| |
| |||||||
Log-Analyse und Auswertung: Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
03.08.2014, 17:41
| #1 |
 |  Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Liebe Trojaner-Board Community, vor ca. 2 Wochen hat mein Virenscanner Avira Free (siehe log unten) nach einem Systemscan gemeldet einen Trojaner gefunden zu haben. Die betroffenen Dateien wurden von Avira in die Quarantäne verschoben. Ca. eine Woche später hatte ich das Problem, dass Dateien von meinen USB-Sticks verschwanden und nur noch Verknüpfungen (mit der c:\windows\system32 Datei) aufschienen. Ich bin mir nicht sicher, ob dieses Problem mit dem genannten Trojanerfund zusammenhängt oder an einem anderen Virus liegt, da ich die betroffenen USB sticks aufgrund einer Reise auf Rechnern von Internetcafes benutzt habe. Glücklicherweise fand ich bei meiner Internetrecherche zu diesem Problem schnell heraus, dass ähnliche Probleme bereits mehrmals auf Trojaner-Board diskutiert und gelöst wurden. Auch habe ich gelesen, dass nicht geraten wird einfach so die selben Schritte zu befolgen, welche bei anderen zur Lösung des Problems führten. Im folgenden möchte ich deswegen die im Thread "Für alle Hilfesuchenden" beschriebenen Logfiles posten, und wäre sehr dankbar für etwas Hilfe. Zuerst kopiere ich den Bericht von Avira, welcher am 17.07 einen Trojaner Fund meldete: Code:
ATTFilter Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 17. Juli 2014 18:34
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : COMPIUTA-PC
Versionsinformationen:
BUILD.DAT : 14.0.5.450 91868 Bytes 24.06.2014 20:39:00
AVSCAN.EXE : 14.0.5.396 1042512 Bytes 04.07.2014 01:14:39
AVSCANRC.DLL : 14.0.5.364 62544 Bytes 04.07.2014 01:14:39
LUKE.DLL : 14.0.5.336 57936 Bytes 04.07.2014 01:15:37
AVSCPLR.DLL : 14.0.5.376 89680 Bytes 04.07.2014 01:14:39
AVREG.DLL : 14.0.5.356 261200 Bytes 04.07.2014 01:14:34
avlode.dll : 14.0.5.396 588368 Bytes 04.07.2014 01:14:32
avlode.rdf : 14.0.4.42 65114 Bytes 17.07.2014 15:02:11
XBV00008.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:03
XBV00009.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:03
XBV00010.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:03
XBV00011.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:03
XBV00012.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:03
XBV00013.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:03
XBV00014.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:04
XBV00015.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:04
XBV00016.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:04
XBV00017.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:04
XBV00018.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:04
XBV00019.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:04
XBV00020.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:04
XBV00021.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:04
XBV00022.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00023.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00024.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00025.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00026.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00027.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00028.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00029.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00030.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:05
XBV00031.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:06
XBV00032.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:06
XBV00033.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:06
XBV00034.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:06
XBV00035.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:06
XBV00036.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:06
XBV00037.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:06
XBV00038.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:06
XBV00039.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:07
XBV00040.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:07
XBV00041.VDF : 8.11.153.142 2048 Bytes 06.06.2014 00:05:07
XBV00118.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:18
XBV00119.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:18
XBV00120.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:19
XBV00121.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:19
XBV00122.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:19
XBV00123.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:19
XBV00124.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:20
XBV00125.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:20
XBV00126.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:20
XBV00127.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:20
XBV00128.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:21
XBV00129.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:21
XBV00130.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:21
XBV00131.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:21
XBV00132.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:22
XBV00133.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:22
XBV00134.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:22
XBV00135.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:23
XBV00136.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:23
XBV00137.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:23
XBV00138.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:23
XBV00139.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:24
XBV00140.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:24
XBV00141.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:24
XBV00142.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:25
XBV00143.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:25
XBV00144.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:25
XBV00145.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:26
XBV00146.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:26
XBV00147.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:26
XBV00148.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:27
XBV00149.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:27
XBV00150.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:27
XBV00151.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:28
XBV00152.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:28
XBV00153.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:28
XBV00154.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:28
XBV00155.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:28
XBV00156.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:29
XBV00157.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:29
XBV00158.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:29
XBV00159.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:30
XBV00160.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:30
XBV00161.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:30
XBV00162.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:31
XBV00163.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:31
XBV00164.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:32
XBV00165.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:32
XBV00166.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:32
XBV00167.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:33
XBV00168.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:33
XBV00169.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:34
XBV00170.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:34
XBV00171.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:34
XBV00172.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:35
XBV00173.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:35
XBV00174.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:35
XBV00175.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:35
XBV00176.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:35
XBV00177.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:36
XBV00178.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:36
XBV00179.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:36
XBV00180.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:37
XBV00181.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:37
XBV00182.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:38
XBV00183.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:38
XBV00184.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:38
XBV00185.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:39
XBV00186.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:39
XBV00187.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:39
XBV00188.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:39
XBV00189.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:40
XBV00190.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:40
XBV00191.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:40
XBV00192.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:40
XBV00193.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:41
XBV00194.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:41
XBV00195.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:41
XBV00196.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:42
XBV00197.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:42
XBV00198.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:43
XBV00199.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:43
XBV00200.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:43
XBV00201.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:44
XBV00202.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:44
XBV00203.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:44
XBV00204.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:44
XBV00205.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:45
XBV00206.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:45
XBV00207.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:45
XBV00208.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:46
XBV00209.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:46
XBV00210.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:46
XBV00211.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:47
XBV00212.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:47
XBV00213.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:48
XBV00214.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:48
XBV00215.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:49
XBV00216.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:49
XBV00217.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:50
XBV00218.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:50
XBV00219.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:51
XBV00220.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:51
XBV00221.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:52
XBV00222.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:52
XBV00223.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:52
XBV00224.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:52
XBV00225.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:53
XBV00226.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:53
XBV00227.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:54
XBV00228.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:57
XBV00229.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:57
XBV00230.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:58
XBV00231.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:58
XBV00232.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:59
XBV00233.VDF : 8.11.159.102 2048 Bytes 08.07.2014 23:59:59
XBV00234.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:01
XBV00235.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:07
XBV00236.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:08
XBV00237.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:08
XBV00238.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:08
XBV00239.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:09
XBV00240.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:09
XBV00241.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:10
XBV00242.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:11
XBV00243.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:11
XBV00244.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:12
XBV00245.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:12
XBV00246.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:13
XBV00247.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:14
XBV00248.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:14
XBV00249.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:15
XBV00250.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:15
XBV00251.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:16
XBV00252.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:16
XBV00253.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:16
XBV00254.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:17
XBV00255.VDF : 8.11.159.102 2048 Bytes 08.07.2014 00:00:17
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:41:06
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 09:41:06
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 09:41:06
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 09:41:06
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 09:41:06
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 09:41:06
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 15:27:47
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 13:29:15
XBV00042.VDF : 8.11.153.142 710656 Bytes 06.06.2014 00:05:08
XBV00043.VDF : 8.11.155.44 1013760 Bytes 16.06.2014 00:05:10
XBV00044.VDF : 8.11.159.102 1662976 Bytes 08.07.2014 23:58:52
XBV00045.VDF : 8.11.159.104 13824 Bytes 08.07.2014 23:58:52
XBV00046.VDF : 8.11.159.108 13312 Bytes 08.07.2014 23:58:53
XBV00047.VDF : 8.11.159.112 30720 Bytes 09.07.2014 19:22:05
XBV00048.VDF : 8.11.159.114 6144 Bytes 09.07.2014 19:22:05
XBV00049.VDF : 8.11.159.116 10240 Bytes 09.07.2014 19:22:05
XBV00050.VDF : 8.11.159.118 5632 Bytes 09.07.2014 19:22:05
XBV00051.VDF : 8.11.159.122 7168 Bytes 09.07.2014 19:22:05
XBV00052.VDF : 8.11.159.126 180736 Bytes 09.07.2014 19:22:08
XBV00053.VDF : 8.11.159.148 174080 Bytes 09.07.2014 19:22:09
XBV00054.VDF : 8.11.159.168 2560 Bytes 09.07.2014 19:22:09
XBV00055.VDF : 8.11.159.188 15360 Bytes 09.07.2014 19:22:09
XBV00056.VDF : 8.11.159.210 25600 Bytes 09.07.2014 13:38:23
XBV00057.VDF : 8.11.159.212 7168 Bytes 09.07.2014 13:38:24
XBV00058.VDF : 8.11.159.218 27648 Bytes 10.07.2014 13:38:24
XBV00059.VDF : 8.11.159.220 2048 Bytes 10.07.2014 13:38:25
XBV00060.VDF : 8.11.159.222 29696 Bytes 10.07.2014 13:38:25
XBV00061.VDF : 8.11.159.224 167936 Bytes 10.07.2014 13:38:26
XBV00062.VDF : 8.11.159.226 35328 Bytes 10.07.2014 13:38:27
XBV00063.VDF : 8.11.159.230 186368 Bytes 10.07.2014 19:47:43
XBV00064.VDF : 8.11.159.250 16896 Bytes 10.07.2014 19:47:43
XBV00065.VDF : 8.11.159.252 2048 Bytes 10.07.2014 19:47:43
XBV00066.VDF : 8.11.160.16 6144 Bytes 10.07.2014 19:47:43
XBV00067.VDF : 8.11.160.40 17408 Bytes 10.07.2014 02:30:47
XBV00068.VDF : 8.11.160.42 2048 Bytes 11.07.2014 02:30:47
XBV00069.VDF : 8.11.160.46 179200 Bytes 11.07.2014 13:34:14
XBV00070.VDF : 8.11.160.48 203264 Bytes 11.07.2014 00:00:39
XBV00071.VDF : 8.11.160.50 6144 Bytes 11.07.2014 00:00:39
XBV00072.VDF : 8.11.160.52 2048 Bytes 11.07.2014 00:00:39
XBV00073.VDF : 8.11.160.54 2048 Bytes 11.07.2014 00:00:39
XBV00074.VDF : 8.11.160.58 22016 Bytes 11.07.2014 00:00:39
XBV00075.VDF : 8.11.160.60 2048 Bytes 11.07.2014 00:00:39
XBV00076.VDF : 8.11.160.62 8192 Bytes 11.07.2014 00:00:39
XBV00077.VDF : 8.11.160.66 198656 Bytes 12.07.2014 00:00:40
XBV00078.VDF : 8.11.160.68 7168 Bytes 12.07.2014 00:00:40
XBV00079.VDF : 8.11.160.70 14848 Bytes 12.07.2014 00:00:40
XBV00080.VDF : 8.11.160.72 7168 Bytes 12.07.2014 00:00:40
XBV00081.VDF : 8.11.160.92 40448 Bytes 13.07.2014 00:00:40
XBV00082.VDF : 8.11.160.112 2048 Bytes 13.07.2014 00:00:40
XBV00083.VDF : 8.11.160.130 193024 Bytes 13.07.2014 00:00:40
XBV00084.VDF : 8.11.160.132 2048 Bytes 13.07.2014 00:00:40
XBV00085.VDF : 8.11.160.152 20480 Bytes 13.07.2014 00:00:40
XBV00086.VDF : 8.11.160.154 2048 Bytes 13.07.2014 00:00:40
XBV00087.VDF : 8.11.160.156 20992 Bytes 14.07.2014 21:17:40
XBV00088.VDF : 8.11.160.158 2560 Bytes 14.07.2014 21:17:40
XBV00089.VDF : 8.11.160.160 11264 Bytes 14.07.2014 21:17:40
XBV00090.VDF : 8.11.160.162 2560 Bytes 14.07.2014 21:17:40
XBV00091.VDF : 8.11.160.166 14336 Bytes 14.07.2014 21:17:40
XBV00092.VDF : 8.11.160.168 5120 Bytes 14.07.2014 21:17:40
XBV00093.VDF : 8.11.160.178 7168 Bytes 14.07.2014 21:17:40
XBV00094.VDF : 8.11.160.180 2048 Bytes 14.07.2014 21:17:41
XBV00095.VDF : 8.11.160.182 2048 Bytes 14.07.2014 21:17:41
XBV00096.VDF : 8.11.160.188 256000 Bytes 14.07.2014 03:17:41
XBV00097.VDF : 8.11.160.190 7680 Bytes 14.07.2014 03:17:41
XBV00098.VDF : 8.11.160.194 18432 Bytes 15.07.2014 21:30:55
XBV00099.VDF : 8.11.160.212 184832 Bytes 15.07.2014 21:30:55
XBV00100.VDF : 8.11.160.230 289792 Bytes 15.07.2014 21:30:55
XBV00101.VDF : 8.11.160.232 2048 Bytes 15.07.2014 21:30:55
XBV00102.VDF : 8.11.160.234 176128 Bytes 15.07.2014 21:30:57
XBV00103.VDF : 8.11.160.254 18432 Bytes 15.07.2014 03:30:52
XBV00104.VDF : 8.11.161.16 6144 Bytes 16.07.2014 20:10:13
XBV00105.VDF : 8.11.161.32 2048 Bytes 16.07.2014 20:10:13
XBV00106.VDF : 8.11.161.34 2048 Bytes 16.07.2014 20:10:13
XBV00107.VDF : 8.11.161.52 26624 Bytes 16.07.2014 20:10:13
XBV00108.VDF : 8.11.161.68 184832 Bytes 16.07.2014 20:10:14
XBV00109.VDF : 8.11.161.84 2048 Bytes 16.07.2014 20:10:14
XBV00110.VDF : 8.11.162.2 2560 Bytes 16.07.2014 20:10:14
XBV00111.VDF : 8.11.162.6 16896 Bytes 16.07.2014 02:10:10
XBV00112.VDF : 8.11.162.8 24064 Bytes 16.07.2014 02:10:10
XBV00113.VDF : 8.11.162.10 2560 Bytes 16.07.2014 02:10:10
XBV00114.VDF : 8.11.162.14 41472 Bytes 17.07.2014 15:02:12
XBV00115.VDF : 8.11.162.16 2048 Bytes 17.07.2014 15:02:12
XBV00116.VDF : 8.11.162.18 215040 Bytes 17.07.2014 15:02:14
XBV00117.VDF : 8.11.162.22 184320 Bytes 17.07.2014 15:02:16
LOCAL001.VDF : 8.11.162.22 108717056 Bytes 17.07.2014 15:02:44
Engineversion : 8.3.20.34
AEVDF.DLL : 8.3.0.4 118976 Bytes 21.04.2014 15:25:01
AESCRIPT.DLL : 8.1.4.220 532680 Bytes 11.07.2014 13:34:13
AESCN.DLL : 8.3.1.2 135360 Bytes 28.05.2014 19:05:26
AESBX.DLL : 8.2.20.24 1409224 Bytes 08.05.2014 14:27:48
AERDL.DLL : 8.2.0.138 704888 Bytes 25.02.2014 09:41:04
AEPACK.DLL : 8.4.0.42 786632 Bytes 04.07.2014 01:14:22
AEOFFICE.DLL : 8.3.0.10 209096 Bytes 11.07.2014 13:34:11
AEHEUR.DLL : 8.1.4.1160 7229640 Bytes 11.07.2014 13:34:11
AEHELP.DLL : 8.3.1.0 278728 Bytes 28.05.2014 19:05:23
AEGEN.DLL : 8.1.7.28 450752 Bytes 06.06.2014 19:24:22
AEEXP.DLL : 8.4.2.6 237760 Bytes 28.06.2014 14:37:27
AEEMU.DLL : 8.1.3.2 393587 Bytes 25.02.2014 09:41:04
AEDROID.DLL : 8.4.2.24 442568 Bytes 04.06.2014 14:03:32
AECORE.DLL : 8.3.1.4 241864 Bytes 06.06.2014 19:24:22
AEBB.DLL : 8.1.1.4 53619 Bytes 25.02.2014 09:41:04
AVWINLL.DLL : 14.0.5.320 24144 Bytes 04.07.2014 01:14:20
AVPREF.DLL : 14.0.5.320 50256 Bytes 04.07.2014 01:14:34
AVREP.DLL : 14.0.5.320 219216 Bytes 04.07.2014 01:14:35
AVARKT.DLL : 14.0.5.368 226384 Bytes 04.07.2014 01:14:24
AVEVTLOG.DLL : 14.0.5.320 182352 Bytes 04.07.2014 01:14:28
SQLITE3.DLL : 14.0.5.320 452176 Bytes 04.07.2014 01:15:51
AVSMTP.DLL : 14.0.5.320 76368 Bytes 04.07.2014 01:14:40
NETNT.DLL : 14.0.5.320 13392 Bytes 04.07.2014 01:15:37
RCIMAGE.DLL : 14.0.5.320 4998224 Bytes 04.07.2014 01:14:20
RCTEXT.DLL : 14.0.5.322 73808 Bytes 04.07.2014 01:14:20
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Donnerstag, 17. Juli 2014 18:34
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '113' Modul(e) wurden durchsucht
Durchsuche Prozess 'Citavi.exe' - '131' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '254' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'swriter.exe' - '13' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashPlayerPlugin_14_0_0_145.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlashPlayerPlugin_14_0_0_145.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '174' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'SYNTPHELPER.EXE' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'VoipStunt.exe' - '109' Modul(e) wurden durchsucht
Durchsuche Prozess 'Bonus.ScreenshotReader.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'Kies.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPLpr.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTSync.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'KiesTrayAgent.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxsrvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'smax4pnp.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'MotoHelperAgent.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '212' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'xaudio.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'MotoHelperService.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'AEADISRV.EXE' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'NetworkLicenseServer.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '158' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\drivers\beep.sys'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Signiert -> 'C:\Windows\system32\imm32.dll'
Signiert -> 'C:\Windows\system32\dsound.dll'
Signiert -> 'C:\Windows\system32\aclui.dll'
Signiert -> 'C:\Windows\system32\msvcrt.dll'
Signiert -> 'C:\Windows\system32\d3d9.dll'
Signiert -> 'C:\Windows\system32\dnsapi.dll'
Signiert -> 'C:\Windows\system32\mshtml.dll'
Signiert -> 'C:\Windows\system32\regsvr32.exe'
Signiert -> 'C:\Windows\system32\rundll32.exe'
Signiert -> 'C:\Windows\system32\userinit.exe'
Signiert -> 'C:\Windows\system32\reg.exe'
Signiert -> 'C:\Windows\system32\ntvdm.exe'
Signiert -> 'C:\Windows\regedit.exe'
Die Systemdateien wurden durchsucht ('35' Dateien)
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1681' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
[0] Archivtyp: Runtime Packed
--> C:\Users\Compiuta\AppData\Local\Temp\system_auto_.zip
[1] Archivtyp: ZIP
--> system_auto_.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.82398
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Compiuta\AppData\Local\Temp\system_auto_.zip
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.82398
Beginne mit der Desinfektion:
C:\Users\Compiuta\AppData\Local\Temp\system_auto_.zip
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.82398
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5122b0f3.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 17. Juli 2014 20:17
Benötigte Zeit: 1:40:53 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
27045 Verzeichnisse wurden überprüft
820272 Dateien wurden geprüft
2 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
820270 Dateien ohne Befall
26639 Archive wurden durchsucht
1 Warnungen
1 Hinweise
461809 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
Als nächstes kopiere ich den Log von defogger_disable: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:18 on 03/08/2014 (Compiuta)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 03-08-2014 15:55:36
Running from C:\Users\Compiuta\Downloads
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
(VoipStunt) C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Google Update] => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-05-17] (Google Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-03] ()
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\MountPoints2: {0b5e766e-f299-11e3-bc74-00197de848f3} - E:\setup.exe -a
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4c69.js ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-03 15:55 - 2014-08-03 15:56 - 00009656 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:55 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Downloads\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00001244 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:19 - 2014-07-06 23:46 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:43 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
2014-07-06 18:51 - 2014-04-11 10:39 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2014-07-06 18:51 - 2014-04-11 10:39 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-03 15:56 - 2014-08-03 15:55 - 00009656 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:55 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Downloads\FRST.exe
2014-08-03 15:49 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-03 15:48 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-03 15:48 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-03 15:48 - 2014-01-04 20:06 - 01138755 _____ () C:\Windows\WindowsUpdate.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 11:57 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-03 11:40 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-03 11:40 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-03 11:00 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-03 10:59 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-03 10:59 - 2009-07-14 06:39 - 00040893 _____ () C:\Windows\setupact.log
2014-08-03 10:57 - 2014-08-03 10:57 - 00001244 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2010-11-20 23:48 - 00110668 _____ () C:\Windows\PFRO.log
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:46 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:46 - 2014-07-06 23:19 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:09 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\VirtualStore
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
2014-07-04 03:14 - 2014-04-21 17:20 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
Some content of TEMP:
====================
C:\Users\1\AppData\Local\Temp\avgnt.exe
C:\Users\1\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\1\AppData\Local\Temp\fp_pl_pfs_installer-2.exe
C:\Users\1\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Compiuta\AppData\Local\Temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Compiuta\AppData\Local\Temp\MotoHelper_2.0.51_Driver_5.2.0.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-15 01:40
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:2-08-2014
Ran by Compiuta at 2014-08-03 15:56:26
Running from C:\Users\Compiuta\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY PDF Transformer 3.0 (HKLM\...\ABBYY PDF Transformer 3.0) (Version: 3.00.162.6808 - ABBYY)
ABBYY PDF Transformer 3.0 (Version: 3.00.162.6808 - ABBYY) Hidden
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
BitTorrent Sync (HKLM\...\BitTorrent Sync) (Version: 1.3.93 - )
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4643 - CDBurnerXP)
Citavi (HKLM\...\{E12C6653-1FF0-4686-ADB8-589C13AE761F}) (Version: 3.3.0.0 - Swiss Academic Software)
FileZilla Client 3.8.1 (HKLM\...\FileZilla Client) (Version: 3.8.1 - Tim Kosse)
Freeciv 2.4.2 (GTK+2 client) (HKLM\...\Freeciv-2.4.2-gtk2) (Version: - )
Google Talk Plugin (HKLM\...\{C1E3DFE7-4EAD-3E9E-A826-E06055BA5921}) (Version: 5.4.2.18903 - Google)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1867 - Intel Corporation)
Java 7 Update 65 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.650 - Oracle)
Java Auto Updater (Version: 2.1.65.20 - Oracle, Inc.) Hidden
LibreOffice 4.2.3.3 (HKLM\...\{4117DF3C-6677-4A22-90B7-FF06923417E9}) (Version: 4.2.3.3 - The Document Foundation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MotoHelper 2.0.51 Driver 5.2.0 (HKLM\...\MotoHelper) (Version: 2.0.51 - Motorola)
MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden
Motorola Mobile Drivers Installation 5.2.0 (Version: 5.2.0 - Motorola Inc.) Hidden
Mozilla Firefox 31.0 (x86 de) (HKLM\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - )
Paint.NET v3.5.11 (HKLM\...\{72EF03F5-0507-4861-9A44-D99FD4C41417}) (Version: 3.61.0 - dotPDN LLC)
Panda Cloud Cleaner (HKLM\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.103 - Panda Security)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.43.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.14 (HKLM\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.14.104 - Skype Technologies S.A.)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.27614 - TeamViewer)
ThinkPad Modem (HKLM\...\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588) (Version: 7.62.00 - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VoipStunt (HKLM\...\VoipStunt_is1) (Version: 4.14 build 745 - Finarea S.A. Switzerland)
XnView 2.22 (HKLM\...\XnView_is1) (Version: 2.22 - Gougelet Pierre-e)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Google Talk Plugin\googletalkax.dll (Google)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{6B148769-693E-2428-2817-00DCDC203B60}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Google Talk Plugin\o1dax.dll (Google)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4045813022-1567936593-3779010734-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
==================== Restore Points =========================
15-07-2014 13:52:31 Windows Update
17-07-2014 15:23:44 Installed Java 7 Update 65
03-08-2014 08:41:39 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {36BF9DA8-82B6-4A1F-99EC-9DCA66BD2149} - System32\Tasks\MotoHelper Routing => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {5EC7BDEC-B42F-4C73-96E4-936A6FB8EBA6} - System32\Tasks\MotoHelper Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {8D8A696C-4AD5-4F11-8B4B-32055B056A69} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {950AD6BA-35F6-4F17-A700-75738312D2C3} - System32\Tasks\MotoHelper MUM => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
Task: {AACF1C90-959A-4E11-96EE-E1F5B2B31584} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-17] (Google Inc.)
Task: {D11F31FB-2B10-48FD-84BE-737E56A6E8B9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-17] (Google Inc.)
