-16 08:37:01
# local_time=2014-02-16 09:37:01 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=771 16777214 16 1 452485 452485 0 0
# compatibility_mode=5893 16776573 100 94 88570 144212871 0 0
# scanned=411507
# found=5
# cleaned=0
# scan_time=29321
sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"
sh=F8027A71143DEF6FCDB04E88CF5B39BF8C08603E ft=0 fh=0000000000000000 vn="VBS/Runner.NBV trojan" ac=I fn="C:\FRST\Quarantine\cc4j5zs76kd2kj13-02-2014_21-36-11\92050.vbs"
sh=958E7DA26C2C86E093A1F40F64775539C61BFDC6 ft=1 fh=f49d817a11669fc4 vn="a variant of Generik.DAZLFYY trojan" ac=I fn="C:\Program Files (x86)\Microsoft Games\Age of Empires II\Age.dll"
sh=D540934F4129BF0469D99DB9A6BA42B17400BAFD ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Pc\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\a6fcaa2-468d1870"
sh=1A3446B261E6B70723619F3002476781BA728D25 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Pc\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\2219a3ae-784affda"
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-02-2014
Ran by Pc (administrator) on PC-PC on 17-02-2014 16:53:48
Running from C:\Users\Pc\Desktop
Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)
HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
==================== Services (Whitelisted) =================
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()
S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)
S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)
R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-17 16:53 - 2014-02-17 16:53 - 00015237 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-16 20:16 - 2014-02-16 20:45 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part4.rar
2014-02-16 18:33 - 2014-02-16 19:03 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part6.rar
2014-02-16 16:11 - 2014-02-16 18:32 - 03398085 _____ () C:\Users\Pc\Downloads\0utl4st.part7.rar
2014-02-16 16:11 - 2014-02-16 16:11 - 00000189 _____ () C:\Users\Pc\Downloads\0utl4st_checksums.sfv
2014-02-16 16:10 - 2014-02-16 16:10 - 03610608 _____ () C:\Users\Pc\Downloads\0utl4st.part2.rar.part
2014-02-15 20:38 - 2014-02-15 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-15 20:36 - 2014-02-15 20:36 - 02347384 _____ (ESET) C:\Users\Pc\Downloads\esetsmartinstaller_enu.exe
2014-02-14 14:24 - 2014-02-14 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT
2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe
2014-02-13 21:51 - 2014-02-13 22:05 - 00000000 ____D () C:\AdwCleaner
2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe
2014-02-13 21:35 - 2014-02-17 16:53 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip
2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-13 16:40 - 2014-02-13 16:41 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe
2014-02-13 16:40 - 2014-02-13 16:41 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe
2014-02-13 15:18 - 2014-02-13 15:40 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar
2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar
2014-02-13 15:16 - 2014-02-13 15:19 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip
2014-02-13 15:11 - 2014-02-13 15:43 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:18 - 2014-02-13 21:59 - 00110882 _____ () C:\Windows\PFRO.log
2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 21:00 - 2014-02-17 16:08 - 00060928 _____ () C:\Windows\setupact.log
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox
2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt
2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-11 22:27 - 2014-02-15 20:31 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-11 22:23 - 2014-02-17 16:53 - 00000000 ____D () C:\FRST
2014-02-11 22:22 - 2014-02-17 16:53 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:09 - 2014-02-13 16:47 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
==================== One Month Modified Files and Folders =======
2014-02-17 16:54 - 2014-02-17 16:53 - 00015237 _____ () C:\Users\Pc\Desktop\FRST.txt
2014-02-17 16:53 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion
2014-02-17 16:53 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST
2014-02-17 16:53 - 2014-02-11 22:22 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe
2014-02-17 16:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-17 16:08 - 2014-02-12 21:00 - 00060928 _____ () C:\Windows\setupact.log
2014-02-17 15:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-17 15:47 - 2011-05-10 01:27 - 01092669 _____ () C:\Windows\WindowsUpdate.log
2014-02-17 15:44 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-17 15:43 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-17 15:43 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-16 21:36 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype
2014-02-16 21:36 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files
2014-02-16 21:36 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files
2014-02-16 20:45 - 2014-02-16 20:16 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part4.rar
2014-02-16 19:03 - 2014-02-16 18:33 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part6.rar
2014-02-16 18:32 - 2014-02-16 16:11 - 03398085 _____ () C:\Users\Pc\Downloads\0utl4st.part7.rar
2014-02-16 18:30 - 2012-11-24 19:22 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-02-16 17:01 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps
2014-02-16 16:11 - 2014-02-16 16:11 - 00000189 _____ () C:\Users\Pc\Downloads\0utl4st_checksums.sfv
2014-02-16 16:10 - 2014-02-16 16:10 - 03610608 _____ () C:\Users\Pc\Downloads\0utl4st.part2.rar.part
2014-02-16 13:27 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat
2014-02-16 13:27 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat
2014-02-16 13:27 - 2009-07-14 06:13 - 01651686 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-15 21:03 - 2012-10-28 12:40 - 00000000 ____D () C:\AeriaGames
2014-02-15 20:38 - 2014-02-15 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-15 20:36 - 2014-02-15 20:36 - 02347384 _____ (ESET) C:\Users\Pc\Downloads\esetsmartinstaller_enu.exe
2014-02-15 20:35 - 2012-10-18 00:39 - 00000000 ____D () C:\Users\Pc\AppData\Local\Google