Task: {D8822A8C-86CE-4D92-AA83-274EC1461347} - System32\Tasks\{922E80DD-2C1B-4E99-8118-0EBFF0B2DEBF} => C:\Program Files\Panda Security\Panda Cloud Cleaner\PCloudCleaner.exe [2014-03-07] ()
Task: {F580DC84-6D40-4B65-9418-D31E3156F9A8} - System32\Tasks\MotoHelper Initial Update => C:\Program Files\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-04-26] ()
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job => C:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-04-26 22:23 - 2011-04-26 22:23 - 00223088 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
2014-06-01 11:08 - 2014-06-01 11:08 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2014-05-24 18:41 - 2014-05-24 18:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 18:41 - 2014-05-24 18:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll
2011-04-26 22:22 - 2011-04-26 22:22 - 00681840 _____ () C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
2014-06-29 19:50 - 2014-06-29 19:50 - 00186368 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Commonc65c5a95#\75cd8ee7e3164f7b18c76a2c7668b2d0\Kies.Common.DeviceServiceLib.Interface.ni.dll
2014-06-29 19:51 - 2014-06-29 19:51 - 14993920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\e6f83b1e807b714f177c5cc236b100fa\Kies.Theme.ni.dll
2014-06-29 19:50 - 2014-06-29 19:50 - 01865728 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\f901a89aaacd0658db1b88188f5b1df6\Kies.UI.ni.dll
2014-06-29 19:50 - 2014-06-29 19:50 - 00081920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\ea6f79f5bd31f9e22b4fff87d4f39050\Kies.MVVM.ni.dll
2014-05-09 17:39 - 2014-05-09 17:39 - 00236032 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\cffeb31975c17760187d713cf2d7934d\ASF_cSharpAPI.ni.dll
2014-07-31 11:12 - 2014-07-31 11:12 - 03800688 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-07-09 01:59 - 2014-07-09 01:59 - 17029808 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/03/2014 11:01:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/03/2014 10:57:13 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/03/2014 10:50:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/26/2014 06:33:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0xf4c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/24/2014 04:39:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/20/2014 10:02:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x98c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/15/2014 03:01:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058dfb
ID des fehlerhaften Prozesses: 0x1bb8
Startzeit der fehlerhaften Anwendung: 0xGoogleUpdate.exe0
Pfad der fehlerhaften Anwendung: GoogleUpdate.exe1
Pfad des fehlerhaften Moduls: GoogleUpdate.exe2
Berichtskennung: GoogleUpdate.exe3
Error: (07/13/2014 03:26:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GoogleUpdate.exe, Version: 1.3.21.103, Zeitstempel: 0x4f3c6d6c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00058dfb
ID des fehlerhaften Prozesses: 0x2a8
Startzeit der fehlerhaften Anwendung: 0xGoogleUpdate.exe0
Pfad der fehlerhaften Anwendung: GoogleUpdate.exe1
Pfad des fehlerhaften Moduls: GoogleUpdate.exe2
Berichtskennung: GoogleUpdate.exe3
Error: (07/10/2014 01:20:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/26/2014 01:07:06 AM) (Source: ESENT) (EventID: 623) (User: )
Description: wuaueng.dll (864) SUS20ClientDataStore: Der Versionsspeicher für Instanz 0 hat seine maximale Größe von 32 MB erreicht. Wahrscheinlich verhindert eine lange andauernde Transaktion die Bereinigung des Versionsspeichers und vergrößert ihn. Aktualisierungen werden zurückgewiesen, bis für die betreffende Transaktion ein vollständiger Commit- oder Rollbackvorgang durchgeführt wurde.
Mögliche lange andauernde Transaktion:
Sitzungs-ID: 0x01040320
Sitzungskontext: 0x00000000
Thread-ID des Sitzungskontextes: 0x00000CBC
Cleanup: 1
System errors:
=============
Error: (08/03/2014 01:17:51 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (08/03/2014 01:17:50 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (08/03/2014 01:17:50 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (08/03/2014 01:17:49 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (07/31/2014 10:28:25 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{42DD7035-F2BF-43DD-BD2C-B38497880A6A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (07/29/2014 05:08:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TeamViewer9 erreicht.
Error: (07/28/2014 04:35:21 PM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{42DD7035-F2BF-43DD-BD2C-B38497880A6A} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (07/28/2014 02:50:26 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.
Error: (07/21/2014 03:55:30 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.
Error: (07/07/2014 04:31:31 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.
Microsoft Office Sessions:
=========================
Error: (08/03/2014 11:01:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/03/2014 10:57:13 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/03/2014 10:50:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/26/2014 06:33:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141bf4c01cfa87fa56174afC:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dll86035f2c-14e2-11e4-8b0a-00197de848f3
Error: (07/24/2014 04:39:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/20/2014 10:02:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b98c01cf9bcc878614d5C:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dllbcf6543a-1048-11e4-b876-00197de848f3
Error: (07/15/2014 03:01:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: GoogleUpdate.exe1.3.21.1034f3c6d6cntdll.dll6.1.7601.18247521ea91cc000000500058dfb1bb801cf9fc7731db24dC:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exeC:\Windows\SYSTEM32\ntdll.dll8cf8495b-0bbb-11e4-b876-00197de848f3
Error: (07/13/2014 03:26:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: GoogleUpdate.exe1.3.21.1034f3c6d6cntdll.dll6.1.7601.18247521ea91cc000000500058dfb2a801cf9e386340bdabC:\Users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exeC:\Windows\SYSTEM32\ntdll.dllc1904e49-0a2c-11e4-b876-00197de848f3
Error: (07/10/2014 01:20:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/26/2014 01:07:06 AM) (Source: ESENT) (EventID: 623) (User: )
Description: wuaueng.dll864SUS20ClientDataStore: 0320x010403200x000000000x00000CBC1
==================== Memory info ===========================
Percentage of memory in use: 47%
Total physical RAM: 2550.43 MB
Available physical RAM: 1344.64 MB
Total Pagefile: 5099.15 MB
Available Pagefile: 3783.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1917.01 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.79 GB) (Free:23.51 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 3F673AB5)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-03 18:07:19
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Samsung_SSD_840_Series rev.DXT07B0Q 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\Compiuta\AppData\Local\Temp\pfryrkoc.sys
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 81E8DA15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 81EC7212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00197de848f3
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00197de848f3 (not active ControlSet)
---- EOF - GMER 2.1 ----
Ich hoffe ich habe soweit alles richtig gemacht und würde mich wahnsinnig über Hilfe freuen, da ich mit meinen Computerkenntnissen an dieser Stelle nicht weiter weiß. Im Prinzip befürchte ich, dass es die beste Lösung sein wird den Computer zu formatieren. Da jedoch Dateien von meinen USB-Sticks verschwunden sind, sehe ich beim jetzigen Zustand des Computers nicht einmal wirklich sichere Möglichkeiten wichtige Dateien zu sichern, weswegen eine Behebung des Problems vorerst ohne Formatieren sehr wichtig wäre. Zudem wäre es natürlich wichtig für mich zu wissen, welche gefahren von dem Trojaner/Virus ausgehen, so dass ich mich gegebenfalls mit meiner Bank und so weiter in Verbindung setze. Vielen Dank schonmal!!! LG Fred |
|
03.08.2014, 17:48
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden hi,
__________________ Panda USB Vaccine Bitte lade Dir von hier Panda USB Vaccine herunter.
Scan mit Combofix
__________________ |
|
03.08.2014, 19:20
| #3 |
| | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi,
__________________vielen, vielen Dank für die schnelle Antwort! Ich werde mich gleich dranklemmen. Es könnte ein paar Minuten dauern, bis ich die beschriebenen Aktionen durchführen kann, da auch Panda USB Vaccine sich im Normalmodus nicht starten lässt (und ich befürchte dies wird auch für Combofix zutreffen). Soll ich beide im abgesicherten Modus Starten? LG Fred Hi, also jetzt habe ich meinen Computer wie beschrieben mit Panda USB Vaccine geimpft und den Scan mit Combofix laufen lassen. Beide Prozesse habe ich im abgesicherten Modus laufen lassen. Hier poste ich nun den Log von Combofix: Code:
ATTFilter ComboFix 14-08-02.02 - Compiuta 03.08.2014 20:07:12.1.2 - x86 MINIMAL
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.2550.2200 [GMT 2:00]
ausgeführt von:: c:\users\Compiuta\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Compiuta\AppData\Roaming\0a3
c:\users\Compiuta\AppData\Roaming\0a3\1c2b1.js
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-07-03 bis 2014-08-03 ))))))))))))))))))))))))))))))
.
.
2014-08-03 18:04 . 2014-08-03 18:04 -------- d-----w- c:\programdata\Panda Security
2014-08-03 18:03 . 2014-08-03 18:03 -------- d-----w- c:\program files\Panda USB Vaccine
2014-08-03 18:01 . 2014-08-03 18:01 46974 ----a-w- c:\users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\496a.js
2014-08-03 17:00 . 2014-08-03 17:59 46974 ----a-w- c:\users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\406.js
2014-08-03 13:55 . 2014-08-03 13:57 -------- d-----w- C:\FRST
2014-08-03 08:57 . 2013-04-29 07:17 47632 ----a-w- c:\windows\system32\drivers\PSKMAD.sys
2014-08-03 08:57 . 2014-08-03 08:57 -------- d-----w- c:\program files\Panda Security
2014-08-03 08:42 . 2014-05-14 16:23 45536 ----a-w- c:\windows\system32\wups2.dll
2014-08-03 08:42 . 2014-05-14 16:23 54240 ----a-w- c:\windows\system32\wuauclt.exe
2014-08-03 08:42 . 2014-05-14 16:23 1973728 ----a-w- c:\windows\system32\wuaueng.dll
2014-08-03 08:42 . 2014-05-14 16:17 2425856 ----a-w- c:\windows\system32\wucltux.dll
2014-08-03 08:42 . 2014-05-14 16:23 36320 ----a-w- c:\windows\system32\wups.dll
2014-08-03 08:42 . 2014-05-14 16:23 581600 ----a-w- c:\windows\system32\wuapi.dll
2014-08-03 08:42 . 2014-05-14 16:17 92672 ----a-w- c:\windows\system32\wudriver.dll
2014-08-03 08:41 . 2014-05-14 07:23 179656 ----a-w- c:\windows\system32\wuwebv.dll
2014-08-03 08:41 . 2014-05-14 07:17 33792 ----a-w- c:\windows\system32\wuapp.exe
2014-07-31 09:32 . 2009-06-22 16:58 89600 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\HPZPPLHN.DLL
2014-07-23 23:07 . 2014-07-23 23:07 -------- d-----w- C:\0b64
2014-07-20 02:35 . 2014-07-20 02:42 -------- d-----w- c:\users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 19:50 . 2014-07-19 19:50 -------- d-----w- c:\program files\Freeciv-2.4.2-gtk2
2014-07-17 15:24 . 2014-07-17 15:24 -------- d-----w- c:\program files\Common Files\Java
2014-07-17 15:24 . 2014-07-11 01:02 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-07-14 17:55 . 2014-07-14 18:06 -------- d-----w- c:\users\Compiuta\AppData\Roaming\Audacity
2014-07-09 15:19 . 2014-06-03 09:29 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2014-07-09 15:19 . 2014-06-03 09:29 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2014-07-09 15:19 . 2014-06-03 09:29 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2014-07-09 15:19 . 2014-06-03 09:29 989184 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2014-07-09 15:14 . 2014-06-05 14:26 1059840 ----a-w- c:\windows\system32\lsasrv.dll
2014-07-09 15:02 . 2014-06-18 01:52 868864 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-07-09 15:02 . 2014-06-18 01:52 399360 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
2014-07-09 15:02 . 2014-06-18 01:52 348672 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tiptsf.dll
2014-07-09 15:02 . 2014-06-18 01:52 104448 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll
2014-07-09 15:02 . 2014-06-18 01:51 181760 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TabTip.exe
2014-07-09 15:02 . 2014-06-18 01:51 646144 ----a-w- c:\windows\system32\osk.exe
2014-07-09 15:02 . 2014-06-18 01:50 544768 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TipRes.dll
2014-07-09 15:02 . 2014-06-18 00:52 2350080 ----a-w- c:\windows\system32\win32k.sys
2014-07-09 15:02 . 2014-06-06 09:44 509440 ----a-w- c:\windows\system32\qedit.dll
2014-07-09 15:02 . 2014-05-30 06:36 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2014-07-08 12:33 . 2014-07-08 12:33 -------- d-----w- c:\program files\MSXML 4.0
2014-07-06 21:19 . 2014-07-06 21:46 -------- d-----w- c:\users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 21:19 . 2014-07-06 21:19 -------- d-----w- c:\program files\VoipStunt.com
2014-07-06 17:43 . 2014-07-19 20:26 -------- d-----w- c:\users\Compiuta\AppData\Roaming\XnView
2014-07-06 17:08 . 2014-07-06 17:08 -------- d-----w- c:\program files\Common Files\Motorola Shared
2014-07-06 17:08 . 2014-07-06 17:08 -------- d-----w- c:\program files\Motorola
2014-07-06 16:51 . 2014-04-11 08:39 89856 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2014-07-06 16:51 . 2014-04-11 08:39 184192 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-24 16:50 . 2014-04-21 15:30 35848 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-07-08 23:59 . 2014-04-29 19:30 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 23:59 . 2014-04-29 19:30 699056 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-07-04 01:14 . 2014-04-21 15:20 97648 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-05-27 12:55 . 2014-04-21 15:20 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-05-08 09:06 . 2014-06-12 12:05 2742784 ----a-w- c:\windows\system32\rdpcorets.dll
2014-05-08 09:06 . 2014-06-12 12:05 13824 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"1c2b1"="c:\users\Compiuta\AppData\Roaming\0a3\1c2b1.js" [X]
"BitTorrent Sync"="c:\program files\BitTorrent Sync\BTSync.exe" [2014-06-27 3020136]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-02-10 20917408]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2014-06-14 1563440]
"ABBYY Screenshot Reader Bonus"="c:\program files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe" [2014-04-23 939272]
"VoipStunt"="c:\program files\VoipStunt.com\VoipStunt\VoipStunt.exe" [2014-02-11 19768640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-05-18 1314816]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-06 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-06 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2013-04-23 2379504]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-07-04 750160]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2014-06-14 310064]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]
.
c:\users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
406.js [2014-8-3 46974]
496a.js [2014-8-3 46974]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-02-25 37352]
R2 ABBYY.Licensing.PDFTransformer.Classic.3.0;ABBYY PDF Transformer 3.0 Licensing Service;c:\program files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [2014-04-23 759048]
R2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-07-04 430160]
R2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [2011-04-26 223088]
R2 TeamViewer9;TeamViewer 9;c:\program files\TeamViewer\Version9\TeamViewer_Service.exe [2014-04-02 4972864]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6016]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2014-04-11 89856]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-06-18 108032]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2011-04-04 20480]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 8320]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2010-04-01 23424]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [2011-02-07 11008]
R3 PSKMAD;PSKMAD;c:\windows\system32\DRIVERS\PSKMAD.sys [2013-04-29 47632]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2014-04-11 184192]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 27136]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2014-05-13 1343400]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29 23:59]
.
2014-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
- c:\users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-17 14:36]
.
2014-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
- c:\users\Compiuta\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-17 14:36]
.
.
------- Zusätzlicher Suchlauf -------
.
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-08-03 20:12:45
ComboFix-quarantined-files.txt 2014-08-03 18:12
.
Vor Suchlauf: 8 Verzeichnis(se), 27.937.751.040 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 27.916.808.192 Bytes frei
.
- - End Of File - - F5307E39D37CD1CC71D01BEB17A19C29
A36C5E4F47E84449FF07ED3517B43A31
LG Fred PS: Bitte lasst mich nach dem Ganzen wissen, ob und wie man an das Board als kleines Dankeschön spenden bzw. es sonst wie unterstützen kann. |
|
04.08.2014, 10:24
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Schau mal in meine Signatur  Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.08.2014, 19:34
| #5 |
| | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schrauber, super, bin gerade aus der Uni zurück und habe deine Signatur gelesen und werd gern was schicken sobald ich mich wieder mit meinem Rechner auf Bank etc Seiten trauen kann. Ich habe Malwarebytes im abgesicherten Modus durchgeführt, da es sich im normalen Modus weder installieren noch starten ließ. Hier nun der Log: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 04.08.2014 Suchlauf-Zeit: 19:38:05 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.03.04.09 Rootkit Datenbank: v2014.02.20.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Compiuta Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 239216 Verstrichene Zeit: 3 Min, 55 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Nun poste ich den Adwcleaner log. Auch Adwcleaner konnte ich nur aus dem abgesicherten Modus starten. Code:
ATTFilter # AdwCleaner v3.302 - Bericht erstellt am 04/08/2014 um 20:09:22
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Compiuta - COMPIUTA-PC
# Gestartet von : C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKLM\Software\Myfree Codec
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17207
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\1\AppData\Roaming\Mozilla\Firefox\Profiles\832yryei.default\prefs.js ]
[ Datei : C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [1385 octets] - [04/08/2014 20:08:28]
AdwCleaner[S0].txt - [1306 octets] - [04/08/2014 20:09:22]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1366 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x86
Ran by Compiuta on 04.08.2014 at 20:12:47,20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files\myfree codec"
~~~ FireFox
Emptied folder: C:\Users\Compiuta\AppData\Roaming\mozilla\firefox\profiles\kpvwewrm.default\minidumps [9 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.08.2014 at 20:15:44,66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Un hier nun erneut ein FRST log (auh das konnte ich vom Normalmodus aus machen): FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 04-08-2014 20:16:38
Running from C:\Users\Compiuta\Desktop
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-04] ()
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\496a.js ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:14 - 2014-08-03 20:14 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox
2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:03 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:32 - 2014-08-03 17:34 - 00049106 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 17:27 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 17:24 - 2014-08-04 20:16 - 00008817 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 17:24 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:55 - 2014-08-04 20:16 - 00000000 ____D () C:\FRST
2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:19 - 2014-07-06 23:46 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:43 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
2014-07-06 18:51 - 2014-04-11 10:39 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2014-07-06 18:51 - 2014-04-11 10:39 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-04 20:16 - 2014-08-03 17:24 - 00008817 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-04 20:16 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:15 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:11 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-04 20:11 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-04 20:10 - 2010-11-20 23:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 20:10 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-04 20:10 - 2009-07-14 06:39 - 00041397 _____ () C:\Windows\setupact.log
2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:02 - 2014-01-04 20:06 - 01202185 _____ () C:\Windows\WindowsUpdate.log
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:52 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-04 19:52 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-04 19:47 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-04 19:19 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-04 08:07 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-03 20:14 - 2014-08-03 20:14 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox
2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:02 - 2014-08-03 19:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:34 - 2014-08-03 17:32 - 00049106 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 15:57 - 2014-08-03 17:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 17:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:46 - 2014-07-06 23:19 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:09 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\VirtualStore
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
Some content of TEMP:
====================
C:\Users\1\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-15 01:40
==================== End Of Log ============================
Danke fürs erneute Auswerten! LG Fred |
|
05.08.2014, 12:44
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefundenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden |
|
05.08.2014, 15:51
| #7 |
| | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schauber, leider konnte ich auch ESET nicht im normalen Modus installieren. Irgendwas scheint das noch zu blockieren bzw. das Installationsmenü nach dem Öffnen gleich wieder zu schließen. Deswegen habe ich den Scan im abgesicherten Modus mit Netzwerktreibern und abgeschalteter Firewall laufen lassen. Dabei hat ESET zwei Trojaner und zwei ungewünschte Toolbars gefunden. Hier nun der log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=59582790a3ceb04fab8d68e5ea925596
# engine=19509
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-05 02:26:31
# local_time=2014-08-05 04:26:31 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777214 100 100 29076 13931127 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 3830 158879982 0 0
# scanned=113861
# found=4
# cleaned=0
# scan_time=3153
sh=6DDD82112A07890A9BE568E2AFB6ACE830A653E9 ft=0 fh=0000000000000000 vn="JS/Kryptik.ALK Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js.vir"
sh=6DDD82112A07890A9BE568E2AFB6ACE830A653E9 ft=0 fh=0000000000000000 vn="JS/Kryptik.ALK Trojaner" ac=I fn="C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js"
sh=503FB0F73E1F7FC3C7300A252DE32197E9C524FE ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Compiuta\Desktop\Downloads\ProgrammeFriedi.zip"
sh=998E13E519B2BF4C9D714E821C7C04AE41BECC36 ft=1 fh=acaa135d3d0b8ae0 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Compiuta\Desktop\Downloads\SICHERN\ProgrammeFriedi\Freemake Video Converter\FreemakeVideoConverter_3.0.2.9.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.86
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 65
Adobe Flash Player 14.0.0.145
Adobe Reader XI
Mozilla Firefox (31.0)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 05-08-2014 16:43:04
Running from C:\Users\Compiuta\Desktop
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-05] ()
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f694.js ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 141.51.247.1
FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 16:42 - 2014-08-05 16:42 - 00037658 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:14 - 2014-08-03 20:14 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox
2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:03 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:32 - 2014-08-04 20:25 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 17:27 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 17:24 - 2014-08-05 16:43 - 00008971 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 17:24 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:55 - 2014-08-05 16:43 - 00000000 ____D () C:\FRST
2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:19 - 2014-07-06 23:46 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:43 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
2014-07-06 18:51 - 2014-04-11 10:39 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2014-07-06 18:51 - 2014-04-11 10:39 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 16:43 - 2014-08-03 17:24 - 00008971 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-05 16:43 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-05 16:42 - 2014-08-05 16:42 - 00037658 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:38 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:32 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 16:31 - 2014-01-04 20:06 - 01246385 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 16:30 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-05 16:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 16:28 - 2009-07-14 06:39 - 00041621 _____ () C:\Windows\setupact.log
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-05 15:04 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-05 15:03 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-05 08:27 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-04 20:25 - 2014-08-03 17:32 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:10 - 2010-11-20 23:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:14 - 2014-08-03 20:14 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox
2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:02 - 2014-08-03 19:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 15:57 - 2014-08-03 17:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 17:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-07-06 23:46 - 2014-07-06 23:19 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VoipStunt
2014-07-06 23:19 - 2014-07-06 23:19 - 00000000 ____D () C:\Program Files\VoipStunt.com
2014-07-06 23:17 - 2014-07-06 23:17 - 06569296 _____ (Finarea S.A. Switzerland ) C:\Users\Compiuta\Downloads\setupVoipStunt.exe
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motmodem_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motfilt_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf
2014-07-06 19:09 - 2014-07-06 19:09 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_motccgp_01007.Wdf
2014-07-06 19:09 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\VirtualStore
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Motorola
2014-07-06 19:08 - 2014-07-06 19:08 - 00000000 ____D () C:\Program Files\Common Files\Motorola Shared
Some content of TEMP:
====================
C:\Users\1\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-15 01:40
==================== End Of Log ============================
Zu der Frage, ob noch Probleme bestehen: Nun ja, es kommt mir sehr komisch vor, dass ich im Normalmodus keine Anti-Virus-/Anti-Malware-Software installieren kann, da irgendwas das blockiert. Zudem Meldete ESET zwei Trojanerfunde, was ich beunruhigend finde. !!DANKE!! Liebe Grüße, Fred |
|
05.08.2014, 20:39
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Compiuta\AppData\Roaming\0a3
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-05] ()
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f694.js ()
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.08.2014, 08:15
| #9 |
| | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schrauber, hier nun das Fixlog von FRST: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:2-08-2014
Ran by Compiuta at 2014-08-06 09:11:42 Run:1
Running from C:\Users\Compiuta\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Users\Compiuta\AppData\Roaming\0a3
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js [46974 2014-08-05] ()
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f694.js ()
*****************
C:\Users\Compiuta\AppData\Roaming\0a3 => Moved successfully.
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\Software\Microsoft\Windows\CurrentVersion\Run\\1c2b1 => value deleted successfully.
C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4f694.js not found.
==== End of Fixlog ====
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 06-08-2014 09:13:48
Running from C:\Users\Compiuta\Desktop
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Swiss Academic Software) C:\Program Files\Citavi 3\bin\Citavi.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\414.js ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-04] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-06 09:11 - 2014-08-06 09:11 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-05 16:42 - 2014-08-05 16:43 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox
2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:03 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:32 - 2014-08-04 20:25 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 17:27 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 17:24 - 2014-08-06 09:13 - 00009559 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 17:24 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:55 - 2014-08-06 09:13 - 00000000 ____D () C:\FRST
2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-06 09:14 - 2014-08-03 17:24 - 00009559 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-06 09:13 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-06 09:11 - 2014-08-06 09:11 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-06 09:09 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-06 09:07 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-06 09:07 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-06 08:47 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-06 08:34 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-05 16:43 - 2014-08-05 16:42 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:31 - 2014-01-04 20:06 - 01266318 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 16:30 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-05 16:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 16:28 - 2009-07-14 06:39 - 00041621 _____ () C:\Windows\setupact.log
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:25 - 2014-08-03 17:32 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:10 - 2010-11-20 23:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox
2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:02 - 2014-08-03 19:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 15:57 - 2014-08-03 17:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 17:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
Some content of TEMP:
====================
C:\Users\1\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-15 01:40
==================== End Of Log ============================
Danke! LG Fred |
|
07.08.2014, 09:21
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\414.js ()
2014-08-06 09:11 - 2014-08-06 09:11 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Und nochmal ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.08.2014, 11:05
| #11 |
| | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schrauber, hier nun das Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:2-08-2014
Ran by Compiuta at 2014-08-07 12:00:43 Run:2
Running from C:\Users\Compiuta\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js
Startup: C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\414.js ()
2014-08-06 09:11 - 2014-08-06 09:11 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
*****************
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\Software\Microsoft\Windows\CurrentVersion\Run\\1c2b1 => value deleted successfully.
C:\Users\Compiuta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\414.js not found.
C:\Users\Compiuta\AppData\Roaming\0a3 => Moved successfully.
==== End of Fixlog ====
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014
Ran by Compiuta (administrator) on COMPIUTA-PC on 07-08-2014 12:02:31
Running from C:\Users\Compiuta\Desktop
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
() C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
() C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(BitTorrent, Inc.) C:\Program Files\BitTorrent Sync\BTSync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(ABBYY) C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Swiss Academic Software) C:\Program Files\Citavi 3\bin\Citavi.exe
(Tracker Software Products Ltd.) C:\Program Files\ABBYY PDF Transformer 3.0\PDF-XChange\pdfSaver4a.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avira_de____fm.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt)
HKU\S-1-5-21-4045813022-1567936593-3779010734-1000\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xECE210E7535DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Compiuta\AppData\Roaming\Mozilla\Firefox\Profiles\kpvwewrm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Compiuta\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Compiuta\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Compiuta\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-04-21]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
R2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-07 12:00 - 2014-08-07 12:00 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-07 09:56 - 2014-08-07 10:03 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-07 09:56 - 2014-08-07 10:02 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-07 09:56 - 2014-08-07 09:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-06 09:14 - 2014-08-06 09:14 - 00035021 _____ () C:\Users\Compiuta\Desktop\FRST4.txt
2014-08-05 16:42 - 2014-08-05 16:43 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:07 - 2014-08-04 20:09 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 20:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:31 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 19:31 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 19:23 - 2014-08-04 19:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:06 - 2014-08-03 20:12 - 00000000 ____D () C:\Qoobox
2014-08-03 20:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-03 20:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-03 20:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-03 20:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-03 20:05 - 2014-08-03 20:11 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:19 - 2014-08-03 19:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:03 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:01 - 2014-08-03 19:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:32 - 2014-08-04 20:25 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 17:27 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 17:24 - 2014-08-07 12:02 - 00009882 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-03 17:24 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:56 - 2014-08-03 15:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:55 - 2014-08-07 12:02 - 00000000 ____D () C:\FRST
2014-08-03 15:55 - 2014-08-03 15:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:57 - 2013-04-29 09:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-03 10:42 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-03 10:42 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-03 10:42 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-03 10:41 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-03 10:41 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:40 - 2014-07-20 04:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:35 - 2014-07-20 04:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:08 - 2014-07-19 22:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:07 - 2014-07-19 22:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:07 - 2014-07-19 22:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:56 - 2014-07-19 20:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-19 01:40 - 2014-07-24 15:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-17 17:24 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-17 17:24 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-17 17:24 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-14 19:55 - 2014-07-14 20:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-09 18:24 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-09 18:24 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-09 18:24 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-09 18:24 - 2014-06-19 01:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-09 18:24 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-09 18:24 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-09 18:24 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-09 18:24 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-09 18:24 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-09 18:24 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-09 18:24 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-09 18:24 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-09 18:24 - 2014-06-19 01:23 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-09 18:24 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-09 18:24 - 2014-06-19 01:16 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-09 18:24 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-09 18:24 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-09 18:24 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-09 18:24 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-09 18:24 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-09 18:24 - 2014-06-19 00:52 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-09 18:24 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-09 18:24 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-09 18:24 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-09 18:24 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-09 18:24 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-09 18:24 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-09 18:24 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-09 17:14 - 2014-06-05 16:26 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-09 17:02 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-09 17:02 - 2014-06-18 02:52 - 02350080 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-09 17:02 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-09 17:02 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:32 - 2014-07-08 14:33 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-07 12:03 - 2014-04-29 21:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-07 12:02 - 2014-08-03 17:24 - 00009882 _____ () C:\Users\Compiuta\Desktop\FRST.txt
2014-08-07 12:02 - 2014-08-03 15:55 - 00000000 ____D () C:\FRST
2014-08-07 12:00 - 2014-08-07 12:00 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3
2014-08-07 11:55 - 2014-04-21 12:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync
2014-08-07 11:47 - 2014-05-17 16:36 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000UA.job
2014-08-07 10:03 - 2014-08-07 09:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-07 10:02 - 2014-08-07 09:56 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-07 10:02 - 2014-04-21 17:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-07 10:02 - 2014-04-21 17:20 - 00000000 ____D () C:\Program Files\Avira
2014-08-07 10:02 - 2014-01-04 20:06 - 01298252 _____ () C:\Windows\WindowsUpdate.log
2014-08-07 09:56 - 2014-08-07 09:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-07 09:56 - 2014-04-21 17:20 - 00000000 ____D () C:\ProgramData\Avira
2014-08-07 09:47 - 2014-05-17 16:36 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4045813022-1567936593-3779010734-1000Core.job
2014-08-06 09:14 - 2014-08-06 09:14 - 00035021 _____ () C:\Users\Compiuta\Desktop\FRST4.txt
2014-08-06 09:09 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 16:43 - 2014-08-05 16:42 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt
2014-08-05 16:41 - 2014-08-05 16:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt
2014-08-05 16:35 - 2014-08-05 16:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:35 - 2009-07-14 06:34 - 00022208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-05 16:30 - 2014-04-21 21:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype
2014-08-05 16:28 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 16:28 - 2009-07-14 06:39 - 00041621 _____ () C:\Windows\setupact.log
2014-08-05 15:16 - 2014-08-05 15:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe
2014-08-04 20:25 - 2014-08-03 17:32 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt
2014-08-04 20:17 - 2014-08-04 20:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt
2014-08-04 20:15 - 2014-08-04 20:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt
2014-08-04 20:12 - 2014-08-04 20:12 - 00000000 ____D () C:\Windows\ERUNT
2014-08-04 20:11 - 2014-08-04 20:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt
2014-08-04 20:10 - 2010-11-20 23:48 - 00111524 _____ () C:\Windows\PFRO.log
2014-08-04 20:09 - 2014-08-04 20:07 - 00000000 ____D () C:\AdwCleaner
2014-08-04 20:07 - 2014-08-04 20:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt
2014-08-04 20:06 - 2014-08-04 20:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt
2014-08-04 20:03 - 2014-08-04 19:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 20:01 - 2014-08-04 20:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe
2014-08-04 20:01 - 2014-08-04 20:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe
2014-08-04 19:32 - 2014-08-04 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-04 19:32 - 2014-08-04 19:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-08-04 19:31 - 2014-08-04 19:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 19:24 - 2014-08-04 19:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-08-03 20:13 - 2014-08-03 20:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt
2014-08-03 20:12 - 2014-08-03 20:12 - 00013303 _____ () C:\ComboFix.txt
2014-08-03 20:12 - 2014-08-03 20:06 - 00000000 ____D () C:\Qoobox
2014-08-03 20:12 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-08-03 20:11 - 2014-08-03 20:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-03 20:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-03 20:04 - 2014-08-03 20:04 - 00000000 ____D () C:\ProgramData\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2014-08-03 20:03 - 2014-08-03 20:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine
2014-08-03 19:20 - 2014-08-03 19:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe
2014-08-03 19:20 - 2014-08-03 19:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe
2014-08-03 19:02 - 2014-08-03 19:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe
2014-08-03 19:02 - 2014-08-03 19:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe
2014-08-03 18:07 - 2014-08-03 18:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt
2014-08-03 17:28 - 2014-08-03 17:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe
2014-08-03 15:57 - 2014-08-03 17:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt
2014-08-03 15:57 - 2014-08-03 15:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt
2014-08-03 15:50 - 2014-08-03 15:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe
2014-08-03 13:18 - 2014-08-03 17:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log
2014-08-03 13:18 - 2014-08-03 13:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable
2014-08-03 13:18 - 2014-01-04 20:28 - 00000000 ____D () C:\Users\Compiuta
2014-08-03 13:04 - 2014-08-03 13:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe
2014-08-03 10:57 - 2014-08-03 10:57 - 00000000 ____D () C:\Program Files\Panda Security
2014-08-03 10:55 - 2014-04-21 15:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-08-03 10:48 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-03 10:43 - 2014-08-03 10:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe
2014-07-31 15:53 - 2014-04-23 11:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc
2014-07-31 11:12 - 2014-07-31 11:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-07-24 18:50 - 2014-04-21 17:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-24 15:57 - 2014-07-19 01:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog
2014-07-24 15:56 - 2014-07-24 15:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-24 15:45 - 2014-07-24 15:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe
2014-07-24 15:28 - 2014-07-24 15:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe
2014-07-24 15:21 - 2014-07-24 15:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe
2014-07-24 03:33 - 2014-04-20 19:34 - 00000000 ____D () C:\BtSync
2014-07-24 01:07 - 2014-07-24 01:07 - 00000000 __SHD () C:\0b64
2014-07-23 10:52 - 2014-04-21 15:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-21 20:05 - 2014-07-21 20:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner
2014-07-20 04:46 - 2014-07-20 04:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4
2014-07-20 04:42 - 2014-07-20 04:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv
2014-07-19 22:26 - 2014-07-19 22:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2)
2014-07-19 22:26 - 2014-07-06 19:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView
2014-07-19 22:13 - 2014-04-21 16:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET
2014-07-19 22:09 - 2014-01-04 21:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles
2014-07-19 22:08 - 2014-07-19 22:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip
2014-07-19 22:08 - 2014-07-19 22:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeciv 2.4.2 (GTK+2 client)
2014-07-19 21:50 - 2014-07-19 21:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2
2014-07-19 20:57 - 2014-07-19 20:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe
2014-07-18 18:03 - 2014-06-13 03:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-17 17:24 - 2014-07-17 17:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-17 17:24 - 2014-05-02 10:24 - 00000000 ____D () C:\Program Files\Java
2014-07-15 15:54 - 2014-04-21 21:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 15:52 - 2014-04-21 21:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-15 02:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-14 22:33 - 2014-06-03 23:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla
2014-07-14 20:12 - 2014-06-03 23:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-07-14 20:12 - 2014-04-21 15:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client
2014-07-14 20:06 - 2014-07-14 19:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity
2014-07-14 06:12 - 2014-04-27 14:19 - 00000000 ____D () C:\Users\1
2014-07-12 05:40 - 2014-01-04 20:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets
2014-07-11 03:02 - 2014-07-17 17:24 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-11 02:56 - 2014-07-17 17:24 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-11 02:56 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-11 02:55 - 2014-07-17 17:24 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-10 01:18 - 2010-11-21 02:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 01:18 - 2009-07-14 06:33 - 00324032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-09 01:59 - 2014-04-29 21:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-07-09 01:59 - 2014-04-29 21:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-07-08 14:33 - 2014-07-08 14:33 - 00284564 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-07-08 14:33 - 2014-07-08 14:33 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-07-08 14:33 - 2014-07-08 14:32 - 00291106 _____ () C:\Windows\msxml4-KB973688-enu.LOG
Some content of TEMP:
====================
C:\Users\1\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\avgnt.exe
C:\Users\Compiuta\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-15 01:40
==================== End Of Log ============================
Dnake! LG Fred |
|
08.08.2014, 06:10
| #12 |
| /// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden jetzt nervt das Ding Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.08.2014, 10:19
| #13 |
| | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schrauber, na, da scheint echt ein hartnäckiges Virus zu sein. Hier nun der TDSSKiller Log: Code:
ATTFilter 11:10:08.0664 0x4378 TDSS rootkit removing tool 3.0.0.40 Jul 10 2014 12:37:58
11:10:28.0402 0x4378 ============================================================
11:10:28.0402 0x4378 Current date / time: 2014/08/08 11:10:28.0402
11:10:28.0402 0x4378 SystemInfo:
11:10:28.0402 0x4378
11:10:28.0402 0x4378 OS Version: 6.1.7601 ServicePack: 1.0
11:10:28.0402 0x4378 Product type: Workstation
11:10:28.0403 0x4378 ComputerName: COMPIUTA-PC
11:10:28.0403 0x4378 UserName: Compiuta
11:10:28.0403 0x4378 Windows directory: C:\Windows
11:10:28.0403 0x4378 System windows directory: C:\Windows
11:10:28.0403 0x4378 Processor architecture: Intel x86
11:10:28.0403 0x4378 Number of processors: 2
11:10:28.0403 0x4378 Page size: 0x1000
11:10:28.0403 0x4378 Boot type: Normal boot
11:10:28.0403 0x4378 ============================================================
11:10:28.0796 0x4378 KLMD registered as C:\Windows\system32\drivers\11932214.sys
11:10:28.0985 0x4378 System UUID: {A6F79280-F829-45D6-3E27-A6502803D32A}
11:10:29.0659 0x4378 Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 ( 111.79 Gb ), SectorSize: 0x200, Cylinders: 0x3C91, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
11:10:29.0662 0x4378 ============================================================
11:10:29.0662 0x4378 \Device\Harddisk0\DR0:
11:10:29.0662 0x4378 MBR partitions:
11:10:29.0662 0x4378 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0xDF93800
11:10:29.0662 0x4378 ============================================================
11:10:29.0663 0x4378 C: <-> \Device\Harddisk0\DR0\Partition1
11:10:29.0664 0x4378 ============================================================
11:10:29.0664 0x4378 Initialize success
11:10:29.0664 0x4378 ============================================================
11:12:33.0506 0x3c24 ============================================================
11:12:33.0506 0x3c24 Scan started
11:12:33.0506 0x3c24 Mode: Manual; SigCheck; TDLFS;
11:12:33.0506 0x3c24 ============================================================
11:12:33.0506 0x3c24 KSN ping started
11:12:47.0044 0x3c24 KSN ping finished: true
11:12:47.0316 0x3c24 ================ Scan system memory ========================
11:12:47.0316 0x3c24 System memory - ok
11:12:47.0317 0x3c24 ================ Scan services =============================
11:12:47.0386 0x3c24 [ 1B133875B8AA8AC48969BD3458AFE9F5, 01753BDD47F3F9BC0E0D23A069B9C56D4AE6A6B6295BC19B95AE245D25B12744 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
11:12:47.0479 0x3c24 1394ohci - ok
11:12:47.0534 0x3c24 [ B33CF4DE909A5B30F526D82053A63C8E, ABF5BB962C038E545C18B96E686E072D780C907096C7BB341297AF31D3703ABD ] ABBYY.Licensing.PDFTransformer.Classic.3.0 C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe
11:12:47.0584 0x3c24 ABBYY.Licensing.PDFTransformer.Classic.3.0 - ok
11:12:47.0605 0x3c24 [ CEA80C80BED809AA0DA6FEBC04733349, AE69C142DC2210A4AE657C23CEA4A6E7CB32C4F4EBA039414123CAC52157509B ] ACPI C:\Windows\system32\drivers\ACPI.sys
11:12:47.0633 0x3c24 ACPI - ok
11:12:47.0641 0x3c24 [ 1EFBC664ABFF416D1D07DB115DCB264F, BF94D069D692140B792DBF4FD3CB0127D27C26CC5BFB6B0C28A8B6346767EE58 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