2014-02-15 20:35 - 2012-10-18 00:39 - 00000000 ____D () C:\Program Files (x86)\Google
2014-02-15 20:31 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus
2014-02-15 14:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-15 14:14 - 2013-08-20 18:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-14 22:09 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client
2014-02-14 14:24 - 2014-02-14 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 22:32 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0
2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT
2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe
2014-02-13 22:11 - 2013-05-21 18:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Codec Pack Packages
2014-02-13 22:05 - 2014-02-13 21:51 - 00000000 ____D () C:\AdwCleaner
2014-02-13 21:59 - 2014-02-12 21:18 - 00110882 _____ () C:\Windows\PFRO.log
2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe
2014-02-13 21:36 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc
2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip
2014-02-13 19:45 - 2013-12-30 14:50 - 00000000 ____D () C:\Program Files (x86)\Wargame AirLand Battle
2014-02-13 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-13 16:47 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games
2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk
2014-02-13 16:41 - 2014-02-13 16:40 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe
2014-02-13 16:41 - 2014-02-13 16:40 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe
2014-02-13 15:43 - 2014-02-13 15:11 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar
2014-02-13 15:40 - 2014-02-13 15:18 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar
2014-02-13 15:19 - 2014-02-13 15:16 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip
2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar
2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip
2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox
2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt
2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt
2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe
2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira
2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira
2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe
2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk
2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg
2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB
2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools
2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe
2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump
2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames
2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013
2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe
2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar
2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk
2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband
2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe
2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip
2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2
2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log
2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable
2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe
2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp
2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE
2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410
2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG
2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe
2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite
2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent
2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder
2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon
2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy
2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe
2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt
2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe
2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe
2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe
2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd
2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost
2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu
2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013
2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele
2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog
2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}
2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment
2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify
2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify
2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5
2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows
2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk
2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
Some content of TEMP:
====================
C:\Users\Pc\AppData\Local\Temp\avgnt.exe
C:\Users\Pc\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-11 14:00
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- Geändert von Redblood (17.02.2014 um 17:03 Uhr) |
|
18.02.2014, 16:37
| #14 | ||
| /// Malwareteam | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung.Zitat:
Zitat:
 ): http://www.akamai.de/html/solutions/client_faq.html. Auch das der svchost.exe Prozess mehrmals läuft ist normal. Kein Grund zur Sorge. Gibt es noch weitere Probleme, startet deine Firewall wieder?
__________________ Gruß, Jonas |
|
18.02.2014, 20:03
| #15 |
| | TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. Achso. Weitere Probleme gibt es nicht. Mein Pc läuft jetzt wieder schnell und die Probleme wurden behoben. Mir macht nur die Auslastung zu schaffen. Ich bin mir nicht sicher, ob es auch früher schon so war. Größere Programme wie Spiele, verbrauchen mehr als 1GB RAM. In diesen Fällen nimmt dann auch die Geschwindigkeit stark ab. Falls dies "normal" sein sollte, dann bedanke ich mich bei dir für die Hilfe  . Redblood |
|
Linear-Darstellung