11:12:47.0677 0x3c24 AcpiPmi - ok
11:12:47.0702 0x3c24 [ 6C61BCEB60C2C187E6F96001FD69493E, AB8752E7DCCE134CA63D2E660D3E2688086426167B9E8E2C24E0D45B87497774 ] ADIHdAudAddService C:\Windows\system32\drivers\ADIHdAud.sys
11:12:47.0752 0x3c24 ADIHdAudAddService - ok
11:12:47.0762 0x3c24 [ B362181ED3771DC03B4141927C80F801, 69514E5177A0AEA89C27C2234712F9F82E8D8F99E1FD4273898C9324C6FF7472 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
11:12:47.0781 0x3c24 AdobeARMservice - ok
11:12:47.0799 0x3c24 [ A6B6AB9502B63F43A9A56AE6AFB22078, DD1F0BA3D8F3333F52A71EAE3719A001F6EF844D647FFABF0E4C56C6C764ACA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:12:47.0823 0x3c24 AdobeFlashPlayerUpdateSvc - ok
11:12:47.0849 0x3c24 [ 21E785EBD7DC90A06391141AAC7892FB, A2D3D764C5E6DC0AD5AAF48485FFB8B121D2A40DC08ECF2D2CB92278A1002B25 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
11:12:47.0901 0x3c24 adp94xx - ok
11:12:47.0923 0x3c24 [ 0C676BC278D5B59FF5ABD57BBE9123F2, 339E8A433D186BAAB6FCB44C82CC9FB6FCD63C87981449494CBEB2072CB6B7BB ] adpahci C:\Windows\system32\drivers\adpahci.sys
11:12:47.0966 0x3c24 adpahci - ok
11:12:47.0980 0x3c24 [ 7C7B5EE4B7B822EC85321FE23A27DB33, A934AFB71D439555E6376DA9B34F82E8D39A300A4547BE9AC9311F6A3C36270C ] adpu320 C:\Windows\system32\drivers\adpu320.sys
11:12:48.0013 0x3c24 adpu320 - ok
11:12:48.0027 0x3c24 [ 4DC6B0772D1698F04FC79053A21C8260, 010D4660DB9F7BC49C72691B5D9936EAB6F4A0799374B4019B97343B517D86F4 ] AEADIFilters C:\Windows\system32\AEADISRV.EXE
11:12:48.0048 0x3c24 AEADIFilters - ok
11:12:48.0057 0x3c24 [ 8B5EEFEEC1E6D1A72A06C526628AD161, 026CDF4C96F4D493E7BABF79A14C4B0B5ADCCEF0B081FFFA2E3B243B2414167F ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
11:12:48.0123 0x3c24 AeLookupSvc - ok
11:12:48.0144 0x3c24 [ D0B388DA1D111A34366E04EB4A5DD156, 60D226F027F4025CC032CAFF73A80FAFB5FA75445654FDCF80CA8C0419C6E938 ] AFD C:\Windows\system32\drivers\afd.sys
11:12:48.0180 0x3c24 AFD - ok
11:12:48.0190 0x3c24 [ 507812C3054C21CEF746B6EE3D04DD6E, D7E59350AC338AD229E3D10C76E32AE16D120311B263714A9CD94AB538633B0E ] agp440 C:\Windows\system32\drivers\agp440.sys
11:12:48.0218 0x3c24 agp440 - ok
11:12:48.0228 0x3c24 [ 8B30250D573A8F6B4BD23195160D8707, 64EC289AFCD63D84EAFD9D81C50D0A77BCC79A1EFF32C50B2776BB0C0151757D ] aic78xx C:\Windows\system32\drivers\djsvs.sys
11:12:48.0260 0x3c24 aic78xx - ok
11:12:48.0269 0x3c24 [ 18A54E132947CD98FEA9ACCC57F98F13, 9D39AF972785E49F0DD12C4BAEF39A79CD69F098886BF152AF1B7CCE2E902115 ] ALG C:\Windows\System32\alg.exe
11:12:48.0310 0x3c24 ALG - ok
11:12:48.0318 0x3c24 [ 0D40BCF52EA90FC7DF2AEAB6503DEA44, 1D1AA8F50935D976C29DE7A84708CADBBBDD936F0DD2C059E820F0D21367B3B6 ] aliide C:\Windows\system32\drivers\aliide.sys
11:12:48.0344 0x3c24 aliide - ok
11:12:48.0353 0x3c24 [ 3C6600A0696E90A463771C7422E23AB5, 370B33DC1C25B981628A318BAE434A78A5F0A0DA93C2896DC7A3D7B87AE1A5E7 ] amdagp C:\Windows\system32\drivers\amdagp.sys
11:12:48.0384 0x3c24 amdagp - ok
11:12:48.0392 0x3c24 [ CD5914170297126B6266860198D1D4F0, 2239FCBD1A7EC27CE4F10DA36AE6BD6CCB87E5128C82CA71B84BFE5AF5602A60 ] amdide C:\Windows\system32\drivers\amdide.sys
11:12:48.0417 0x3c24 amdide - ok
11:12:48.0426 0x3c24 [ 00DDA200D71BAC534BF56A9DB5DFD666, CA316B1FFD85BA1CF8664B3229DA1F238A5341E016059F7ED89702324CFD124B ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
11:12:48.0461 0x3c24 AmdK8 - ok
11:12:48.0470 0x3c24 [ 3CBF30F5370FDA40DD3E87DF38EA53B6, 7EACF1743367BE805357B6FD10F8F99E9B1C301FE3782D77719347B13DFA65EC ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
11:12:48.0501 0x3c24 AmdPPM - ok
11:12:48.0511 0x3c24 [ E7F4D42D8076EC60E21715CD11743A0D, 91AC020A70964F8783C999BDE8AB8391A3FA3AFC1CD4BC52A43625A2010A53E7 ] amdsata C:\Windows\system32\drivers\amdsata.sys
11:12:48.0542 0x3c24 amdsata - ok
11:12:48.0556 0x3c24 [ EA43AF0C423FF267355F74E7A53BDABA, 3F1335909AB0281A2FBDD7AD90E18309E091656CD32B48894B992789D8C61DB4 ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
11:12:48.0605 0x3c24 amdsbs - ok
11:12:48.0613 0x3c24 [ 146459D2B08BFDCBFA856D9947043C81, AC7F2069717601F949B0968EA651899D497170A93B84281B66D3CE5C382DDECB ] amdxata C:\Windows\system32\drivers\amdxata.sys
11:12:48.0639 0x3c24 amdxata - ok
11:12:48.0671 0x3c24 [ 0327A6CE0934C324E3E82920E9EC0EE4, B4A1E6A77032F7DF97FED3C01E76E2BD3270A3FFC500C7C9A118C0E2EB675D75 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
11:12:48.0701 0x3c24 AntiVirSchedulerService - ok
11:12:48.0726 0x3c24 [ 0327A6CE0934C324E3E82920E9EC0EE4, B4A1E6A77032F7DF97FED3C01E76E2BD3270A3FFC500C7C9A118C0E2EB675D75 ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe
11:12:48.0753 0x3c24 AntiVirService - ok
11:12:48.0765 0x3c24 [ AEA177F783E20150ACE5383EE368DA19, 8FA9EE27AA1F22E8B8FE33A21028CA1E0062BAA95CB132C20D55B98C03B4254F ] AppID C:\Windows\system32\drivers\appid.sys
11:12:48.0829 0x3c24 AppID - ok
11:12:48.0840 0x3c24 [ 62A9C86CB6085E20DB4823E4E97826F5, E0F840B49710022C4FB437002AD06F64B0F6B5D628B32D00F2B66765E6B97E4B ] AppIDSvc C:\Windows\System32\appidsvc.dll
11:12:48.0888 0x3c24 AppIDSvc - ok
11:12:48.0896 0x3c24 [ EACFDF31921F51C097629F1F3C9129B4, 24138755D823E69760579ECBD672421192457CDC9941B2BC499C2D34D83E86C3 ] Appinfo C:\Windows\System32\appinfo.dll
11:12:48.0932 0x3c24 Appinfo - ok
11:12:48.0948 0x3c24 [ A45D184DF6A8803DA13A0B329517A64A, C1D16B60A6D69689AE951DC3D6884ED2E233D144B3FC0B86BC1C50AAAAA01ED2 ] AppMgmt C:\Windows\System32\appmgmts.dll
11:12:48.0986 0x3c24 AppMgmt - ok
11:12:48.0996 0x3c24 [ 2932004F49677BD84DBC72EDB754FFB3, 73F84582244AC53994A2F4499A119B4A84A6BF7FD3046C29A8080C763DE540B8 ] arc C:\Windows\system32\drivers\arc.sys
11:12:49.0027 0x3c24 arc - ok
11:12:49.0038 0x3c24 [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7, F7C9C3B4F2C816F57A43B2921672858C291054220BADE291044343778216F6BA ] arcsas C:\Windows\system32\drivers\arcsas.sys
11:12:49.0070 0x3c24 arcsas - ok
11:12:49.0094 0x3c24 [ 9D768C43FEF254DD50B1DBF8AD5C4C0B, A50854EA5C08605133B8BB4DFDC6090357C5665314AA72E0BFA1E07D4E451F09 ] aspnet_state C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
11:12:49.0128 0x3c24 aspnet_state - ok
11:12:49.0135 0x3c24 [ ADD2ADE1C2B285AB8378D2DAAF991481, 7965A705F37924C0EC7A934E64E89C5DF4069816E2EEA3509E0AC90F78910519 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
11:12:49.0205 0x3c24 AsyncMac - ok
11:12:49.0212 0x3c24 [ 338C86357871C167A96AB976519BF59E, F28CC534523D1701B0552F5D7E18E88369C4218BDB1F69110C3E31D395884AD6 ] atapi C:\Windows\system32\drivers\atapi.sys
11:12:49.0230 0x3c24 atapi - ok
11:12:49.0284 0x3c24 [ 614A60AEE03A6151FDCBAC295854A9CB, 0453BD59AEF21F2EFD6E1E39F1CF691E694BC778073843111AE5FA2BB1DEF31B ] athr C:\Windows\system32\DRIVERS\athr.sys
11:12:49.0358 0x3c24 athr - ok
11:12:49.0390 0x3c24 [ CE3B4E731638D2EF62FCB419BE0D39F0, 3B98179CB0101778D9E7810D2CD46D9C0D7120E141BA11471666E7D9EB3C93CC ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
11:12:49.0470 0x3c24 AudioEndpointBuilder - ok
11:12:49.0498 0x3c24 [ CE3B4E731638D2EF62FCB419BE0D39F0, 3B98179CB0101778D9E7810D2CD46D9C0D7120E141BA11471666E7D9EB3C93CC ] Audiosrv C:\Windows\System32\Audiosrv.dll
11:12:49.0556 0x3c24 Audiosrv - ok
11:12:49.0568 0x3c24 [ B0A63DD71CB0CB597D8BD5C364E73F7C, 572B31F3FC962F50110D42A08CDD0614323E18C213575710CEEFA35EE7CAE8C5 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
11:12:49.0608 0x3c24 avgntflt - ok
11:12:49.0621 0x3c24 [ 05AF7CBF0BDA1571BBADC36703EB9CA4, 3925AD58053769D317D3CF0DDDF7371B010F2F4C839CF7B44F327AE9D0AB5442 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
11:12:49.0656 0x3c24 avipbb - ok
11:12:49.0665 0x3c24 [ D8C712305F73CD34D1B344810E522728, 49A474FF6CA44E8427D7A8290B47395125B0148AF384CF2B3B1FA495A4718CBA ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
11:12:49.0694 0x3c24 avkmgr - ok
11:12:49.0704 0x3c24 [ 6E30D02AAC9CAC84F421622E3A2F6178, 229DC527C1D6C778BCA2C855A2A6F6D2C4B0F4F6DE56C886B3AAD26E3347952C ] AxInstSV C:\Windows\System32\AxInstSV.dll
11:12:49.0750 0x3c24 AxInstSV - ok
11:12:49.0774 0x3c24 [ 1A231ABEC60FD316EC54C66715543CEC, 09E2897BA80737997A286EA5408C03DD3CC0EBACD24CB391C2455B6D4BE7D67E ] b06bdrv C:\Windows\system32\drivers\bxvbdx.sys
11:12:49.0836 0x3c24 b06bdrv - ok
11:12:49.0853 0x3c24 [ BD8869EB9CDE6BBE4508D869929869EE, F4363A12EBFDBB89C69FD59B22F9EE05BADA07D477A1DF2DE01F59D6EE496543 ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys
11:12:49.0894 0x3c24 b57nd60x - ok
11:12:49.0908 0x3c24 [ EE1E9C3BB8228AE423DD38DB69128E71, ED54FD9795F3A4D32F02BED6052AD9404409A05644CDBEBFF19C662D104DA95A ] BDESVC C:\Windows\System32\bdesvc.dll
11:12:49.0943 0x3c24 BDESVC - ok
11:12:49.0950 0x3c24 [ 505506526A9D467307B3C393DEDAF858, 8AD6F1492E357F57CF42261497BA29122045D4FC0DCC9669AA5AC9B2A4BABFA4 ] Beep C:\Windows\system32\drivers\Beep.sys
11:12:49.0998 0x3c24 Beep - ok
11:12:50.0025 0x3c24 [ 1E2BAC209D184BB851E1A187D8A29136, 53933C938DA5126986FFF2918C1F522ABE93ABAB460AE32E4453161C2F7B68DF ] BFE C:\Windows\System32\bfe.dll
11:12:50.0086 0x3c24 BFE - ok
11:12:50.0119 0x3c24 [ E585445D5021971FAE10393F0F1C3961, 178C008A9A0A6BFDA65EB0B98C510271360AD4474F22F13594F5EB60AA4E1CF5 ] BITS C:\Windows\system32\qmgr.dll
11:12:50.0189 0x3c24 BITS - ok
11:12:50.0200 0x3c24 [ 2287078ED48FCFC477B05B20CF38F36F, 55BCA6174E6034A8D61CBE4126B2F1989F6052BFA624BEA9C0A0A664AEC74521 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
11:12:50.0229 0x3c24 blbdrive - ok
11:12:50.0239 0x3c24 [ 8F2DA3028D5FCBD1A060A3DE64CD6506, E234672E9CFE1A95AD2E78E306E41E010B870221E6EBBC0E2B0BE2FA5CE0CD76 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
11:12:50.0271 0x3c24 bowser - ok
11:12:50.0279 0x3c24 [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
11:12:50.0317 0x3c24 BrFiltLo - ok
11:12:50.0324 0x3c24 [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
11:12:50.0354 0x3c24 BrFiltUp - ok
11:12:50.0364 0x3c24 [ 77361D72A04F18809D0EFB6CCEB74D4B, 55E7DB65BB29FF421F138CDFF05E5ECFFC7C8862FAA68F6179A3BA9D6B69AE64 ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
11:12:50.0425 0x3c24 BridgeMP - ok
11:12:50.0436 0x3c24 [ 3DAA727B5B0A45039B0E1C9A211B8400, 903B51E75F0C503A0E255120F53BF51B047B219FEC1E15F2F1D02DDD562FC73B ] Browser C:\Windows\System32\browser.dll
11:12:50.0474 0x3c24 Browser - ok
11:12:50.0492 0x3c24 [ 845B8CE732E67F3B4133164868C666EA, 9309B094CD9B5EBC46295A5EB806BED472C3CEDE3B5F6F497EBDABA496A2A27F ] Brserid C:\Windows\System32\Drivers\Brserid.sys
11:12:50.0540 0x3c24 Brserid - ok
11:12:50.0550 0x3c24 [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
11:12:50.0583 0x3c24 BrSerWdm - ok
11:12:50.0591 0x3c24 [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
11:12:50.0620 0x3c24 BrUsbMdm - ok
11:12:50.0628 0x3c24 [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
11:12:50.0659 0x3c24 BrUsbSer - ok
11:12:50.0666 0x3c24 [ 4813DF77EDE536A52E3737971F910BAA, 31BC0DEB6B4C0F3F54A651F0AA848E502A7D259448C823A4DB019F4FBB13C9E5 ] BTCFilterService C:\Windows\system32\DRIVERS\motfilt.sys
11:12:50.0701 0x3c24 BTCFilterService - ok
11:12:50.0709 0x3c24 [ 2865A5C8E98C70C605F417908CEBB3A4, B1C5AC228BD7072AF8668C009C6CDC13EE9FCB9481F57524300F37C40BF1E935 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
11:12:50.0739 0x3c24 BthEnum - ok
11:12:50.0748 0x3c24 [ ED3DF7C56CE0084EB2034432FC56565A, B5B75E002E7BC0209582C635CCCA26DB569BDB23C33A126634E00C6434BF941B ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
11:12:50.0780 0x3c24 BTHMODEM - ok
11:12:50.0791 0x3c24 [ AD1872E5829E8A2C3B5B4B641C3EAB0E, 8C2DBCAC08DDB41E2B44E257C55FA2D0272959B308EFF9EAF5FF9AE1E4A0AA39 ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
11:12:50.0819 0x3c24 BthPan - ok
11:12:50.0843 0x3c24 [ C2FBF6D271D9A94D839C416BF186EAD9, 492F8344BD2E354C3525E1E535A1BAAAC17A38EE01868B986AC112E33B3B2A66 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
11:12:50.0899 0x3c24 BTHPORT - ok
11:12:50.0909 0x3c24 [ 1DF19C96EEF6C29D1C3E1A8678E07190, 1F4BB161FF3A1C5B1465BB52F3520FEDB7ACB1FAA132466F07D16DB8E394AEA5 ] bthserv C:\Windows\system32\bthserv.dll
11:12:50.0962 0x3c24 bthserv - ok
11:12:50.0974 0x3c24 [ C81E9413A25A439F436B1D4B6A0CF9E9, A4C290163207AED22C70C7F90B28F6FC24892889643D60D915059405AC5A4A72 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
11:12:51.0007 0x3c24 BTHUSB - ok
11:12:51.0015 0x3c24 catchme - ok
11:12:51.0025 0x3c24 [ 77EA11B065E0A8AB902D78145CA51E10, 160EB3BBE9E5F3CC4A02584E6F2576A812C7565B940D74838B983F1EE51FA73A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
11:12:51.0077 0x3c24 cdfs - ok
11:12:51.0089 0x3c24 [ BE167ED0FDB9C1FA1133953C18D5A6C9, E26A851CA13E7300F977E5B20FA5D25FD0E1442AB6AD5DB58BBDB2DAAD87027C ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
11:12:51.0126 0x3c24 cdrom - ok
11:12:51.0135 0x3c24 [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] CertPropSvc C:\Windows\System32\certprop.dll
11:12:51.0186 0x3c24 CertPropSvc - ok
11:12:51.0196 0x3c24 [ 3FE3FE94A34DF6FB06E6418D0F6A0060, 6B3A2A26609A75B690D4C0B3059E40822F3B3DB08943F58EC496BABDA7D0A735 ] circlass C:\Windows\system32\drivers\circlass.sys
11:12:51.0233 0x3c24 circlass - ok
11:12:51.0250 0x3c24 [ 635181E0E9BBF16871BF5380D71DB02D, 58D5150C6F3B9F1730FFDF3A8A2ABF5FF207F9785BD66C0C1E03A0F1C223A26A ] CLFS C:\Windows\system32\CLFS.sys
11:12:51.0277 0x3c24 CLFS - ok
11:12:51.0289 0x3c24 [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:12:51.0319 0x3c24 clr_optimization_v2.0.50727_32 - ok
11:12:51.0329 0x3c24 [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:12:51.0366 0x3c24 clr_optimization_v4.0.30319_32 - ok
11:12:51.0374 0x3c24 [ DEA805815E587DAD1DD2C502220B5616, 2D6A7668C95352B818F5EC59FF462894935833D34190257DA9CAC7E67FD3631C ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
11:12:51.0401 0x3c24 CmBatt - ok
11:12:51.0409 0x3c24 [ C537B1DB64D495B9B4717B4D6D9EDBF2, 400EEFE662DE117C9CC956E4CBD5E98F28F962E7447CD93E8A78FDD8CA39EB4B ] cmdide C:\Windows\system32\drivers\cmdide.sys
11:12:51.0434 0x3c24 cmdide - ok
11:12:51.0457 0x3c24 [ 85449EEBE8F8EBD6481EFBF0F352B4EB, E6FF04970C5A5BFDE7297A86C1C7B9BFE2E0F976A1A1AFB874CEB488DC6151CC ] CNG C:\Windows\system32\Drivers\cng.sys
11:12:51.0515 0x3c24 CNG - ok
11:12:51.0525 0x3c24 [ A6023D3823C37043986713F118A89BEE, FAC239A7FA6251C7EDFFA34B4BAE3910B8BC0BD4A3574B6DB6931A8D691E207B ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
11:12:51.0551 0x3c24 Compbatt - ok
11:12:51.0564 0x3c24 [ CBE8C58A8579CFE5FCCF809E6F114E89, AC083A1C649EBA18C59FCC1772D0784B10E2B8C63094E3C14388E147DBC3F6DF ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
11:12:51.0594 0x3c24 CompositeBus - ok
11:12:51.0601 0x3c24 COMSysApp - ok
11:12:51.0611 0x3c24 [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1, 6FC323217D82EF661BA0E3F949B61B05BB5235D1A69C81D24876C2153FAECEF6 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
11:12:51.0638 0x3c24 crcdisk - ok
11:12:51.0655 0x3c24 [ 7CA1BECEA5DE2643ADDAD32670E7A4C9, E3AB4CC52A97E3855D7EAB87363F807FDD2162ED8C76A036CD71549ED64E7797 ] CryptSvc C:\Windows\system32\cryptsvc.dll
11:12:51.0694 0x3c24 CryptSvc - ok
11:12:51.0718 0x3c24 [ 3C2177A897B4CA2788C6FB0C3FD81D4B, 98575CBD0664586E6211D02E71BDD52CBAA149A1658573550E29E74E5F7B1553 ] CSC C:\Windows\system32\drivers\csc.sys
11:12:51.0774 0x3c24 CSC - ok
11:12:51.0804 0x3c24 [ 15F93B37F6801943360D9EB42485D5D3, DD6838C6496CB15F8BB57A6596F6A64ADD9C36B09F062295699131232712B558 ] CscService C:\Windows\System32\cscsvc.dll
11:12:51.0852 0x3c24 CscService - ok
11:12:51.0880 0x3c24 [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] DcomLaunch C:\Windows\system32\rpcss.dll
11:12:51.0939 0x3c24 DcomLaunch - ok
11:12:51.0956 0x3c24 [ 8D6E10A2D9A5EED59562D9B82CF804E1, 888F9650F4E872BA8F4E0C27E38A6672A561042B17EBA40E306A22357965B0AD ] defragsvc C:\Windows\System32\defragsvc.dll
11:12:52.0021 0x3c24 defragsvc - ok
11:12:52.0031 0x3c24 [ F024449C97EC1E464AAFFDA18593DB88, 7EF1E241892E098A472BCA14C724DFF1AACCF190954AF1C4A38B6D542CC74BD2 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
11:12:52.0082 0x3c24 DfsC - ok
11:12:52.0093 0x3c24 [ 1D93C52AF82D68CFF028B51AA8E024C6, D68DBA930EF89FD3A6D7FF889722EE458D52550411FA399CF20F3BA62AAB9FBA ] dg_ssudbus C:\Windows\system32\DRIVERS\ssudbus.sys
11:12:52.0122 0x3c24 dg_ssudbus - ok
11:12:52.0139 0x3c24 [ E9E01EB683C132F7FA27CD607B8A2B63, 4D9037B458C522874619143A4176BCED42472C68933E6E83D37B67242706F3C4 ] Dhcp C:\Windows\system32\dhcpcore.dll
11:12:52.0186 0x3c24 Dhcp - ok
11:12:52.0195 0x3c24 [ 1A050B0274BFB3890703D490F330C0DA, 79D74F4679A2EE040FAAF4D0392A9311239A10A5F8A5CCB48656C6F89B6D62FB ] discache C:\Windows\system32\drivers\discache.sys
11:12:52.0236 0x3c24 discache - ok
11:12:52.0245 0x3c24 [ 565003F326F99802E68CA78F2A68E9FF, ABC42B24DBA4FFC411120E09278EF26AF56CCAB463B69B4BD6C530B4A07063D2 ] Disk C:\Windows\system32\drivers\disk.sys
11:12:52.0274 0x3c24 Disk - ok
11:12:52.0284 0x3c24 [ 2A958EF85DB1B61FFCA65044FA4BCE9E, C83511685EE1CE85A5ADF9B5BE96C375A521601F66024BDC3EE044C0B6E85D69 ] dmvsc C:\Windows\system32\drivers\dmvsc.sys
11:12:52.0317 0x3c24 dmvsc - ok
11:12:52.0330 0x3c24 [ 33EF4861F19A0736B11314AAD9AE28D0, 4C4B84365D85758E3263B88F157D8B086B392C6F1EA5F0F3DB6BF87EF90248EC ] Dnscache C:\Windows\System32\dnsrslvr.dll
11:12:52.0368 0x3c24 Dnscache - ok
11:12:52.0386 0x3c24 [ 366BA8FB4B7BB7435E3B9EACB3843F67, 65B7C61ACF34F1F0149045AA9E09A3F917A927963237A385A914D0B80551DC31 ] dot3svc C:\Windows\System32\dot3svc.dll
11:12:52.0454 0x3c24 dot3svc - ok
11:12:52.0468 0x3c24 [ 8EC04CA86F1D68DA9E11952EB85973D6, 2E3FBC2D683D1274E8BC45EEEA87D43B77EDDCAAF0D453296D9FDA6B9D717071 ] DPS C:\Windows\system32\dps.dll
11:12:52.0513 0x3c24 DPS - ok
11:12:52.0520 0x3c24 [ B918E7C5F9BF77202F89E1A9539F2EB4, C589A37DE50BBEF22E2DAA9682EA43147F614AA1AF7DAAA942BA5FC192313A0B ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
11:12:52.0546 0x3c24 drmkaud - ok
11:12:52.0585 0x3c24 [ 71BC35067CABC02C9453AEAA42B2E43E, 713B19F2C08EA5E4C087F7A74A8856932CF33E19D63384823DD4E02ED8798619 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
11:12:52.0654 0x3c24 DXGKrnl - ok
11:12:52.0676 0x3c24 [ 377AD53E4154477339290B4212E69D53, CFB201699CBB9416963973DB2E45810760BEBABAE684EC06E35495601A8A10AF ] e1express C:\Windows\system32\DRIVERS\e1e6232.sys
11:12:52.0711 0x3c24 e1express - ok
11:12:52.0722 0x3c24 [ 8600142FA91C1B96367D3300AD0F3F3A, 5713625E27DF11FAAFDA7AC79899A6AD813166E167088FA990EC5DE87DBE83DF ] EapHost C:\Windows\System32\eapsvc.dll
11:12:52.0778 0x3c24 EapHost - ok
11:12:52.0918 0x3c24 [ 024E1B5CAC09731E4D868E64DBFB4AB0, AB0826A74BBEE5B7A1B035861B665C79BC98305CFC7D82BEF420558FBD3EE994 ] ebdrv C:\Windows\system32\drivers\evbdx.sys
11:12:53.0123 0x3c24 ebdrv - ok
11:12:53.0141 0x3c24 [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] EFS C:\Windows\System32\lsass.exe
11:12:53.0163 0x3c24 EFS - ok
11:12:53.0193 0x3c24 [ A8C362018EFC87BEB013EE28F29C0863, 07971C681FBD391C0BA0172618AF8AD77520182207F1C57F134B34D6A113857F ] ehRecvr C:\Windows\ehome\ehRecvr.exe
11:12:53.0263 0x3c24 ehRecvr - ok
11:12:53.0275 0x3c24 [ D389BFF34F80CAEDE417BF9D1507996A, 12859B9925D7A4631DE61A820922F43F56ED23C2AF014CBF36322685E5CF641E ] ehSched C:\Windows\ehome\ehsched.exe
11:12:53.0311 0x3c24 ehSched - ok
11:12:53.0338 0x3c24 [ 0ED67910C8C326796FAA00B2BF6D9D3C, 97FAA7627A162B0AEC15545E0165D13355D535B4157604BB87F8EEB72ECD24A8 ] elxstor C:\Windows\system32\drivers\elxstor.sys
11:12:53.0387 0x3c24 elxstor - ok
11:12:53.0396 0x3c24 [ 8FC3208352DD3912C94367A206AB3F11, 69B65C12BDADD4B730508674B1B77C5496612B4ACCC447DB9AFE49ADEA8CBF02 ] ErrDev C:\Windows\system32\drivers\errdev.sys
11:12:53.0426 0x3c24 ErrDev - ok
11:12:53.0451 0x3c24 [ F6916EFC29D9953D5D0DF06882AE8E16, ED41893960018D5EC2F7829B1DE4B6967D9FD074D60B11B9EB854E3E0948EC24 ] EventSystem C:\Windows\system32\es.dll
11:12:53.0504 0x3c24 EventSystem - ok
11:12:53.0517 0x3c24 [ 2DC9108D74081149CC8B651D3A26207F, 75CB47923A867DDAC512701CE71DFCFC340FC3A2E27F4255D0836A1FBC463176 ] exfat C:\Windows\system32\drivers\exfat.sys
11:12:53.0574 0x3c24 exfat - ok
11:12:53.0587 0x3c24 [ 7E0AB74553476622FB6AE36F73D97D35, 41463A255FDA1D550B3385EC7C73ABC343B1BBBE9CEE4DF9F2A8B3E7338C4947 ] fastfat C:\Windows\system32\drivers\fastfat.sys
11:12:53.0644 0x3c24 fastfat - ok
11:12:53.0672 0x3c24 [ 967EA5B213E9984CBE270205DF37755B, 43153E23210B03FAE16897D62D55B8742F834EDC695F8401EAB5DE307F62602D ] Fax C:\Windows\system32\fxssvc.exe
11:12:53.0736 0x3c24 Fax - ok
11:12:53.0746 0x3c24 [ E817A017F82DF2A1F8CFDBDA29388B29, 4CC9320A21E6FEA2D16C48D6BEA14391B695BD541A3C5FDDAEEE086A414FC837 ] fdc C:\Windows\system32\drivers\fdc.sys
11:12:53.0773 0x3c24 fdc - ok
11:12:53.0781 0x3c24 [ F3222C893BD2F5821A0179E5C71E88FB, A85B947249DBB986358CCD4B158DD58A9301F074F3C6CCCDEF2D01F432E59D1B ] fdPHost C:\Windows\system32\fdPHost.dll
11:12:53.0829 0x3c24 fdPHost - ok
11:12:53.0837 0x3c24 [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B, 0E76C29D2A974A3F2FBFCB63D066D4136B78E02F6B1F579B1865CA7A76193987 ] FDResPub C:\Windows\system32\fdrespub.dll
11:12:53.0888 0x3c24 FDResPub - ok
11:12:53.0897 0x3c24 [ 6CF00369C97F3CF563BE99BE983D13D8, F65F35324A2FB9DFB533B1C4D089D990CC242218FE83414329D07B786D8EFF33 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
11:12:53.0926 0x3c24 FileInfo - ok
11:12:53.0934 0x3c24 [ 42C51DC94C91DA21CB9196EB64C45DB9, 388C68D12ECC8FFE3116FEAAF4DB7B80CF4A3F97E935788DD21C6ADE2369F635 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
11:12:53.0982 0x3c24 Filetrace - ok
11:12:53.0991 0x3c24 [ 87907AA70CB3C56600F1C2FB8841579B, CA1CD82A1CD453617CE5EA431A1836997F14E3580554E8A516D9FE1E9926D979 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
11:12:54.0018 0x3c24 flpydisk - ok
11:12:54.0033 0x3c24 [ 7520EC808E0C35E0EE6F841294316653, 6EC65511B4838A7172A8F89E35C2F9DF4F0BFCE3BE12EDA790F3EB567102FF67 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
11:12:54.0073 0x3c24 FltMgr - ok
11:12:54.0131 0x3c24 [ E12C4928B32ACE04610259647F072635, B71B9C2DF45F33C4DAC88435129B08B0BCDBBE82E8C3AD0A95F00137CC8B619F ] FontCache C:\Windows\system32\FntCache.dll
11:12:54.0215 0x3c24 FontCache - ok
11:12:54.0227 0x3c24 [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F, DBED26852B99B362152DA9CD4F31A1883EF6F9B496F3CF3772A197BA72DB61DA ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
11:12:54.0251 0x3c24 FontCache3.0.0.0 - ok
11:12:54.0261 0x3c24 [ 1A16B57943853E598CFF37FE2B8CBF1D, 87609F46F3B8123552141FD70866E895220B1BBD92BC2B580CAF49201AA0197E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
11:12:54.0289 0x3c24 FsDepends - ok
11:12:54.0297 0x3c24 [ 7DAE5EBCC80E45D3253F4923DC424D05, 8A2C4D5591509B0B0A44583520617A9AE34F32BB6E68A012A7D7870ED24F703A ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
11:12:54.0324 0x3c24 Fs_Rec - ok
11:12:54.0339 0x3c24 [ E306A24D9694C724FA2491278BF50FDB, 1D246B9C28550640EACBF8CF9DC980FD75106B92832D392FEBEF0C7012353091 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
11:12:54.0368 0x3c24 fvevol - ok
11:12:54.0378 0x3c24 [ 65EE0C7A58B65E74AE05637418153938, 0E1A398ADD8411AF4CCC3344D67BE1B261320C58328BD5C5855A357476FAEBEF ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
11:12:54.0407 0x3c24 gagp30kx - ok
11:12:54.0439 0x3c24 [ E897EAF5ED6BA41E081060C9B447A673, A428DC68516F19C6C53A8B62E4BDB2587E70FB751B9D77700B6B147D347DA157 ] gpsvc C:\Windows\System32\gpsvc.dll
11:12:54.0509 0x3c24 gpsvc - ok
11:12:54.0519 0x3c24 [ C44E3C2BAB6837DB337DDEE7544736DB, 88A24FF7D2FECCEAFFD421B2039A0FB623DA47A6B220B80EF1E52DD26D9E222D ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
11:12:54.0548 0x3c24 hcw85cir - ok
11:12:54.0568 0x3c24 [ A5EF29D5315111C80A5C1ABAD14C8972, A181DA72E946F121C3F4A19438C547B0BFD15138AB1DB5465945EC89DF1F6B0A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
11:12:54.0619 0x3c24 HdAudAddService - ok
11:12:54.0631 0x3c24 [ 9036377B8A6C15DC2EEC53E489D159B5, 1E56D2ACFE92E6DF96D755B05C63D580EED82C210F075C8623E138BEE6BCD41B ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
11:12:54.0657 0x3c24 HDAudBus - ok
11:12:54.0665 0x3c24 [ 1D58A7F3E11A9731D0EAAAA8405ACC36, 7056FA18B86FBD52C4A6092D80476C02553EA053D6A0BEDB01A2FA5E152D5215 ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
11:12:54.0692 0x3c24 HidBatt - ok
11:12:54.0706 0x3c24 [ 89448F40E6DF260C206A193A4683BA78, 71E0FCC32AE6FF8DFF420DB0383D6A200E1EAE14BD2E32453F92CE18B31C1F3C ] HidBth C:\Windows\system32\drivers\hidbth.sys
11:12:54.0752 0x3c24 HidBth - ok
11:12:54.0762 0x3c24 [ CF50B4CF4A4F229B9F3C08351F99CA5E, B97843620AF80FF0EC8F2C438255C0A42A756C6314FAF3DEF415DE16E14C108F ] HidIr C:\Windows\system32\drivers\hidir.sys
11:12:54.0793 0x3c24 HidIr - ok
11:12:54.0802 0x3c24 [ 2BC6F6A1992B3A77F5F41432CA6B3B6B, 2AF3312F1C8C8923C0A29AA5DAE57CE269417E53DEA2F0CCCC8DB57029698FE1 ] hidserv C:\Windows\System32\hidserv.dll
11:12:54.0857 0x3c24 hidserv - ok
11:12:54.0866 0x3c24 [ 10C19F8290891AF023EAEC0832E1EB4D, E208553029488A6EE2F5216CC9FE5F93E9931A94C0D0625253BB159E30642853 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
11:12:54.0897 0x3c24 HidUsb - ok
11:12:54.0906 0x3c24 [ 196B4E3F4CCCC24AF836CE58FACBB699, 7A2E1F603A073421FA0987EFB96647F1F0F2D4E0C82AA62EBC041585DA811DAF ] hkmsvc C:\Windows\system32\kmsvc.dll
11:12:54.0958 0x3c24 hkmsvc - ok
11:12:54.0973 0x3c24 [ 6658F4404DE03D75FE3BA09F7ABA6A30, E51D9C1580A283EB862F09B73AAE1B647DD683A53F3DD99834222F12DD15E40F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
11:12:55.0025 0x3c24 HomeGroupListener - ok
11:12:55.0040 0x3c24 [ DBC02D918FFF1CAD628ACBE0C0EAA8E8, 02121800D9062692C102475876AE8143EBE46D855E8328B8CDCFE6A2F0D19696 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
11:12:55.0084 0x3c24 HomeGroupProvider - ok
11:12:55.0094 0x3c24 [ 295FDC419039090EB8B49FFDBB374549, 670E8015FD374640C6570F56F7FE8DE4D8F92E7A8072F5D1B2B95D0BD699CEF7 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
11:12:55.0125 0x3c24 HpSAMD - ok
11:12:55.0175 0x3c24 [ 7BC42C65B5C6281777C1A7605B253BA8, 71885EB4E8625450ECA4623466FB3D5437DAABE739A5DC3B5F4CF982A65F8A86 ] HSF_DPV C:\Windows\system32\DRIVERS\HSX_DPV.sys
11:12:55.0263 0x3c24 HSF_DPV - ok
11:12:55.0282 0x3c24 [ 9EBF2D102CCBB6BCDFBF1B7922F8BA2E, A11CE324DD8E8BDFFDF513429C32D3C16EC79DC9A7517048587759B26BF38583 ] HSXHWAZL C:\Windows\system32\DRIVERS\HSXHWAZL.sys
11:12:55.0322 0x3c24 HSXHWAZL - ok
11:12:55.0351 0x3c24 [ 871917B07A141BFF43D76D8844D48106, 30C702008D0EE57D63F74864967DD19A55A268E77E42B5B3CC73037AD51D2987 ] HTTP C:\Windows\system32\drivers\HTTP.sys
11:12:55.0414 0x3c24 HTTP - ok
11:12:55.0425 0x3c24 [ 0C4E035C7F105F1299258C90886C64C5, CFB4FBE7B28058E6D3E6E508CF3C1645F6AAE0AFEB4C5364835B9C42311DF0D4 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
11:12:55.0445 0x3c24 hwpolicy - ok
11:12:55.0455 0x3c24 [ F151F0BDC47F4A28B1B20A0818EA36D6, 84B24B5796D9F70A8C37773F5484A4606CC7908370CCD942627ACBEDC4952D79 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
11:12:55.0488 0x3c24 i8042prt - ok
11:12:55.0513 0x3c24 [ A3CAE5D281DB4CFF7CFF8233507EE5AD, 2666107220B9F301193F2CF85A3D6B09E6E42CC150152D10A8886E47A3FD9B0D ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
11:12:55.0561 0x3c24 iaStorV - ok
11:12:55.0605 0x3c24 [ C521D7EB6497BB1AF6AFA89E322FB43C, BDDCFCBB5B76A9295669B5AC9F732D6127199ED5C300770B554C4E4794F66BB7 ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:12:55.0688 0x3c24 idsvc - ok
11:12:55.0703 0x3c24 IEEtwCollectorService - ok
11:12:55.0919 0x3c24 [ 1F50623259DF354776DF04C56504A2D7, AC9D7A588638C00091C2CB7A257182DB72AF9C924BDEA20BAF10CC556896BA75 ] igfx C:\Windows\system32\DRIVERS\igdkmd32.sys
11:12:56.0212 0x3c24 igfx - ok
11:12:56.0235 0x3c24 [ 4173FF5708F3236CF25195FECD742915, 0A9C0701DF6EAC6602BE342FC13C7950EF04BB5BDF7D96C2C5DABBD2A29AA55D ] iirsp C:\Windows\system32\drivers\iirsp.sys
11:12:56.0263 0x3c24 iirsp - ok
11:12:56.0298 0x3c24 [ B9C54120F46392100478F58F374E5709, A28EE8B0988F580D5984E815FC78DF41B169260814234AA0E453375542D0957B ] IKEEXT C:\Windows\System32\ikeext.dll
11:12:56.0372 0x3c24 IKEEXT - ok
11:12:56.0386 0x3c24 [ A0F12F2C9BA6C72F3987CE780E77C130, 5F53DF8BE1621AA7DFB655CFD9C95E0AFA1AD3CE2E290E19D7B7FB3C6E380034 ] intelide C:\Windows\system32\drivers\intelide.sys
11:12:56.0411 0x3c24 intelide - ok
11:12:56.0420 0x3c24 [ 3B514D27BFC4ACCB4037BC6685F766E0, F12D7AC62F8550E6F33B28AD751D8413AB7FFEF963242D99FFA76CE8A48B027A ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
11:12:56.0441 0x3c24 intelppm - ok
11:12:56.0452 0x3c24 [ ACB364B9075A45C0736E5C47BE5CAE19, 202F77C659103D2D0E787B8CB0A23BE32EA5AA2E6B3B0A0F0A8DFA906AB3C0C0 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
11:12:56.0508 0x3c24 IPBusEnum - ok
11:12:56.0518 0x3c24 [ 709D1761D3B19A932FF0238EA6D50200, 0A9D2C3A6E91CA45540555B40CB4E2DF3EBE98C1D164C4EECEE20C86782F5823 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:12:56.0570 0x3c24 IpFilterDriver - ok
11:12:56.0596 0x3c24 [ 58F67245D041FBE7AF88F4EAF79DF0FA, 67468D6A46FF4D87AD321BFEA42F2FC843D09AA292A119C76D4D795D06028F96 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
11:12:56.0642 0x3c24 iphlpsvc - ok
11:12:56.0653 0x3c24 [ 4BD7134618C1D2A27466A099062547BF, 20284ABEF4433A59E2981F4143CAEC67DC990864FE0B9E3DC70EE0B88539E964 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
11:12:56.0684 0x3c24 IPMIDRV - ok
11:12:56.0695 0x3c24 [ A5FA468D67ABCDAA36264E463A7BB0CD, EDB828D596E43372F97DAE1AADA46428C4C45FB80646DDC64FAD5F25C826CF63 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
11:12:56.0750 0x3c24 IPNAT - ok
11:12:56.0761 0x3c24 [ 9F7E491FB0BA0F9E370163834FC1FE31, 313D81BEBEC8C3F370FD1C9CC49931F0F178E6BA0581E6594EE1C64275FC157D ] irda C:\Windows\system32\DRIVERS\irda.sys
11:12:56.0798 0x3c24 irda - ok
11:12:56.0806 0x3c24 [ 42996CFF20A3084A56017B7902307E9F, 688176DAB91BE569280E4822E4C5BDE755794D293591C53F8047AD59C441751D ] IRENUM C:\Windows\system32\drivers\irenum.sys
11:12:56.0838 0x3c24 IRENUM - ok
11:12:56.0846 0x3c24 [ 4220D2F03D5C4226D0A1AA4B84025E45, 9002F4CB026CB0D71FFF4CC420C0F3573DA9F70B574A18AE7EF84D5B0A64D472 ] Irmon C:\Windows\System32\irmon.dll
11:12:56.0879 0x3c24 Irmon - ok
11:12:56.0888 0x3c24 [ 1F32BB6B38F62F7DF1A7AB7292638A35, 86522358680FBB1CEBC56B4D139290689BB0F71A3EC78CE883E4D75D0B37586F ] isapnp C:\Windows\system32\drivers\isapnp.sys
11:12:56.0917 0x3c24 isapnp - ok
11:12:56.0933 0x3c24 [ CB7A9ABB12B8415BCE5D74994C7BA3AE, 464BFF3F5EEE985BE075E23E1813F5CB82A9A0771A92C6D889B13B867BCDF647 ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
11:12:56.0975 0x3c24 iScsiPrt - ok
11:12:56.0985 0x3c24 [ ADEF52CA1AEAE82B50DF86B56413107E, A3AE1E96B04AC81665ABBD3CB267DFB3F78376DAE18FB0DBD447908DDAAA22D2 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
11:12:57.0014 0x3c24 kbdclass - ok
11:12:57.0022 0x3c24 [ 9E3CED91863E6EE98C24794D05E27A71, 90CF59F20E14E4A5A793266805E82BF7AE1F0CF4C7BAB1FD2EEF3B53C5DF770F ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
11:12:57.0050 0x3c24 kbdhid - ok
11:12:57.0057 0x3c24 [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] KeyIso C:\Windows\system32\lsass.exe
11:12:57.0078 0x3c24 KeyIso - ok
11:12:57.0088 0x3c24 [ 4120DA10AA42A9996F4575DB9E3E6E6E, 1C6E790772EA327ACB885D731A030408160534997DD56FEE4D6CEE6929873BB8 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
11:12:57.0117 0x3c24 KSecDD - ok
11:12:57.0131 0x3c24 [ D3964885F0A11ACF51DA3AAA776973B2, 417ED5A3201FC50FBC0D646F8F2114A1E8A91E7919A62508DCBC156C0BFB2FBA ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
11:12:57.0165 0x3c24 KSecPkg - ok
11:12:57.0185 0x3c24 [ 89A7B9CC98D0D80C6F31B91C0A310FCD, 4583CAEEE0D50C0C7CE955E533FDA063CDC37B69033D41EF22EF1BA242E4C747 ] KtmRm C:\Windows\system32\msdtckrm.dll
11:12:57.0254 0x3c24 KtmRm - ok
11:12:57.0269 0x3c24 [ D64AF876D53ECA3668BB97B51B4E70AB, D5C07C019BFEAFBEDC29AB5060356A3B07449712B21B50E03378BEF04AF180F9 ] LanmanServer C:\Windows\System32\srvsvc.dll
11:12:57.0330 0x3c24 LanmanServer - ok
11:12:57.0341 0x3c24 [ 58405E4F68BA8E4057C6E914F326ABA2, C3E6519A1A38F1B3597D4391E42ABFE8F1F5E86256C4B3BD876CDAD9BB68B0A6 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
11:12:57.0396 0x3c24 LanmanWorkstation - ok
11:12:57.0408 0x3c24 [ F7611EC07349979DA9B0AE1F18CCC7A6, 879AA7A391966F00761CA039C25EBC62F6712DD5461694911EEC673E12DE103E ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
11:12:57.0459 0x3c24 lltdio - ok
11:12:57.0476 0x3c24 [ 5700673E13A2117FA3B9020C852C01E2, 6684A2905EE8C438F2A64BE47E51A54D287B08DEFB8E0AE7FC2809D845EE3C5F ] lltdsvc C:\Windows\System32\lltdsvc.dll
11:12:57.0537 0x3c24 lltdsvc - ok
11:12:57.0545 0x3c24 [ 55CA01BA19D0006C8F2639B6C045E08B, 4DBBDC820C514DB18CC13F8EE178F8C4E39C295C6E3C255416C235553CE7BDC1 ] lmhosts C:\Windows\System32\lmhsvc.dll
11:12:57.0592 0x3c24 lmhosts - ok
11:12:57.0607 0x3c24 [ EB119A53CCF2ACC000AC71B065B78FEF, 1FD60735C4945AE565C223F0B47EAF9602D8777E3D15600914C1A9D761215AF9 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
11:12:57.0637 0x3c24 LSI_FC - ok
11:12:57.0648 0x3c24 [ 8ADE1C877256A22E49B75D1CC9161F9C, 3D64F233DC866537E50549A7C1A2B40A954055B22F0BDA39825B04C38C607CB7 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
11:12:57.0679 0x3c24 LSI_SAS - ok
11:12:57.0688 0x3c24 [ DC9DC3D3DAA0E276FD2EC262E38B11E9, A264990857CBC74036799E17A087130626C0A09BE19879019BAF2D761C62AECC ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
11:12:57.0716 0x3c24 LSI_SAS2 - ok
11:12:57.0727 0x3c24 [ 0A036C7D7CAB643A7F07135AC47E0524, 2F662D07FCB74B8D493156DB555EAA90A47E93CF14C7B30039D2FE47EB8682B8 ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
11:12:57.0758 0x3c24 LSI_SCSI - ok
11:12:57.0770 0x3c24 [ 6703E366CC18D3B6E534F5CF7DF39CEE, 7396B9AF938284D99EC51206A7B2FA4A0DC10A493DCE6707818B03A7473782C4 ] luafv C:\Windows\system32\drivers\luafv.sys
11:12:57.0824 0x3c24 luafv - ok
11:12:57.0836 0x3c24 [ BFB9EE8EE977EFE85D1A3105ABEF6DD1, D2A84EBF0C0B7A14AD432FD2EF43CC12300027AEA3FA4075659FB088AB62B588 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
11:12:57.0871 0x3c24 Mcx2Svc - ok
11:12:57.0879 0x3c24 [ 0CEA2D0D3FA284B85ED5B68365114F76, E6FF0EC98FDC3F628438B613C356C237E68686E3B5B17A58A60C16F4B9A2B968 ] mdmxsdk C:\Windows\system32\DRIVERS\mdmxsdk.sys
11:12:57.0901 0x3c24 mdmxsdk - ok
11:12:57.0910 0x3c24 [ 0FFF5B045293002AB38EB1FD1FC2FB74, 49071B565FD5B2DE43EC00D8518C3BE70843F38919E82F13104B8C1FAFB20374 ] megasas C:\Windows\system32\drivers\megasas.sys
11:12:57.0937 0x3c24 megasas - ok
11:12:57.0954 0x3c24 [ DCBAB2920C75F390CAF1D29F675D03D6, 85C3A7A010BEA5E3C6179161B295F2CB900A6A214833A5F87A4327392880E2BB ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
11:12:57.0995 0x3c24 MegaSR - ok
11:12:58.0004 0x3c24 [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] MMCSS C:\Windows\system32\mmcss.dll
11:12:58.0047 0x3c24 MMCSS - ok
11:12:58.0056 0x3c24 [ F001861E5700EE84E2D4E52C712F4964, F4DC5AEED6F34D76CCEF360862CC47EF71097BE0813C8CE04EE5F0DB387DFFAE ] Modem C:\Windows\system32\drivers\modem.sys
11:12:58.0100 0x3c24 Modem - ok
11:12:58.0108 0x3c24 [ 79D10964DE86B292320E9DFE02282A23, 52714827B7EEDACA55326A4E4F6158D4942DFAA3BACDE303A2F569BF3F4FAA72 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
11:12:58.0131 0x3c24 monitor - ok
11:12:58.0139 0x3c24 [ F4EA1193A52C8FE4B8A135E210ABE546, B7370190A3B11A4A458F8B94118971F6C2448562645DAA05A79A93FCE6407B93 ] motccgp C:\Windows\system32\DRIVERS\motccgp.sys
11:12:58.0175 0x3c24 motccgp - ok
11:12:58.0182 0x3c24 [ B812DA6605CAF02641312F1F65C75419, 5001E21AFE5FFC6F0333FE7F1C19DE882348A4BB0881B2E483EF59BC38351239 ] motccgpfl C:\Windows\system32\DRIVERS\motccgpfl.sys
11:12:58.0215 0x3c24 motccgpfl - ok
11:12:58.0223 0x3c24 [ 69814ACD50A9D6D28296050EF6215D46, B8D4F6D7A6922CF146B053BAD6254A20B9FD77DA7425C7E04C4BB21F0561956E ] motmodem C:\Windows\system32\DRIVERS\motmodem.sys
11:12:58.0260 0x3c24 motmodem - ok
11:12:58.0275 0x3c24 [ 3BBC6C2402242401F791548AAEBF3D39, DF0CBD6713D863C1A686367ACFB152C9E75741656E4F0DF3826B8A53EF7BDE57 ] MotoHelper C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
11:12:58.0297 0x3c24 MotoHelper - ok
11:12:58.0304 0x3c24 [ FD8C2CEF7AD8B23C6714103D621FAC1F, E008F2727E15DA513D21F0CA6A5872C089631523B511769857AF35D819D6EA47 ] MotoSwitchService C:\Windows\system32\DRIVERS\motswch.sys
11:12:58.0336 0x3c24 MotoSwitchService - ok
11:12:58.0345 0x3c24 [ DDC489D40B49F443787E7FFA75373522, A2144E20883A5D6502F763879023FA984244985469AE5AABC5AE0E85A32E831C ] Motousbnet C:\Windows\system32\DRIVERS\Motousbnet.sys
11:12:58.0381 0x3c24 Motousbnet - ok
11:12:58.0389 0x3c24 [ F18898D418F43E74A93EDC57E1F28BC9, BFD5C6631F6F9E4E7337ED7470FA0384CE1FDB51E3FC9AC75E661F04036BF2D0 ] motusbdevice C:\Windows\system32\DRIVERS\motusbdevice.sys
11:12:58.0425 0x3c24 motusbdevice - ok
11:12:58.0433 0x3c24 [ FB18CC1D4C2E716B6B903B0AC0CC0609, F10CCA63493782B16DE6B96B94A27078DBE68AECEF34FDF840CFF86D2C6E3C5E ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
11:12:58.0461 0x3c24 mouclass - ok
11:12:58.0470 0x3c24 [ 2C388D2CD01C9042596CF3C8F3C7B24D, B2FB72272BB01AEDA4047B57C943B7E9BD8A6497854F8CC34672AAA592D0A703 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
11:12:58.0502 0x3c24 mouhid - ok
11:12:58.0512 0x3c24 [ FC8771F45ECCCFD89684E38842539B9B, 806DDF2B4830CA866582FE74A521BB7DF26CA0E19013DAF584D3677FB48CC77A ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
11:12:58.0532 0x3c24 mountmgr - ok
11:12:58.0543 0x3c24 [ 4E9D8041D352A33332FD6F59A3A78B03, D4E6229B07EF9866993EEE4F6223DC7F1FF1108273FE14A3DC74E65C181DE56A ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
11:12:58.0578 0x3c24 MozillaMaintenance - ok
11:12:58.0591 0x3c24 [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0, D3D903EEA465D77345AAC9B9F02CDEADF4831212EA2DE4FCA33BEE26EBB47420 ] mpio C:\Windows\system32\drivers\mpio.sys
11:12:58.0627 0x3c24 mpio - ok
11:12:58.0637 0x3c24 [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0, 1D6DCFA0E56C3E55B6AED819176E751502F863BA0FCF4F0B3253A81D208141A2 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
11:12:58.0685 0x3c24 mpsdrv - ok
11:12:58.0715 0x3c24 [ 9835584E999D25004E1EE8E5F3E3B881, 71798B0CBE9AE69F1F29B845319019C69EC7F415CBABB3B87DDE92C360675021 ] MpsSvc C:\Windows\system32\mpssvc.dll
11:12:58.0785 0x3c24 MpsSvc - ok
11:12:58.0798 0x3c24 [ 21F4B24ACFC79A483515BD986DD9043F, 22681907E02E0B723ABE2CEF0602D36C8EF862E7E2B62A9B40A5EF582E58D7BA ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
11:12:58.0835 0x3c24 MRxDAV - ok
11:12:58.0847 0x3c24 [ 5D16C921E3671636C0EBA3BBAAC5FD25, 5BC107B95CAFC88F51FBB9F657B99944B20627A2B618F263093D7045E4FFD65C ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
11:12:58.0884 0x3c24 mrxsmb - ok
11:12:58.0902 0x3c24 [ 6D17A4791ACA19328C685D256349FEFC, 012AA3D84EEAAF53780D06D2D11B9727DFC3441F3FAD75BC9E751FB814403668 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:12:58.0945 0x3c24 mrxsmb10 - ok
11:12:58.0957 0x3c24 [ B81F204D146000BE76651A50670A5E9E, 78193D0F967BE9829E53F9B500342934B4B1E1F4CEFC444382959E2061BC3B17 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:12:58.0989 0x3c24 mrxsmb20 - ok
11:12:58.0997 0x3c24 [ 012C5F4E9349E711E11E0F19A8589F0A, 208B92DFCF7AD43202660FBBC9FF5E03AEDBEE38178FF3628EB74CB6CD37C584 ] msahci C:\Windows\system32\drivers\msahci.sys
11:12:59.0023 0x3c24 msahci - ok
11:12:59.0036 0x3c24 [ 55055F8AD8BE27A64C831322A780A228, C2C9FD1F61302997117B1CD0835E8234405BB80084065ED05363B77868397304 ] msdsm C:\Windows\system32\drivers\msdsm.sys
11:12:59.0069 0x3c24 msdsm - ok
11:12:59.0082 0x3c24 [ E1BCE74A3BD9902B72599C0192A07E27, 5162EB623FE64E9DFEAC6CA2410EFA1314E62EC13207FFBFED2D61AA887603C4 ] MSDTC C:\Windows\System32\msdtc.exe
11:12:59.0123 0x3c24 MSDTC - ok
11:12:59.0159 0x3c24 [ DAEFB28E3AF5A76ABCC2C3078C07327F, 6EB558532400B489763BAE7203538DE5F196282A8CB46A1B31D59120FC5AFCEF ] Msfs C:\Windows\system32\drivers\Msfs.sys
11:12:59.0223 0x3c24 Msfs - ok
11:12:59.0234 0x3c24 [ 3E1E5767043C5AF9367F0056295E9F84, B2EDFECD3C14E4FE1BA87D9A86334043A9BD696A554EBD186DA7EAEB2EBD4F70 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
11:12:59.0279 0x3c24 mshidkmdf - ok
11:12:59.0287 0x3c24 [ 0A4E5757AE09FA9622E3158CC1AEF114, ED574E420E57374E328C7C526504ECA569C164287966F06019EC207CB17F2C54 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
11:12:59.0313 0x3c24 msisadrv - ok
11:12:59.0324 0x3c24 [ 90F7D9E6B6F27E1A707D4A297F077828, BEFC220EAA7307849600748842ACB9254A6A91158812D9B23EFAF912C498BA7F ] MSiSCSI C:\Windows\system32\iscsiexe.dll
11:12:59.0379 0x3c24 MSiSCSI - ok
11:12:59.0387 0x3c24 msiserver - ok
11:12:59.0397 0x3c24 [ 8C0860D6366AAFFB6C5BB9DF9448E631, 949C5A14E57F2D7385543C17C3485E7ADE36EA2016F6E0A1866571D2EDE90A77 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
11:12:59.0443 0x3c24 MSKSSRV - ok
11:12:59.0450 0x3c24 [ 3EA8B949F963562CEDBB549EAC0C11CE, 1B0B2F16A1790282504F3C548D47C3281EFB440D5D9711A1EF76D6371B768D2D ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
11:12:59.0496 0x3c24 MSPCLOCK - ok
11:12:59.0504 0x3c24 [ F456E973590D663B1073E9C463B40932, 48BA6D5580EE7B6A4C06E04772FD35B51779553FC0DD6C5C30DD8B5DEEB25B11 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
11:12:59.0549 0x3c24 MSPQM - ok
11:12:59.0562 0x3c24 [ 0E008FC4819D238C51D7C93E7B41E560, 141FCEBDD05874407EAEC35A9DCD3BB16F2A428F23E55487D6A5DBFCADBF10D2 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
11:12:59.0597 0x3c24 MsRPC - ok
11:12:59.0609 0x3c24 [ FC6B9FF600CC585EA38B12589BD4E246, F05DB01AE1955D2468CE6B51E51998B111CA3B0BDEED090EE6B99B625CBA564A ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
11:12:59.0628 0x3c24 mssmbios - ok
11:12:59.0636 0x3c24 [ B42C6B921F61A6E55159B8BE6CD54A36, 6BB0A7BE005B8F281E551D1B8046CE4202372BC7AE0161881C858BFAC675FE1C ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
11:12:59.0682 0x3c24 MSTEE - ok
11:12:59.0689 0x3c24 [ 33599130F44E1F34631CEA241DE8AC84, E15B31D1AFDC8DC6D2B21D4215796A99ECC69EEDBB06CEED01AECC3C99A44C8B ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
11:12:59.0716 0x3c24 MTConfig - ok
11:12:59.0725 0x3c24 [ 159FAD02F64E6381758C990F753BCC80, E55AB01DCFA95ECAB24A2A9656E28FF9D064BA08B3D82DC8AA42F5991BA09598 ] Mup C:\Windows\system32\Drivers\mup.sys
11:12:59.0753 0x3c24 Mup - ok
11:12:59.0775 0x3c24 [ 61D57A5D7C6D9AFE10E77DAE6E1B445E, D252248532142E9E2332DA693BC51B795102CA938B568FF04981E98B19BFBC5C ] napagent C:\Windows\system32\qagentRT.dll
11:12:59.0844 0x3c24 napagent - ok
11:12:59.0864 0x3c24 [ 26384429FCD85D83746F63E798AB1480, 957C115C263A4B4DC854558B43ECE632D8E2BCCB744E23A01EBA7476BA2E7FFB ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
11:12:59.0916 0x3c24 NativeWifiP - ok
11:12:59.0952 0x3c24 [ 8C9C922D71F1CD4DEF73F186416B7896, 15FF43CD90C7913F83B35F2E7986561584588E8A45196EBD965C3A355836A9C7 ] NDIS C:\Windows\system32\drivers\ndis.sys
11:12:59.0999 0x3c24 NDIS - ok
11:13:00.0011 0x3c24 [ 0E1787AA6C9191D3D319E8BAFE86F80C, F535022747355B2C66424BDA892D7DCB820C2EB8EE05BAE5BC6D1B1D65186278 ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
11:13:00.0060 0x3c24 NdisCap - ok
11:13:00.0067 0x3c24 [ E4A8AEC125A2E43A9E32AFEEA7C9C888, 6EA181117126FC70B3C1DD1AC73CC26D1603A2CF49E47F66623E2C9489C49B55 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
11:13:00.0112 0x3c24 NdisTapi - ok
11:13:00.0121 0x3c24 [ D8A65DAFB3EB41CBB622745676FCD072, 874D3C3D247C4A309DA813DB1D2EDB0037D3C489824BD5FE95B0C20699764EF7 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
11:13:00.0171 0x3c24 Ndisuio - ok
11:13:00.0183 0x3c24 [ 38FBE267E7E6983311179230FACB1017, CFD1CBCA59650795C030DB30E5795B37C11C736E14003AE1DAB081BA5C0C9B14 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
11:13:00.0235 0x3c24 NdisWan - ok
11:13:00.0244 0x3c24 [ A4BDC541E69674FBFF1A8FF00BE913F2, 18CCFD063E9870B8B6958715BC0414C4D920AE63528EA1E9D7E30F7138918FFA ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
11:13:00.0291 0x3c24 NDProxy - ok
11:13:00.0299 0x3c24 [ 80B275B1CE3B0E79909DB7B39AF74D51, 75B406B0D9D28239D4EB2A298419A5F78A58237D88C5FD688EF1DFFAFACCF796 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
11:13:00.0348 0x3c24 NetBIOS - ok
11:13:00.0365 0x3c24 [ 280122DDCF04B378EDD1AD54D71C1E54, F98B2ADE34F7E67C7C06C1D0FFB80ECBC353D044D4B4784CD952910345DC2ED0 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
11:13:00.0411 0x3c24 NetBT - ok
11:13:00.0419 0x3c24 [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] Netlogon C:\Windows\system32\lsass.exe
11:13:00.0439 0x3c24 Netlogon - ok
11:13:00.0458 0x3c24 [ 7CCCFCA7510684768DA22092D1FA4DB2, BB9E4F8FABBF596D888E6D303CB54A336D9DFF95B36AEA9369D2ED787DDC4B5D ] Netman C:\Windows\System32\netman.dll
11:13:00.0529 0x3c24 Netman - ok
11:13:00.0545 0x3c24 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:13:00.0585 0x3c24 NetMsmqActivator - ok
11:13:00.0596 0x3c24 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:13:00.0621 0x3c24 NetPipeActivator - ok
11:13:00.0643 0x3c24 [ 8C338238C16777A802D6A9211EB2BA50, 0D08A47CD403EDA5E8CAD7409BBBBCDC29A9861D2DC41D42B68B22B1AA1EBDD6 ] netprofm C:\Windows\System32\netprofm.dll
11:13:00.0703 0x3c24 netprofm - ok
11:13:00.0715 0x3c24 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:13:00.0740 0x3c24 NetTcpActivator - ok
11:13:00.0751 0x3c24 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:13:00.0776 0x3c24 NetTcpPortSharing - ok
11:13:00.0785 0x3c24 [ 1D85C4B390B0EE09C7A46B91EFB2C097, 6A8850B151E88EE371F3CC543A946302DDF9494908D684B8B0C706A42CC54348 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
11:13:00.0813 0x3c24 nfrd960 - ok
11:13:00.0830 0x3c24 [ 374071043F9E4231EE43BE2BB48DD36D, C4FA3FC40CC49DBBB91901D14210A55D3831FAC9F9B3FF45FCA7F5CF242C9E92 ] NlaSvc C:\Windows\System32\nlasvc.dll
11:13:00.0876 0x3c24 NlaSvc - ok
11:13:00.0885 0x3c24 [ 1DB262A9F8C087E8153D89BEF3D2235F, A51EE5D5AD3CD76B74BEA9C66C462608BF3B50C53DAA4110A75DB10495A8C101 ] Npfs C:\Windows\system32\drivers\Npfs.sys
11:13:00.0934 0x3c24 Npfs - ok
11:13:00.0942 0x3c24 [ 6D8D2E5652FC2442C810C5D8BE784148, 013FF4FA03CA2E066B1946CC09889616B243068BA0FB2E58D4C1435BF66FBC87 ] NSCIRDA C:\Windows\system32\DRIVERS\nscirda.sys
11:13:00.0968 0x3c24 NSCIRDA - ok
11:13:00.0976 0x3c24 [ BA387E955E890C8A88306D9B8D06BF17, 3477BD9686C5777A93251C154512671AAA7533B18C536DF51F7B1D6D28E7F8A5 ] nsi C:\Windows\system32\nsisvc.dll
11:13:01.0026 0x3c24 nsi - ok
11:13:01.0034 0x3c24 [ E9A0A4D07E53D8FEA2BB8387A3293C58, 690CAD6C4E35ECC1172A2E1FD3933DF73158B3BF42CB21244269612A53DE4D7A ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
11:13:01.0075 0x3c24 nsiproxy - ok
11:13:01.0135 0x3c24 [ 5E43D2B0EE64123D4880DFA6626DEFDE, 164413A22DE58B19EA2B4120034B46D6BE1F424B80C3421E10BE5C81153D049F ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
11:13:01.0231 0x3c24 Ntfs - ok
11:13:01.0242 0x3c24 [ F9756A98D69098DCA8945D62858A812C, 572ADBFCFDE2030B34A013AADC14DBC144EB3F34D06991E2464A3EA9605BC045 ] Null C:\Windows\system32\drivers\Null.sys
11:13:01.0288 0x3c24 Null - ok
11:13:01.0299 0x3c24 [ AF2EEC9580C1D32FB7EAF105D9784061, 6DAAE3BCA048ACD7FFD26A65C793C461933179070F03855FE3DC3C01F968163A ] nvraid C:\Windows\system32\drivers\nvraid.sys
11:13:01.0332 0x3c24 nvraid - ok
11:13:01.0345 0x3c24 [ 9283C58EBAA2618F93482EB5DABCEC82, 0BC119D4EAFDEA879E4C1CFBA5402499DBD1970EDF963C6D2034D4867C34D15E ] nvstor C:\Windows\system32\drivers\nvstor.sys
11:13:01.0379 0x3c24 nvstor - ok
11:13:01.0390 0x3c24 [ 5A0983915F02BAE73267CC2A041F717D, D83461D74597BF2BE042FEFCC27FCD18BF63CB8135B0666D731D50951C3468A8 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
11:13:01.0423 0x3c24 nv_agp - ok
11:13:01.0433 0x3c24 [ 08A70A1F2CDDE9BB49B885CB817A66EB, 0BB98123B544124B144F3E95D77E01E973D060B8B2302503FF24ABBBE803EB63 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
11:13:01.0465 0x3c24 ohci1394 - ok
11:13:01.0483 0x3c24 [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
11:13:01.0518 0x3c24 p2pimsvc - ok
11:13:01.0538 0x3c24 [ 59C3DDD501E39E006DAC31BF55150D91, E02B63AB7F34CF6FF3F644AF354D10004E6F50014E03172D80BD78934EF71EF1 ] p2psvc C:\Windows\system32\p2psvc.dll
11:13:01.0591 0x3c24 p2psvc - ok
11:13:01.0602 0x3c24 [ 2EA877ED5DD9713C5AC74E8EA7348D14, 14BA3722CE5F8FF07F2D97DCDD6558EB49C9B02E5E6FAD6D9F18D354733EFECE ] Parport C:\Windows\system32\drivers\parport.sys
11:13:01.0634 0x3c24 Parport - ok
11:13:01.0643 0x3c24 [ 3F34A1B4C5F6475F320C275E63AFCE9B, 31295D5121C0C3F2085E0EEBA260EEE4CA003993C026E2F81986D19158036E6B ] partmgr C:\Windows\system32\drivers\partmgr.sys
11:13:01.0673 0x3c24 partmgr - ok
11:13:01.0680 0x3c24 [ EB0A59F29C19B86479D36B35983DAADC, AC09AFE7F13BE4079D01383BAC44091997E1AAF6512C9673A42B9E3780EB08A8 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
11:13:01.0705 0x3c24 Parvdm - ok
11:13:01.0718 0x3c24 [ 358AB7956D3160000726574083DFC8A6, 6CAFD4D1B8AB8C1D167ADC018985DDAB5AC2CBFFB3434FE6390F14AF50C19025 ] PcaSvc C:\Windows\System32\pcasvc.dll
11:13:01.0764 0x3c24 PcaSvc - ok
11:13:01.0778 0x3c24 [ 673E55C3498EB970088E812EA820AA8F, 1F81315664B8CBFDD569416C0ECCE4C6251F34577313A0858AB46609781303B5 ] pci C:\Windows\system32\drivers\pci.sys
11:13:01.0816 0x3c24 pci - ok
11:13:01.0824 0x3c24 [ AFE86F419014DB4E5593F69FFE26CE0A, CAF36E61BE7B511D3A03A65FF5A3017CEE4D2F53005B410F2D4A2AAE9FED4C00 ] pciide C:\Windows\system32\drivers\pciide.sys
11:13:01.0849 0x3c24 pciide - ok
11:13:01.0864 0x3c24 [ F396431B31693E71E8A80687EF523506, BC614FC21E029E2497F1CCE3131BBD295B827F2310762B47D5BBC7703D80554B ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
11:13:01.0903 0x3c24 pcmcia - ok
11:13:01.0912 0x3c24 [ 250F6B43D2B613172035C6747AEEB19F, A91F15B133F2619912CF750E6F3662E011CD0FA4B9477CE532CE3196D23307D9 ] pcw C:\Windows\system32\drivers\pcw.sys
11:13:01.0940 0x3c24 pcw - ok
11:13:01.0971 0x3c24 [ 9E0104BA49F4E6973749A02BF41344ED, B32F39F38DB48D77FBA884DEE34112BAB81CCEF5DD2EAAA12D9589D73D2BB116 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
11:13:02.0061 0x3c24 PEAUTH - ok
11:13:02.0112 0x3c24 [ AF4D64D2A57B9772CF3801950B8058A6, C9C493A3775E6E1660CE5DF75DA574D0C04245FB88CF41B96217A725359C350D ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
11:13:02.0186 0x3c24 PeerDistSvc - ok
11:13:02.0274 0x3c24 [ 414BBA67A3DED1D28437EB66AEB8A720, D6DF254E2615FA402044824DCD9004F579FC0DF74B90E44C99D5F0253CF8AD88 ] pla C:\Windows\system32\pla.dll
11:13:02.0413 0x3c24 pla - ok
11:13:02.0437 0x3c24 [ EC7BC28D207DA09E79B3E9FAF8B232CA, A42F8F69C3CD753D787A5D558659DEA2CC306C896D75B8C82549219CF654504F ] PlugPlay C:\Windows\system32\umpnpmgr.dll
11:13:02.0473 0x3c24 PlugPlay - ok
11:13:02.0481 0x3c24 [ 63FF8572611249931EB16BB8EED6AFC8, 9732CCBCB93A7A4BEC88812B952C20244479E9BD781240C195E57F09E619EA33 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
11:13:02.0510 0x3c24 PNRPAutoReg - ok
11:13:02.0528 0x3c24 [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
11:13:02.0559 0x3c24 PNRPsvc - ok
11:13:02.0581 0x3c24 [ 53946B69BA0836BD95B03759530C81EC, 7F14A34635354CCA0F5342C8D9DF5A6AA1B94F6A508BD8834029E9BACF252920 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
11:13:02.0649 0x3c24 PolicyAgent - ok
11:13:02.0669 0x3c24 [ F87D30E72E03D579A5199CCB3831D6EA, B09328E89954584F97908FA5946376BA990B8C650DABCBF3CA3B08719937C694 ] Power C:\Windows\system32\umpo.dll
11:13:02.0714 0x3c24 Power - ok
11:13:02.0724 0x3c24 [ 631E3E205AD6D86F2AED6A4A8E69F2DB, 1D3BF0CFC37D91A3A56246920B9CF1084E78A055D56E85A773417809C58C8065 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
11:13:02.0766 0x3c24 PptpMiniport - ok
11:13:02.0775 0x3c24 [ 85B1E3A0C7585BC4AAE6899EC6FCF011, 1E067113C146D6842D7FB04007F363D6FB7783C6BC7C9AB6614E44075C4F86C3 ] Processor C:\Windows\system32\drivers\processr.sys
11:13:02.0807 0x3c24 Processor - ok
11:13:02.0821 0x3c24 [ CADEFAC453040E370A1BDFF3973BE00D, 2E3DD8DA702468D8AB0F3CE27188B1991D4CB015FB36BAE4C6E7996B61CF49B8 ] ProfSvc C:\Windows\system32\profsvc.dll
11:13:02.0864 0x3c24 ProfSvc - ok
11:13:02.0871 0x3c24 [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] ProtectedStorage C:\Windows\system32\lsass.exe
11:13:02.0892 0x3c24 ProtectedStorage - ok
11:13:02.0904 0x3c24 [ 6270CCAE2A86DE6D146529FE55B3246A, 463209CBAF1B0E269DC8FC6FBDEE5BB7E5ADB5D3F024930BFD0B97E0A9678883 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
11:13:02.0949 0x3c24 Psched - ok
11:13:02.0958 0x3c24 [ 05A0C2744CEAC6F1B723EC469B650EF0, D9F2E0E4431217C6A7CDE38D36362CD5A06E93B9F45F92638120EF151089B370 ] PSKMAD C:\Windows\system32\DRIVERS\PSKMAD.sys
11:13:02.0985 0x3c24 PSKMAD - ok
11:13:03.0049 0x3c24 [ AB95ECF1F6659A60DDC166D8315B0751, 0ED6D3460D28978BADF31B930DBB3298A6A10EFF8883763EABA0E36A21A0E83D ] ql2300 C:\Windows\system32\drivers\ql2300.sys
11:13:03.0145 0x3c24 ql2300 - ok
11:13:03.0161 0x3c24 [ B4DD51DD25182244B86737DC51AF2270, 7E62B04F054A6330B7F9968222523BDE8F3EE47A11D17E6C0E2D5ACDC07B9E6B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
11:13:03.0194 0x3c24 ql40xx - ok
11:13:03.0209 0x3c24 [ 31AC809E7707EB580B2BDB760390765A, A8481FD19A0F778F5591B7676F591F664ADC68B6867E663C0F9564173F4AC909 ] QWAVE C:\Windows\system32\qwave.dll
11:13:03.0259 0x3c24 QWAVE - ok
11:13:03.0267 0x3c24 [ 584078CA1B95CA72DF2A27C336F9719D, 836F115C92D343463C14A9DE39648C1EFA7C7EE4720F5C692EE0F68B84830121 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
11:13:03.0300 0x3c24 QWAVEdrv - ok
11:13:03.0307 0x3c24 [ 30A81B53C766D0133BB86D234E5556AB, 726C6B83B5ACAA84CAB1689B6DD6DDAE3199D61A57B5D7B5B5A0F62FCF838090 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
11:13:03.0353 0x3c24 RasAcd - ok
11:13:03.0361 0x3c24 [ 57EC4AEF73660166074D8F7F31C0D4FD, C66B425EC4DB5E7FD289AE631C9B019EB16717C55E80FAE964BB22203E4AACEF ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
11:13:03.0401 0x3c24 RasAgileVpn - ok
11:13:03.0411 0x3c24 [ A60F1839849C0C00739787FD5EC03F13, B210DFA5A843CF1DA73635F168E2EA5052CBED15C664F8523CDFB34CA165D0E0 ] RasAuto C:\Windows\System32\rasauto.dll
11:13:03.0467 0x3c24 RasAuto - ok
11:13:03.0477 0x3c24 [ D9F91EAFEC2815365CBE6D167E4E332A, 8350457A39D141C13807E7DB5A8D4113197C4016F7744B9993391F4AEA0C4A5C ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
11:13:03.0530 0x3c24 Rasl2tp - ok
11:13:03.0549 0x3c24 [ CB9E04DC05EACF5B9A36CA276D475006, 4D8C0AEF1D4F84F375AD2BAF786C9F6C52316A3E655B913449E71AD7C0FCA56E ] RasMan C:\Windows\System32\rasmans.dll
11:13:03.0618 0x3c24 RasMan - ok
11:13:03.0629 0x3c24 [ 0FE8B15916307A6AC12BFB6A63E45507, 64119474DE7499E6E8B82E78BBD50074B3AA70B3E8329089FAE9B7F29919004E ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
11:13:03.0672 0x3c24 RasPppoe - ok
11:13:03.0682 0x3c24 [ 44101F495A83EA6401D886E7FD70096B, 56A0CE5C89870752B9B2AB795C1A248CA28209E049B2F20CCA0308CBE2488A0A ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
11:13:03.0723 0x3c24 RasSstp - ok
11:13:03.0739 0x3c24 [ D528BC58A489409BA40334EBF96A311B, C71E9A4B101DB6C3183B9F97B9098D73D6FE1B12C05C2EB3CE8A8041BEE6BA61 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
11:13:03.0802 0x3c24 rdbss - ok
11:13:03.0811 0x3c24 [ 0D8F05481CB76E70E1DA06EE9F0DA9DF, 2AFCBE3237D27AFBF095F91F1FCCA63E6890F34A9E4F00E5C34C92394CDA89FB ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
11:13:03.0840 0x3c24 rdpbus - ok
11:13:03.0847 0x3c24 [ 23DAE03F29D253AE74C44F99E515F9A1, 8FED93D10B2062F0526FE3508101F8FCF8F72DEB90AFB472EB7CBAE83A0EC430 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
11:13:03.0885 0x3c24 RDPCDD - ok
11:13:03.0901 0x3c24 [ B973FCFC50DC1434E1970A146F7E3885, BE797E5F5AE34D37F8DA1134CE94DD14DBE36D2BC405B97E992E2257848B7CA9 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
11:13:03.0938 0x3c24 RDPDR - ok
11:13:03.0946 0x3c24 [ 5A53CA1598DD4156D44196D200C94B8A, 8112FE14FEC94C67B1C5BDE4171E37584F1D0098D2C557C9E4BDD3E0291E25E4 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
11:13:03.0984 0x3c24 RDPENCDD - ok
11:13:03.0995 0x3c24 [ 44B0A53CD4F27D50ED461DAE0C0B4E1F, CDA80B08E67AD034081C0C920CD66147689F1844403CBC552F65005E7C011A91 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
11:13:04.0034 0x3c24 RDPREFMP - ok
11:13:04.0045 0x3c24 [ 65375DF758CA1872AB7EBBBA457FD5E6, 8AC7681F51277E799C22FF95FA0B833E9E260D37C0416319FF05B66FB3948005 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
11:13:04.0072 0x3c24 RdpVideoMiniport - ok
11:13:04.0087 0x3c24 [ F031683E6D1FEA157ABB2FF260B51E61, 83B552819A5964152882C527E1421DBCEAACC74DEB897E3C4B53F52F1467FED3 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
11:13:04.0126 0x3c24 RDPWD - ok
11:13:04.0140 0x3c24 [ 518395321DC96FE2C9F0E96AC743B656, 5F6A0880B4F3EE7196259EA362DA9554B0687B0236F9A8E5CF7A4A77F01F1776 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
11:13:04.0179 0x3c24 rdyboost - ok
11:13:04.0189 0x3c24 [ 7B5E1419717FAC363A31CC302895217A, 048B96B127CC20833948DAE53C59886D5C725ECA7A744424A01339447D2DDC32 ] RemoteAccess C:\Windows\System32\mprdim.dll
11:13:04.0240 0x3c24 RemoteAccess - ok
11:13:04.0251 0x3c24 [ CB9A8683F4EF2BF99E123D79950D7935, B9FA3E7E91E76D975CF40BFA37909E50F29CC13AB1399007884710651827E9AA ] RemoteRegistry C:\Windows\system32\regsvc.dll
11:13:04.0309 0x3c24 RemoteRegistry - ok
11:13:04.0322 0x3c24 [ CB928D9E6DAF51879DD6BA8D02F01321, DFD263B67DDF98AE09AF6D6986CBC7BE3206BCE8403AAC51BCF9459E78233D12 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
11:13:04.0391 0x3c24 RFCOMM - ok
11:13:04.0400 0x3c24 [ 78D072F35BC45D9E4E1B61895C152234, 80C924EE1156B4E3172E83DCB9C60817E87885FB9377647E0BF90153E415B1CA ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
11:13:04.0454 0x3c24 RpcEptMapper - ok
11:13:04.0461 0x3c24 [ 94D36C0E44677DD26981D2BFEEF2A29D, D77A93AC60536F3706E8A0154C0C2199E888B7748C84DB7437254FF175F4DF55 ] RpcLocator C:\Windows\system32\locator.exe
11:13:04.0488 0x3c24 RpcLocator - ok
11:13:04.0509 0x3c24 [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] RpcSs C:\Windows\system32\rpcss.dll
11:13:04.0565 0x3c24 RpcSs - ok
11:13:04.0575 0x3c24 [ 032B0D36AD92B582D869879F5AF5B928, 0F8F18A6A0A689957B886D9368015889091094EDA18BE532093F06A70A7CE184 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
11:13:04.0626 0x3c24 rspndr - ok
11:13:04.0633 0x3c24 [ 7FA7F2E249A5DCBB7970630E15E1F482, 9633B193F3FDA67BC551C6DCA4788AB83E9F45F77763EE579D02FE5D6B80DEDF ] s3cap C:\Windows\system32\drivers\vms3cap.sys
11:13:04.0657 0x3c24 s3cap - ok
11:13:04.0665 0x3c24 [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] SamSs C:\Windows\system32\lsass.exe
11:13:04.0686 0x3c24 SamSs - ok
11:13:04.0696 0x3c24 [ 05D860DA1040F111503AC416CCEF2BCA, DAE2F37D09A5A42F945BC8E27E4EA2303521081783A80CEE7FEE7C5A1C2CFC5E ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
11:13:04.0727 0x3c24 sbp2port - ok
11:13:04.0740 0x3c24 [ 8FC518FFE9519C2631D37515A68009C4, 21E10585470CF9FC3BD1977F8A426686CD2FA6BD2094B9E3594B21C7C4541D25 ] SCardSvr C:\Windows\System32\SCardSvr.dll
11:13:04.0795 0x3c24 SCardSvr - ok
11:13:04.0804 0x3c24 [ 0693B5EC673E34DC147E195779A4DCF6, AF1B56FBF3ADABF94CD9DBA67586B8746DE135151F6B3D1B0EE315BC1E2DB670 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
11:13:04.0850 0x3c24 scfilter - ok
11:13:04.0889 0x3c24 [ A04BB13F8A72F8B6E8B4071723E4E336, E63287FF71C39CBF64C3347C455324C8437F9CF398153E269543588B65389502 ] Schedule C:\Windows\system32\schedsvc.dll
11:13:04.0987 0x3c24 Schedule - ok
11:13:04.0999 0x3c24 [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] SCPolicySvc C:\Windows\System32\certprop.dll
11:13:05.0040 0x3c24 SCPolicySvc - ok
11:13:05.0055 0x3c24 [ 08236C4BCE5EDD0A0318A438AF28E0F7, 77727F963F63C4CEC11E7AAD5FB3836179701D512CA9436C3170B9E6A4E5F888 ] SDRSVC C:\Windows\System32\SDRSVC.dll
11:13:05.0094 0x3c24 SDRSVC - ok
11:13:05.0102 0x3c24 [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv C:\Windows\system32\drivers\secdrv.sys
11:13:05.0149 0x3c24 secdrv - ok
11:13:05.0157 0x3c24 [ A59B3A4442C52060CC7A85293AA3546F, 1776D6DEE51991149265AAF39E17065E301C5FA1FF4068653DC0010B9B27185D ] seclogon C:\Windows\system32\seclogon.dll
11:13:05.0209 0x3c24 seclogon - ok
11:13:05.0218 0x3c24 [ DCB7FCDCC97F87360F75D77425B81737, F8289AF2C458C167038EEFE613EE5E3D6D5B3308B8784168374BC81C47891CE5 ] SENS C:\Windows\system32\sens.dll
11:13:05.0263 0x3c24 SENS - ok
11:13:05.0271 0x3c24 [ 50087FE1EE447009C9CC2997B90DE53F, B5E6CF1D991F87C29C5E28198E0962E31FFB499A46C3BD43FC20391693389959 ] SensrSvc C:\Windows\system32\sensrsvc.dll
11:13:05.0302 0x3c24 SensrSvc - ok
11:13:05.0310 0x3c24 [ 9AD8B8B515E3DF6ACD4212EF465DE2D1, E2F019BCD1446236D078D46065DD151DD068778F33BE2F1E8A0CC1EA2F954E86 ] Serenum C:\Windows\system32\drivers\serenum.sys
11:13:05.0350 0x3c24 Serenum - ok
11:13:05.0360 0x3c24 [ 5FB7FCEA0490D821F26F39CC5EA3D1E2, A26DB2EB9F3E2509B4EBA949DB97595CC32332D9321DF68283BFC102E66D766F ] Serial C:\Windows\system32\drivers\serial.sys
11:13:05.0398 0x3c24 Serial - ok
11:13:05.0406 0x3c24 [ 79BFFB520327FF916A582DFEA17AA813, 7A2A9D69BE02228591186A9F4453D4B5FD98837CA422C873C48040170E8BD18C ] sermouse C:\Windows\system32\drivers\sermouse.sys
11:13:05.0440 0x3c24 sermouse - ok
11:13:05.0464 0x3c24 [ 4AE380F39A0032EAB7DD953030B26D28, C8F5F2DD59574E966FDF3057867BB959A554BAB6FD5DC6F1427094A6BC2B2809 ] SessionEnv C:\Windows\system32\sessenv.dll
11:13:05.0527 0x3c24 SessionEnv - ok
11:13:05.0534 0x3c24 [ 9F976E1EB233DF46FCE808D9DEA3EB9C, 6A5C53F27F8BCA85CE206EE7D196176F67EC6FFA5D4830373A20792C149B5E75 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
11:13:05.0563 0x3c24 sffdisk - ok
11:13:05.0570 0x3c24 [ 932A68EE27833CFD57C1639D375F2731, 11D6B98FBEEE2B9C7B06EF7091857BBD3B349077997D6261D66280668FD1B5C3 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
11:13:05.0599 0x3c24 sffp_mmc - ok
11:13:05.0607 0x3c24 [ 6D4CCAEDC018F1CF52866BBBAA235982, AAC41F5C97B3FE5A3DC0838457EB8CC9BB71FCA16D3EDBB67D603F0A9D46C131 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
11:13:05.0637 0x3c24 sffp_sd - ok
11:13:05.0644 0x3c24 [ DB96666CC8312EBC45032F30B007A547, C3AE60FC65A36E96E0D2CC6E184481D70F91A19DC3E2E17E2873DD670A592DD7 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
11:13:05.0671 0x3c24 sfloppy - ok
11:13:05.0691 0x3c24 [ D1A079A0DE2EA524513B6930C24527A2, E2BC16DBCF38841EECD49C6FA1A9AC89C17F332F12606CA826F058E995E1B83D ] SharedAccess C:\Windows\System32\ipnathlp.dll
11:13:05.0762 0x3c24 SharedAccess - ok
11:13:05.0784 0x3c24 [ 414DA952A35BF5D50192E28263B40577, 9C9BAFB9880DA6CC728506A142BE124E186219610DCC3460657A3CA93C865DF1 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
11:13:05.0891 0x3c24 ShellHWDetection - ok
11:13:05.0902 0x3c24 [ 2565CAC0DC9FE0371BDCE60832582B2E, 1A775214E86B83C2F1799F12D71077D81C89AD32734A248BA88787B7F104B79D ] sisagp C:\Windows\system32\drivers\sisagp.sys
11:13:05.0949 0x3c24 sisagp - ok
11:13:05.0967 0x3c24 [ A9F0486851BECB6DDA1D89D381E71055, 7E909538AB758C18AC2CCBFFEE17BA36FA6ED2E674AA70924AA87AC61375FF35 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
11:13:05.0997 0x3c24 SiSRaid2 - ok
11:13:06.0012 0x3c24 [ 3727097B55738E2F554972C3BE5BC1AA, 75D52A596A298C33EC79A3B0B80F25492C08A182ABC679401502DA9597687566 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
11:13:06.0044 0x3c24 SiSRaid4 - ok
11:13:06.0054 0x3c24 [ 3E21C083B8A01CB70BA1F09303010FCE, 803F8F91299C387110F34A49340E7136AAE91B418E2977A36285EA8F432FF197 ] Smb C:\Windows\system32\DRIVERS\smb.sys
11:13:06.0111 0x3c24 Smb - ok
11:13:06.0132 0x3c24 [ 6A984831644ECA1A33FFEAE4126F4F37, 753E23D2B33D47C52C05D892B052CFD96D93B97FB6E9FCB58EF1E4C4A125BF78 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
11:13:06.0164 0x3c24 SNMPTRAP - ok
11:13:06.0174 0x3c24 [ 95CF1AE7527FB70F7816563CBC09D942, CE8BACB91A5A86CBCE82619C6C1873B4D7593B00CED3B522E41B8F7F6258CC65 ] spldr C:\Windows\system32\drivers\spldr.sys
11:13:06.0200 0x3c24 spldr - ok
11:13:06.0219 0x3c24 [ 866A43013535DC8587C258E43579C764, B2BE846B5167A2ECD1E30C69A81385FCC6EAE6033394D08458A5583D311C4D82 ] Spooler C:\Windows\System32\spoolsv.exe
11:13:06.0293 0x3c24 Spooler - ok
11:13:06.0432 0x3c24 [ CF87A1DE791347E75B98885214CED2B8, 7AF4E03D751C951A4E5FBA28200DABFE6B3BF055490163EEEEA84EBA4D0F368A ] sppsvc C:\Windows\system32\sppsvc.exe
11:13:06.0666 0x3c24 sppsvc - ok
11:13:06.0685 0x3c24 [ B0180B20B065D89232A78A40FE56EAA6, 4D045B23AD58A8822BE9F20119744A8D47455469D54494745CEB099951DA60FF ] sppuinotify C:\Windows\system32\sppuinotify.dll
11:13:06.0738 0x3c24 sppuinotify - ok
11:13:06.0757 0x3c24 [ E4C2764065D66EA1D2D3EBC28FE99C46, 043AEF06A23069DD17675955C834690A5FD8F1948A05B3969F977E823C4E25F5 ] srv C:\Windows\system32\DRIVERS\srv.sys
11:13:06.0815 0x3c24 srv - ok
11:13:06.0836 0x3c24 [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB, 4DF31206DF8F33C2975E23C7257ED930C4EDA8BC4E246D8FDA130BB583083ED0 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
11:13:06.0888 0x3c24 srv2 - ok
11:13:06.0904 0x3c24 [ E00FDFAFF025E94F9821153750C35A6D, 6ECDC5F314A29B859B0DCB7FF114CACE0718612556299B16412C21F9539DC9B5 ] SrvHsfHDA C:\Windows\system32\DRIVERS\VSTAZL3.SYS
11:13:06.0947 0x3c24 SrvHsfHDA - ok
11:13:06.0995 0x3c24 [ CEB4E3B6890E1E42DCA6694D9E59E1A0, 00D841690A88F1051A238F67AACCE905E8A59C86070F215A8D31FA3E68C6BF35 ] SrvHsfV92 C:\Windows\system32\DRIVERS\VSTDPV3.SYS
11:13:07.0083 0x3c24 SrvHsfV92 - ok
11:13:07.0120 0x3c24 [ BC0C7EA89194C299F051C24119000E17, F5FB21F7AD7370F3D5DF7C23F33118ECF19865B995AF12E9A8A8D893E7E6264F ] SrvHsfWinac C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
11:13:07.0194 0x3c24 SrvHsfWinac - ok
11:13:07.0208 0x3c24 [ BE6BD660CAA6F291AE06A718A4FA8ABC, CD38939CFBA80B882D38099194FC1EBAE15A9D27A4D941DD03C55EC745E52E59 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
11:13:07.0245 0x3c24 srvnet - ok
11:13:07.0261 0x3c24 [ D887C9FD02AC9FA880F6E5027A43E118, F38BAD90EC791368C37C21090302708D2DFB83ECE9096609AD9AA667B2E5592E ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
11:13:07.0336 0x3c24 SSDPSRV - ok
11:13:07.0346 0x3c24 [ A36EE93698802CD899F98BFD553D8185, 224CFED921EA230FF8025D259E34968FD2C0FD34BB3A918FB4B9B8BA42BEA5D3 ] ssmdrv C:\Windows\system32\DRIVERS\ssmdrv.sys
11:13:07.0369 0x3c24 ssmdrv - ok
11:13:07.0380 0x3c24 [ D318F23BE45D5E3A107469EB64815B50, D74355E6FF215AA8CE53BC9DF16AF2740F2FC2FD754939478A3608BDA8C6DDA0 ] SstpSvc C:\Windows\system32\sstpsvc.dll
11:13:07.0427 0x3c24 SstpSvc - ok
11:13:07.0443 0x3c24 [ 2C71F7AFB1DA599E87F3C4FF15188EBE, 1B9DC278674AB8663A2D92CC66ECF233DC101844B0F9D8D8CD5BD4825460B469 ] ssudmdm C:\Windows\system32\DRIVERS\ssudmdm.sys
11:13:07.0481 0x3c24 ssudmdm - ok
11:13:07.0489 0x3c24 [ DB32D325C192B801DF274BFD12A7E72B, F089DBA719E22BC269720A6B840B873A4AF5639745DB0C3DBC8BD2F2839A1ABA ] stexstor C:\Windows\system32\drivers\stexstor.sys
11:13:07.0516 0x3c24 stexstor - ok
11:13:07.0542 0x3c24 [ E1FB3706030FB4578A0D72C2FC3689E4, A62EC9AA4514CAF2A10C0A3AEF7A36F593A7E7DA370A3F130C24E1B612E19427 ] StiSvc C:\Windows\System32\wiaservc.dll
11:13:07.0607 0x3c24 StiSvc - ok
11:13:07.0617 0x3c24 [ 472AF0311073DCECEAA8FA18BA2BDF89, 089414057EB2047E42C96C1ACE79D509967461DC5A4D2836F63C04268637A3FC ] storflt C:\Windows\system32\drivers\vmstorfl.sys
11:13:07.0645 0x3c24 storflt - ok
11:13:07.0653 0x3c24 [ 0BF669F0A910BEDA4A32258D363AF2A5, 83EEBACDE4F69A2866B69CAA633F5C8B3CB01D88CEDB01B6EA5988E0A25CEE47 ] StorSvc C:\Windows\system32\storsvc.dll
11:13:07.0684 0x3c24 StorSvc - ok
11:13:07.0691 0x3c24 [ DCAFFD62259E0BDB433DD67B5BB37619, CBD12FF9BBF33D18B0F3D322B12EC62E7DF3BF45C6AD43D2E91FF4C4762E05D0 ] storvsc C:\Windows\system32\drivers\storvsc.sys
11:13:07.0718 0x3c24 storvsc - ok
11:13:07.0725 0x3c24 [ E58C78A848ADD9610A4DB6D214AF5224, 1575A90EB22A4FB066459BDA00C6CAC10198C3C8C74493721EC6D34B51F50426 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
11:13:07.0751 0x3c24 swenum - ok
11:13:07.0770 0x3c24 [ A28BD92DF340E57B024BA433165D34D7, 889CC7FF143C3549982128473FF927CD80CF36485A347EF399C1271C8CE12CE4 ] swprv C:\Windows\System32\swprv.dll
11:13:07.0827 0x3c24 swprv - ok
11:13:07.0849 0x3c24 [ FFFA898575A8A16665429AFAE3D55302, 4241268D45E86D797250A996C014F7F4F701DF023A64669217C1EBE2555836BE ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
11:13:07.0892 0x3c24 SynTP - ok
11:13:07.0947 0x3c24 [ 36650D618CA34C9D357DFD3D89B2C56F, 7C3774E53DCF32CB3A4B3504E32D2A651E18467FA0A6AC4C7993C696741B704B ] SysMain C:\Windows\system32\sysmain.dll
11:13:08.0053 0x3c24 SysMain - ok
11:13:08.0067 0x3c24 [ 763FECDC3D30C815FE72DD57936C6CD1, 1A62C7E63E426D56894F4121C75D9C60FC9A14469ADBD0D6F0B94B8DE48CDA3E ] TabletInputService C:\Windows\System32\TabSvc.dll
11:13:08.0108 0x3c24 TabletInputService - ok
11:13:08.0125 0x3c24 [ 613BF4820361543956909043A265C6AC, FCFF02E466D2501630B452627FB218C01E5245A0921EE3D2117E7FD63AC7E98E ] TapiSrv C:\Windows\System32\tapisrv.dll
11:13:08.0191 0x3c24 TapiSrv - ok
11:13:08.0201 0x3c24 [ B799D9FDB26111737F58288D8DC172D9, 409A60819A4305699E2E492A6190637FAAEBD19E745A5DB2A5D6977106C86591 ] TBS C:\Windows\System32\tbssvc.dll
11:13:08.0245 0x3c24 TBS - ok
11:13:08.0305 0x3c24 [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
11:13:08.0406 0x3c24 Tcpip - ok
11:13:08.0472 0x3c24 [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
11:13:08.0541 0x3c24 TCPIP6 - ok
11:13:08.0559 0x3c24 [ 3EEBD3BD93DA46A26E89893C7AB2FF3B, 2C7204DCD2BCBC6A250FF0F6477616F327AF41FDB7CABE69E5C357361009FB4E ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
11:13:08.0589 0x3c24 tcpipreg - ok
11:13:08.0601 0x3c24 [ 1CB91B2BD8F6DD367DFC2EF26FD751B2, 879E2827354BB21573AC6A7CCEB746D44214540687E6882FFCB4089546FBD954 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
11:13:08.0635 0x3c24 TDPIPE - ok
11:13:08.0643 0x3c24 [ 2C2C5AFE7EE4F620D69C23C0617651A8, E828D974C3F9D7004A030C3AD448096C736FDB4C4C1707D043E567D08C845103 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
11:13:08.0672 0x3c24 TDTCP - ok
11:13:08.0684 0x3c24 [ B459575348C20E8121D6039DA063C704, 1B4328A9EA39FF5A57F258E02254D04B73455F1DF7C997C13702A8B2F12D0347 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
11:13:08.0751 0x3c24 tdx - ok
11:13:08.0968 0x3c24 [ CC907C2FB839D3F92690A25FF8E463BE, 3CEE9BEA1ACB1086389AA4817D996431716EFEB4432EC4D59EEF1BA710C15B8C ] TeamViewer9 C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
11:13:09.0230 0x3c24 TeamViewer9 - ok
11:13:09.0255 0x3c24 [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20, 0D81B427720637882077C5024D738191F858FC734ED040697872D906351EF663 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
11:13:09.0283 0x3c24 TermDD - ok
11:13:09.0311 0x3c24 [ 382C804C92811BE57829D8E550A900E2, 5F52C2E7902024CF1C9CC0069F411C3F19CCA3DB209F437FA0F3932D4898EB50 ] TermService C:\Windows\System32\termsrv.dll
11:13:09.0394 0x3c24 TermService - ok
11:13:09.0404 0x3c24 [ 42FB6AFD6B79D9FE07381609172E7CA4, B57C85091209A2FAD19ED490B8FA7FC98F12911F9C9CACE9AF1E540780CE6700 ] Themes C:\Windows\system32\themeservice.dll
11:13:09.0471 0x3c24 Themes - ok
11:13:09.0479 0x3c24 [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] THREADORDER C:\Windows\system32\mmcss.dll
11:13:09.0522 0x3c24 THREADORDER - ok
11:13:09.0530 0x3c24 [ 5AD05191DC8B444A7BA4D79B76C42A30, 6166E939A5A240388EBA5AF7FF335DC413F2BBCF74C2E1D310F4BE2A5454A610 ] TPM C:\Windows\system32\drivers\tpm.sys
11:13:09.0559 0x3c24 TPM - ok
11:13:09.0569 0x3c24 [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A, 532A3A812578B2DFD83001DE66FC73689D79EC729409EB572E07E6D65B281712 ] TrkWks C:\Windows\System32\trkwks.dll
11:13:09.0625 0x3c24 TrkWks - ok
11:13:09.0639 0x3c24 [ 2C49B175AEE1D4364B91B531417FE583, 6C7995E18F84E465C376D1D5F153C15ACB66CDEA86EE5BF186677F572E7E129B ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
11:13:09.0686 0x3c24 TrustedInstaller - ok
11:13:09.0698 0x3c24 [ B37B08F2E5EEB1A37E448E09BACE1101, 32CC9E06B88BAB6FAB4696B744548DFCE9199A7FD2BA8B019F269CA75895852C ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
11:13:09.0727 0x3c24 tssecsrv - ok
11:13:09.0736 0x3c24 [ 9CE253214ACAA5A7D323327D2055EFAA, 15E7DB578EDF36DD2FD5BA960C3941B2353037323B6B96702CDCDC07588EA724 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
11:13:09.0767 0x3c24 TsUsbFlt - ok
11:13:09.0775 0x3c24 [ 57C527AF84748B5C2F5178C499C0B81F, 2FF1F25BA16F8984E9F2CE4DE663F261BAF267EDF10D466A52BB211C567F763C ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
11:13:09.0802 0x3c24 TsUsbGD - ok
11:13:09.0813 0x3c24 [ B2FA25D9B17A68BB93D58B0556E8C90D, 0146931B733CAB1CD87F94C35F97E110D6ED6C55EAFF03345400A29AEDE99BDE ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
11:13:09.0867 0x3c24 tunnel - ok
11:13:09.0876 0x3c24 [ 750FBCB269F4D7DD2E420C56B795DB6D, E1A95C59148FE463539C34336FD0E74B31A33B8AB2B8E34AA10349C3347471D7 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
11:13:09.0905 0x3c24 uagp35 - ok
11:13:09.0922 0x3c24 [ EE43346C7E4B5E63E54F927BABBB32FF, BAD6FC3BEE45E644D5A6A0A31428F5B2AEC72A0AA0C74EF8177B1FE23EEF3AA9 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
11:13:10.0007 0x3c24 udfs - ok
11:13:10.0031 0x3c24 [ 8344FD4FCE927880AA1AA7681D4927E5, 1B54EFA60A221E2B9FFE59BB41C7E7D8B5AC6826F1C5577456D81371D464255A ] UI0Detect C:\Windows\system32\UI0Detect.exe
11:13:10.0065 0x3c24 UI0Detect - ok
11:13:10.0074 0x3c24 [ 44E8048ACE47BEFBFDC2E9BE4CBC8880, 5D96D90FDF68AE470CC92CA9DF9DA2C05A53EF455A5A109DBBF7C96F3238257C ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
11:13:10.0104 0x3c24 uliagpkx - ok
11:13:10.0113 0x3c24 [ D295BED4B898F0FD999FCFA9B32B071B, D4130DB4AE76EE6DC0B8E7A4FEF5CB8B26EBD822C21021F6FA78FD29C1E211C2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
11:13:10.0149 0x3c24 umbus - ok
11:13:10.0156 0x3c24 [ 7550AD0C6998BA1CB4843E920EE0FEAC, 24C001E422C3B3B920CDCF6003A3179CE464DE4284775403DD5122EF9780460D ] UmPass C:\Windows\system32\drivers\umpass.sys
11:13:10.0186 0x3c24 UmPass - ok
11:13:10.0201 0x3c24 [ 409994A8EACEEE4E328749C0353527A0, FFC57B647147DE2957A7DE4B330CC534DE7AC892A2FCE3BB164F7A516CAB1B56 ] UmRdpService C:\Windows\System32\umrdp.dll
11:13:10.0247 0x3c24 UmRdpService - ok
11:13:10.0266 0x3c24 [ 833FBB672460EFCE8011D262175FAD33, C0C3067A305993CBF056C229771CB0593DD60C9C7AC5130FF1CA610BCA812AB5 ] upnphost C:\Windows\System32\upnphost.dll
11:13:10.0334 0x3c24 upnphost - ok
11:13:10.0344 0x3c24 [ 0803FBA9FE829D61AE26EC0BCC910C46, 30D00E2C7DFC630C99C1599587D4F9C272BC30D444E07C961AA05BF84587806B ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
11:13:10.0375 0x3c24 usbccgp - ok
11:13:10.0386 0x3c24 [ 2352AB5F9F8F097BF9D41D5A4718A041, 25BC7828C625B9B2A5110C25B230C5828CEC18EC97ECF9EC4745E8930CBF472C ] usbcir C:\Windows\system32\drivers\usbcir.sys
11:13:10.0421 0x3c24 usbcir - ok
11:13:10.0430 0x3c24 [ D40855F89B69305140BBD7E9A3BA2DA6, 745DC6D770666F6B19C2B6AA89C21D1A314732E291453BFA2367F9AF86F97C3C ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
11:13:10.0460 0x3c24 usbehci - ok
11:13:10.0478 0x3c24 [ EDF2DF71C4F1E13A6AC75F5224DE655A, 1764D155C6B99201774B57195349304259232A12868ECFC2069CA49443EBDC2C ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
11:13:10.0523 0x3c24 usbhub - ok
11:13:10.0531 0x3c24 [ 9828C8D14CC2676421778F0DE638CF97, 479A28211FFB85190A01FAB0283B927588805D2C0CDB03F85F8F814B88E4F453 ] usbohci C:\Windows\system32\drivers\usbohci.sys
11:13:10.0557 0x3c24 usbohci - ok
11:13:10.0565 0x3c24 [ 797D862FE0875E75C7CC4C1AD7B30252, 1BBE745E4C85F8911076F6032ACD7A35FAC048D3CB1500C64E08D8B2C70A1069 ] usbprint C:\Windows\system32\drivers\usbprint.sys
11:13:10.0595 0x3c24 usbprint - ok
11:13:10.0605 0x3c24 [ BF63EBFC6979FEFB2BC03DF7989A0C1A, AFEF764A3E5D52CDBB5074F0E87F2B5EBCDF8D9B6E8F88EE235602B80145BE31 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:13:10.0637 0x3c24 USBSTOR - ok
11:13:10.0645 0x3c24 [ 800AABFD625EEFF899F7E5496BDE37AB, 3EB7ED07760CB348FCA9A06C2B838EF79B51A83C5F70A9C9EAAEAE54480067E2 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
11:13:10.0672 0x3c24 usbuhci - ok
11:13:10.0681 0x3c24 [ 081E6E1C91AEC36758902A9F727CD23C, 9FDAA17A3B99067E035E5D76305427F15FFDBC5D304B2BB78AFC6463EDDE1A75 ] UxSms C:\Windows\System32\uxsms.dll
11:13:10.0732 0x3c24 UxSms - ok
11:13:10.0739 0x3c24 [ DD17E1573651293D4ED31053795B3471, 94F7D1BB1C3B0C1FAAEED07375DB0F3BC995394FB5C26983548D946C8D229D54 ] VaultSvc C:\Windows\system32\lsass.exe
11:13:10.0759 0x3c24 VaultSvc - ok
11:13:10.0769 0x3c24 [ A059C4C3EDB09E07D21A8E5C0AABD3CB, BDD3729B49DF2E2FC72FFEF9D10235B481A671DE5A721B6B9A80873B7A343F07 ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
11:13:10.0796 0x3c24 vdrvroot - ok
11:13:10.0822 0x3c24 [ C3CD30495687C2A2F66A65CA6FD89BE9, 582E4706C1D6A151020D14B26C7BF166F4E42BDD6E410F30EC452469270C5E9B ] vds C:\Windows\System32\vds.exe
11:13:10.0902 0x3c24 vds - ok
11:13:10.0912 0x3c24 [ 17C408214EA61696CEC9C66E388B14F3, 829C0416672E2B2DFABCFE641E7F281F41E8DBB3C0EF11C7784CB9BB94F87E97 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
11:13:10.0943 0x3c24 vga - ok
11:13:10.0951 0x3c24 [ 8E38096AD5C8570A6F1570A61E251561, 4DBA3C1397A2203548F45F006E66D99F837903F601ABBCE2304754F783CA8A39 ] VgaSave C:\Windows\System32\drivers\vga.sys
11:13:10.0999 0x3c24 VgaSave - ok
11:13:11.0012 0x3c24 [ 5461686CCA2FDA57B024547733AB42E3, 2721D0659AA890172FCAD4EC4D926B58ACD0EE4887DA51545DC7237420D5BF84 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
11:13:11.0049 0x3c24 vhdmp - ok
11:13:11.0058 0x3c24 [ C829317A37B4BEA8F39735D4B076E923, 55D1796AE750071E1E05BD7702B6C355CCFFE27B4C00E93E7044C3184732B497 ] viaagp C:\Windows\system32\drivers\viaagp.sys
11:13:11.0086 0x3c24 viaagp - ok
11:13:11.0095 0x3c24 [ E02F079A6AA107F06B16549C6E5C7B74, B530DCE3EE4F285B3D5F69F7148D17E016D54F04E6F93706B829A34567748788 ] ViaC7 C:\Windows\system32\drivers\viac7.sys
11:13:11.0126 0x3c24 ViaC7 - ok
11:13:11.0134 0x3c24 [ E43574F6A56A0EE11809B48C09E4FD3C, 3687BF638E21C00E62ABFED70D728B91ADA08F7164CA898E654F31DA196589E9 ] viaide C:\Windows\system32\drivers\viaide.sys
11:13:11.0161 0x3c24 viaide - ok
11:13:11.0175 0x3c24 [ C2F2911156FDC7817C52829C86DA494E, FE499F189B5016FCE0018AA3DE3970B72275B7B15F3D4D608117F6DDEC6B90DC ] vmbus C:\Windows\system32\drivers\vmbus.sys
11:13:11.0214 0x3c24 vmbus - ok
11:13:11.0222 0x3c24 [ D4D77455211E204F370D08F4963063CE, 2018B2A84C73E0834200A594C02A9D28C74906F126DAD3CCDDFC9CD9A61669E2 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
11:13:11.0248 0x3c24 VMBusHID - ok
11:13:11.0256 0x3c24 [ 4C63E00F2F4B5F86AB48A58CD990F212, 9796BD4B9CFEEEAF57C5E332A732EFC2770B21F9B35301A5D202F5FC52C1E035 ] volmgr C:\Windows\system32\drivers\volmgr.sys
11:13:11.0286 0x3c24 volmgr - ok
11:13:11.0305 0x3c24 [ B5BB72067DDDDBBFB04B2F89FF8C3C87, 65B9AD55F43940A5FDD88B6EC5034A7E375DF8E6F5F1AE6519A4BD6B7E992EBC ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
11:13:11.0335 0x3c24 volmgrx - ok
11:13:11.0353 0x3c24 [ F497F67932C6FA693D7DE2780631CFE7, DAE544ED99D2CF570DA31343BD87D2F856D0D13529656D38E1BF854C77F017F6 ] volsnap C:\Windows\system32\drivers\volsnap.sys
11:13:11.0399 0x3c24 volsnap - ok
11:13:11.0412 0x3c24 [ 9DFA0CC2F8855A04816729651175B631, 37FD9E43A2A3F125E94A315FB4CD8A1B5499A5FD74806EB2D1E5DA88C070D3A3 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
11:13:11.0448 0x3c24 vsmraid - ok
11:13:11.0502 0x3c24 [ 209A3B1901B83AEB8527ED211CCE9E4C, 1A431F6409F8E0531F600F8F988ECECECB902DA26BBAAF1DE74A5CAC29A7CB44 ] VSS C:\Windows\system32\vssvc.exe
11:13:11.0598 0x3c24 VSS - ok
11:13:11.0612 0x3c24 [ 90567B1E658001E79D7C8BBD3DDE5AA6, EFC23BEEA7F54A2DC56CB523DAD1AF0358D904C5278BF08873910E2DB3F13557 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
11:13:11.0643 0x3c24 vwifibus - ok
11:13:11.0652 0x3c24 [ 7090D3436EEB4E7DA3373090A23448F7, 3A130B28F2BFA7DCEC8596C4CE4E187B019F5ECF1AAC8DD1BBDE9CBD2428FEC2 ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
11:13:11.0688 0x3c24 vwififlt - ok
11:13:11.0695 0x3c24 [ A3F04CBEA6C2A10E6CB01F8B47611882, 32AFE18B07FECA30BC95831A5DC94C784E543784DF16165334A777DC84E91EF3 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
11:13:11.0726 0x3c24 vwifimp - ok
11:13:11.0746 0x3c24 [ 55187FD710E27D5095D10A472C8BAF1C, AE298E2D3BA366BCBDC092C717214C181E8843FA564A6DFB07FC3238A5A68DC3 ] W32Time C:\Windows\system32\w32time.dll
11:13:11.0818 0x3c24 W32Time - ok
11:13:11.0830 0x3c24 [ DE3721E89C653AA281428C8A69745D90, 501C78056ED4295625D8A5412025FD2F0CA24077044D3A5800BA79DF3D946516 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
11:13:11.0859 0x3c24 WacomPen - ok
11:13:11.0868 0x3c24 [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
11:13:11.0916 0x3c24 WANARP - ok
11:13:11.0924 0x3c24 [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
11:13:11.0965 0x3c24 Wanarpv6 - ok
11:13:12.0028 0x3c24 [ 353A04C273EC58475D8633E75CCD5604, FFAE53B6B53AEFC9E8A10BF27480E072D74430276BEB532FE1D473E9616D8CE0 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
11:13:12.0152 0x3c24 WatAdminSvc - ok
11:13:12.0216 0x3c24 [ 691E3285E53DCA558E1A84667F13E15A, 12EDB66EF8FC100402BEA221F354D3BD5542F6DDF715B6E7D873D6BAE7E3D329 ] wbengine C:\Windows\system32\wbengine.exe
11:13:12.0319 0x3c24 wbengine - ok
11:13:12.0335 0x3c24 [ 9614B5D29DC76AC3C29F6D2D3AA70E67, A2FFB92F0030B4CD771E862DA575ECCF2F3A5B4B85858C1241A0C59262C0EC88 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
11:13:12.0379 0x3c24 WbioSrvc - ok
11:13:12.0398 0x3c24 [ 34EEE0DFAADB4F691D6D5308A51315DC, A040A03E25A0C78B9E26F86C2DF95BCAF8E7EC90183CEB295615D3265350EBEE ] wcncsvc C:\Windows\System32\wcncsvc.dll
11:13:12.0450 0x3c24 wcncsvc - ok
11:13:12.0459 0x3c24 [ 5D930B6357A6D2AF4D7653BDABBF352F, 677FF2ED14EE0B0CAA710DA81556CC16D5971DAB10E7C7432D167A87CA6F0EAA ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
11:13:12.0493 0x3c24 WcsPlugInService - ok
11:13:12.0501 0x3c24 [ 1112A9BADACB47B7C0BB0392E3158DFF, 1AE2AFA125973571F91E6945FE8A735F63D76EBB250A0075D98C580167FD9ED4 ] Wd C:\Windows\system32\drivers\wd.sys
11:13:12.0529 0x3c24 Wd - ok
11:13:12.0558 0x3c24 [ 25944D2CC49E0A6C581D02A74B7D6645, AF8FFAFEC07F1A6A3D4008E609E8E1D705A8DFCC7995C766E3946887203F7BEE ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
11:13:12.0618 0x3c24 Wdf01000 - ok
11:13:12.0630 0x3c24 [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiServiceHost C:\Windows\system32\wdi.dll
11:13:12.0679 0x3c24 WdiServiceHost - ok
11:13:12.0687 0x3c24 [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiSystemHost C:\Windows\system32\wdi.dll
11:13:12.0718 0x3c24 WdiSystemHost - ok
11:13:12.0734 0x3c24 [ 75E8EBD7040CE238684333F97014762A, 2CA0B267FBAEB303D1F8B639D733DC0DE17BA1276CC9096035B4F2BBBED3EF7F ] WebClient C:\Windows\System32\webclnt.dll
11:13:12.0782 0x3c24 WebClient - ok
11:13:12.0795 0x3c24 [ 760F0AFE937A77CFF27153206534F275, A53940BA28854486FF18F16B98A3314B36322B0B6EFB54D08B921315BEB0ADD5 ] Wecsvc C:\Windows\system32\wecsvc.dll
11:13:12.0859 0x3c24 Wecsvc - ok
11:13:12.0869 0x3c24 [ AC804569BB2364FB6017370258A4091B, 1856F354146A5946F3E7D0DD09726FC8A3502B0F0776FEADDF10669C81CC28E2 ] wercplsupport C:\Windows\System32\wercplsupport.dll
11:13:12.0923 0x3c24 wercplsupport - ok
11:13:12.0933 0x3c24 [ 08E420D873E4FD85241EE2421B02C4A4, E1E9436EB096FF7DE9A76DA6217035257EF9FC7565DDB9016DCA3859E7F1EF0F ] WerSvc C:\Windows\System32\WerSvc.dll
11:13:12.0991 0x3c24 WerSvc - ok
11:13:12.0999 0x3c24 [ 8B9A943F3B53861F2BFAF6C186168F79, 88E2F79F32AFBA17CB8377A508B83A1EC2315E9F3A365F591C87FE4525AA6713 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
11:13:13.0045 0x3c24 WfpLwf - ok
11:13:13.0053 0x3c24 [ 5CF95B35E59E2A38023836FFF31BE64C, CEA21302B3E855EE592810D4E0DE10E47A47A393064C435463CD54598735CD8D ] WIMMount C:\Windows\system32\drivers\wimmount.sys
11:13:13.0079 0x3c24 WIMMount - ok
11:13:13.0112 0x3c24 [ 5A77AC34A0FFB70CE8B35B524FEDE9BA, 711DD957AF98F1B835ECE0FEBCCF8FCC7763F1DAA232F1C9E80DE6DA123C7F33 ] winachsf C:\Windows\system32\DRIVERS\HSX_CNXT.sys
11:13:13.0180 0x3c24 winachsf - ok
11:13:13.0216 0x3c24 [ 082CF481F659FAE0DE51AD060881EB47, BB67D2AF0BB9192D4CCF66C23D80CE5A1B38715556D94E2561DBF8F805FA30A5 ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
11:13:13.0288 0x3c24 WinDefend - ok
11:13:13.0302 0x3c24 WinHttpAutoProxySvc - ok
11:13:13.0324 0x3c24 [ F62E510B6AD4C21EB9FE8668ED251826, FA3E5CAC3E67E49377320CFBE4646585E6B62168292768FEA81E4623F9166890 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
11:13:13.0383 0x3c24 Winmgmt - ok
11:13:13.0439 0x3c24 [ 1B91CD34EA3A90AB6A4EF0550174F4CC, 5B6618615EBFBA594C945AD35F5C68DA8C6053892B6D12D626BB6120910D80DC ] WinRM C:\Windows\system32\WsmSvc.dll
11:13:13.0558 0x3c24 WinRM - ok
11:13:13.0577 0x3c24 [ A67E5F9A400F3BD1BE3D80613B45F708, E170A8BD31A779403DC9C43ED6483DA8E186512D3EE700B87F6BA292E284E367 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
11:13:13.0610 0x3c24 WinUsb - ok
11:13:13.0651 0x3c24 [ 16935C98FF639D185086A3529B1F2067, E9C6B73A572A04FCE9B1B0E6815F941B10332D9A6D55B92927C2B1275F119091 ] Wlansvc C:\Windows\System32\wlansvc.dll
11:13:13.0733 0x3c24 Wlansvc - ok
11:13:13.0744 0x3c24 [ 0217679B8FCA58714C3BF2726D2CA84E, 4494984B922DCF24D37BCD0E6831CEBD07D1CA49235D04E821D17ED3DF84ED2A ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
11:13:13.0772 0x3c24 WmiAcpi - ok
11:13:13.0789 0x3c24 [ 6EB6B66517B048D87DC1856DDF1F4C3F, EBB534C4829477C70062ADBB5626236B02FE563A544C53FA255E79F3CA170FE8 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
11:13:13.0828 0x3c24 wmiApSrv - ok
11:13:13.0883 0x3c24 [ 3B40D3A61AA8C21B88AE57C58AB3122E, 6C67DCB007C3CDF2EB0BBF5FD89C32CD7800C20F7166872F8C387BE262C5CD21 ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
11:13:13.0982 0x3c24 WMPNetworkSvc - ok
11:13:13.0994 0x3c24 [ A2F0EC770A92F2B3F9DE6D518E11409C, 6838F2148B11285E00DC449D51F8AD85AAE57694E89BA2C607B87AC1C650D845 ] WPCSvc C:\Windows\System32\wpcsvc.dll
11:13:14.0023 0x3c24 WPCSvc - ok
11:13:14.0033 0x3c24 [ AA53356D60AF47EACC85BC617A4F3F66, 155CB8112AA382D841C1891750FF29EF4F1BF716CD9CDF0F2243209E2CCCAC98 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
11:13:14.0075 0x3c24 WPDBusEnum - ok
11:13:14.0083 0x3c24 [ 6DB3276587B853BF886B69528FDB048C, 9972FF6DF0DF6F86D1E9BCEF4C29064748B217DA196B0633C30D3D580144951C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
11:13:14.0125 0x3c24 ws2ifsl - ok
11:13:14.0135 0x3c24 [ 6F5D49EFE0E7164E03AE773A3FE25340, 15B6AFF7455538189A96F8863CC995A271E02C6FBDAC15B037D44DDA65E61339 ] wscsvc C:\Windows\system32\wscsvc.dll
11:13:14.0182 0x3c24 wscsvc - ok
11:13:14.0188 0x3c24 WSearch - ok
11:13:14.0288 0x3c24 [ D9B0134913E5EF007AF82A418C503322, 7418DD28C8E968674382F8352AAFFC4DE77887E2B71B8844D615F19432B4C55A ] wuauserv C:\Windows\system32\wuaueng.dll
11:13:14.0403 0x3c24 wuauserv - ok
11:13:14.0419 0x3c24 [ 06E6F32C8D0A3F66D956F57B43A2E070, 9A6BD96A28294B0372F16E13D652FD603308F64B74A56E41E0C68C5E8011F943 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
11:13:14.0441 0x3c24 WudfPf - ok
11:13:14.0455 0x3c24 [ 867C301E8B790040AE9CF6486E8041DF, D867D6498C987944D99508B2FAD6D6B749FA1EDFE8124B0863D4A642352F0855 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
11:13:14.0492 0x3c24 WUDFRd - ok
11:13:14.0502 0x3c24 [ FE47B7BC8EA320C2D9B5E5BF6E303765, 34518DBD1E9EA6E5DA62273B18613761E1D9C6B4E074A93C6D639FBAF02222EA ] wudfsvc C:\Windows\System32\WUDFSvc.dll
11:13:14.0537 0x3c24 wudfsvc - ok
11:13:14.0551 0x3c24 [ 3C5E51C05BE9B56EAFF4E388C3AB25E4, 10D9FDEDAB1FB2E76D54661AFA5C1A6B1B0980525F38F5D061537077841C6AEE ] WwanSvc C:\Windows\System32\wwansvc.dll
11:13:14.0615 0x3c24 WwanSvc - ok
11:13:14.0623 0x3c24 [ 88AF537264F2B818DA15479CEEAF5D7C, E0F95D6448FFB77351BB63ED444238F891B16748FD09F8BCCA23BEC4E341A96B ] XAudio C:\Windows\system32\DRIVERS\xaudio.sys
11:13:14.0645 0x3c24 XAudio - ok
11:13:14.0667 0x3c24 [ 15A317674A08DF26BE65164D959E9203, 6EEE0D1711F37936D157651E265A65137BCBFBDA17F066C844BAA0D53558F86A ] XAudioService C:\Windows\system32\DRIVERS\xaudio.exe
11:13:14.0702 0x3c24 XAudioService - ok
11:13:14.0726 0x3c24 ================ Scan global ===============================
11:13:14.0735 0x3c24 [ DAB748AE0439955ED2FA22357533DDDB, 73EDD402C7479DDCE1998D0C7E99E1EC2974F64EFC33A851439CC85D09EDCDF9 ] C:\Windows\system32\basesrv.dll
11:13:14.0759 0x3c24 [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
11:13:14.0792 0x3c24 [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
11:13:14.0806 0x3c24 [ 364455805E64882844EE9ACB72522830, 906561DBBB33F744844CF27E456226044C85DF0FCFD26DE1FD11E09E2CFA6F8F ] C:\Windows\system32\sxssrv.dll
11:13:14.0832 0x3c24 [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6, D7BC4ED605B32274B45328FD9914FB0E7B90D869A38F0E6F94FB1BF4E9E2B407 ] C:\Windows\system32\services.exe
11:13:14.0846 0x3c24 [ Global ] - ok
11:13:14.0847 0x3c24 ================ Scan MBR ==================================
11:13:14.0851 0x3c24 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
11:13:14.0952 0x3c24 \Device\Harddisk0\DR0 - ok
11:13:14.0952 0x3c24 ================ Scan VBR ==================================
11:13:14.0958 0x3c24 [ 55D6350D9E9B209F39352897E6C3C499 ] \Device\Harddisk0\DR0\Partition1
11:13:14.0960 0x3c24 \Device\Harddisk0\DR0\Partition1 - ok
11:13:14.0960 0x3c24 ================ Scan generic autorun ======================
11:13:15.0018 0x3c24 [ AFD15F701B550037FFDDE6B18171479D, 38C049529611653832944B9A624BA9E336E0AFE668CEDD95BDAF550A9605ADF5 ] C:\Program Files\Analog Devices\Core\smax4pnp.exe
11:13:15.0096 0x3c24 SoundMAXPnP - ok
11:13:15.0110 0x3c24 [ BC60F7192CCBF9864EF55E4FA2F42079, 4B5DE5F9B67CB4BA06C7385F55D675F806E44145D3CE1DC6B94FFEE685C27A1D ] C:\Windows\system32\igfxtray.exe
11:13:15.0130 0x3c24 IgfxTray - ok
11:13:15.0143 0x3c24 [ 1B63F8FFFFFFDA1E03AED970C7383FFE, EC7C55827137105F6FF56163114ED530A1C8E273939A4A3B067185D106625B28 ] C:\Windows\system32\hkcmd.exe
11:13:15.0164 0x3c24 HotKeysCmds - ok
11:13:15.0175 0x3c24 [ A2636716C37ABD1EE9B4C6F56B685BB2, 50B36ADE106C9CAAA1F3A2B1BEDE35E75E48CE257F688486FB39A2D68AADCFE5 ] C:\Windows\system32\igfxpers.exe
11:13:15.0196 0x3c24 Persistence - ok
11:13:15.0299 0x3c24 [ C963F1BA9DAFE0C07A27E14557AA8B3E, 4ADD6C088FDF706229E13FCF1644F1F3A02F3FCABB7FF63AE4E5EA0E5A98E353 ] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
11:13:15.0413 0x3c24 SynTPEnh - ok
11:13:15.0496 0x3c24 [ 048EA4B978851788E9F5E8E4F081DF7A, EB62719AC0DCC18FF056F2CD84438BF14B61E38F0619617C81961C6257BDFCEC ] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
11:13:15.0555 0x3c24 Adobe ARM - ok
11:13:15.0600 0x3c24 [ 2AA5DD75EA1281432C40D22B5FD87D3A, 9868D4176C8F08EB72B0B992D3E2A480C587930CA025B4FDF3212F99B79C3017 ] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
11:13:15.0640 0x3c24 avgnt - ok
11:13:15.0660 0x3c24 [ EB1B7B961090A4AF33FC297516B88FAE, 2E49D704C33EE2CA57DAE16137157F595F9811CB617A88C958EFC21BB4297CE7 ] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
11:13:15.0684 0x3c24 KiesTrayAgent - ok
11:13:15.0701 0x3c24 [ 1DE859B82E381A645C44284A5044BC33, 305AE678D3163D57C8E027F94BC553FDFDE7F9A14599EAEC370B0867DE4A9EC2 ] C:\Program Files\Common Files\Java\Java Update\jusched.exe
11:13:15.0724 0x3c24 SunJavaUpdateSched - ok
11:13:15.0856 0x3c24 [ 9A2FE54A34315F38C1D79E16081EB775, 1B966FCE15814F67D800E807C6FE7BEDDEB1D3F499622C76D7629DF959A1B59C ] C:\Program Files\BitTorrent Sync\BTSync.exe
11:13:16.0007 0x3c24 BitTorrent Sync - ok
11:13:16.0901 0x3c24 [ 4C41287B6AEF44D9F4233403F1614671, 469D37DBAA082AF52273E1E89C1D321B9365EC16EDBBD04E3E018389217CCFE3 ] C:\Program Files\Skype\Phone\Skype.exe
11:13:19.0216 0x3c24 Skype - ok
11:13:19.0344 0x3c24 [ D3F78E38C39AB0E7358735717FB52EAE, 43C6DF27A0E0BB2C83F9D936454C41501B1908851795250BBA95B9BF55C8026D ] C:\Program Files\Samsung\Kies\Kies.exe
11:13:19.0423 0x3c24 KiesPreload - ok
11:13:19.0476 0x3c24 [ 7737E1471FD1437B82A2C12575443CAE, 81FEEDF91111E996DE2569C8EDCD1C2AC0291B2BE401C448497171D958EFDC35 ] C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe
11:13:19.0545 0x3c24 ABBYY Screenshot Reader Bonus - detected UnsignedFile.Multi.Generic ( 1 )
11:13:22.0346 0x3c24 Detect skipped due to KSN trusted
11:13:22.0346 0x3c24 ABBYY Screenshot Reader Bonus - ok
11:13:23.0187 0x3c24 [ 401F53AA84F3E42F1EE3AA86C1247747, B067D0AEF3135E9AEAD0A70CA440466E28ADCB880D472D269215475C46D406F9 ] C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe
11:13:24.0328 0x3c24 VoipStunt - ok
11:13:24.0391 0x3c24 1c2b1 - ok
11:13:24.0392 0x3c24 Waiting for KSN requests completion. In queue: 1
11:13:25.0392 0x3c24 Waiting for KSN requests completion. In queue: 1
11:13:26.0392 0x3c24 Waiting for KSN requests completion. In queue: 1
11:13:27.0491 0x3c24 AV detected via SS2: Avira Desktop, C:\Program Files\Avira\AntiVir Desktop\wsctool.exe ( 14.0.6.548 ), 0x40000 ( disabled : updated )
11:13:27.0509 0x3c24 Win FW state via NFP2: enabled
11:13:29.0963 0x3c24 ============================================================
11:13:29.0963 0x3c24 Scan finished
11:13:29.0963 0x3c24 ============================================================
11:13:29.0982 0x0f9c Detected object count: 0
11:13:29.0982 0x0f9c Actual detected object count: 0
LG Fred |
|
09.08.2014, 09:48
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden hi, Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8) Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.08.2014, 13:03
| #15 |
| | Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden Hi Schrauber, hier nun das FRSTLog vom USB Stick aus: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:9-08-2014 Ran by SYSTEM on MININT-LF7BNT7 on 09-08-2014 12:47:32 Running from E:\ Platform: Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log. ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKU\Compiuta\...\Run: [BitTorrent Sync] => C:\Program Files\BitTorrent Sync\BTSync.exe [3020136 2014-06-27] (BitTorrent, Inc.) HKU\Compiuta\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20917408 2014-02-10] (Skype Technologies S.A.) HKU\Compiuta\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1563440 2014-06-14] (Samsung) HKU\Compiuta\...\Run: [ABBYY Screenshot Reader Bonus] => C:\Program Files\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe [939272 2014-04-23] (ABBYY) HKU\Compiuta\...\Run: [VoipStunt] => C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe [19768640 2014-02-11] (VoipStunt) HKU\Compiuta\...\Run: [1c2b1] => C:\Users\Compiuta\AppData\Roaming\0a3\1c2b1.js ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 ABBYY.Licensing.PDFTransformer.Classic.3.0; C:\Program Files\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe [759048 2014-04-23] (ABBYY) S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG) S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG) S2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [223088 2011-04-26] () ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-04] (Avira Operations GmbH & Co. KG) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-27] (Avira Operations GmbH & Co. KG) S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG) S3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation) S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.) S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH) S3 catchme; \??\C:\Users\Compiuta\AppData\Local\Temp\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-08 10:06 - 2014-08-08 10:06 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Compiuta\Downloads\tdsskiller.exe 2014-08-07 11:04 - 2014-08-07 11:04 - 00036362 _____ () C:\Users\Compiuta\Desktop\FRST5.txt 2014-08-07 11:00 - 2014-08-07 11:00 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3 2014-08-07 08:56 - 2014-08-07 11:06 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-07 08:56 - 2014-08-07 08:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-06 08:14 - 2014-08-06 08:14 - 00035021 _____ () C:\Users\Compiuta\Desktop\FRST4.txt 2014-08-05 15:42 - 2014-08-05 15:43 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt 2014-08-05 15:41 - 2014-08-05 15:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt 2014-08-05 15:35 - 2014-08-05 15:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe 2014-08-05 14:16 - 2014-08-05 14:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe 2014-08-04 19:17 - 2014-08-04 19:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt 2014-08-04 19:15 - 2014-08-04 19:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt 2014-08-04 19:12 - 2014-08-04 19:12 - 00000000 ____D () C:\Windows\ERUNT 2014-08-04 19:11 - 2014-08-04 19:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt 2014-08-04 19:07 - 2014-08-04 19:09 - 00000000 ____D () C:\AdwCleaner 2014-08-04 19:07 - 2014-08-04 19:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt 2014-08-04 19:06 - 2014-08-04 19:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt 2014-08-04 19:01 - 2014-08-04 19:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe 2014-08-04 19:01 - 2014-08-04 19:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe 2014-08-04 18:32 - 2014-08-04 19:03 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys 2014-08-04 18:31 - 2014-08-04 18:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-04 18:31 - 2014-08-04 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-04 18:31 - 2014-05-12 06:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys 2014-08-04 18:31 - 2014-05-12 06:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys 2014-08-04 18:31 - 2014-05-12 06:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2014-08-04 18:23 - 2014-08-04 18:24 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-08-03 19:13 - 2014-08-03 19:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt 2014-08-03 19:12 - 2014-08-03 19:12 - 00013303 _____ () C:\ComboFix.txt 2014-08-03 19:06 - 2014-08-03 19:12 - 00000000 ____D () C:\Qoobox 2014-08-03 19:06 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-08-03 19:06 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-08-03 19:06 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-08-03 19:06 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-08-03 19:06 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-08-03 19:06 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-08-03 19:06 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-08-03 19:06 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-08-03 19:05 - 2014-08-03 19:11 - 00000000 ____D () C:\Windows\erdnt 2014-08-03 19:04 - 2014-08-03 19:04 - 00000000 ____D () C:\ProgramData\Panda Security 2014-08-03 19:03 - 2014-08-03 19:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine 2014-08-03 18:20 - 2014-08-03 18:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe 2014-08-03 18:19 - 2014-08-03 18:20 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe 2014-08-03 18:03 - 2014-08-03 18:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe 2014-08-03 18:01 - 2014-08-03 18:02 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe 2014-08-03 17:07 - 2014-08-03 17:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt 2014-08-03 16:32 - 2014-08-04 19:25 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt 2014-08-03 16:28 - 2014-08-03 16:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe 2014-08-03 16:27 - 2014-08-03 12:18 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log 2014-08-03 16:24 - 2014-08-07 11:03 - 00036362 _____ () C:\Users\Compiuta\Desktop\FRST.txt 2014-08-03 16:24 - 2014-08-03 14:57 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt 2014-08-03 14:56 - 2014-08-03 14:57 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt 2014-08-03 14:55 - 2014-08-09 12:47 - 00000000 ____D () C:\FRST 2014-08-03 14:55 - 2014-08-03 14:57 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt 2014-08-03 14:50 - 2014-08-03 14:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe 2014-08-03 12:18 - 2014-08-03 12:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log 2014-08-03 12:18 - 2014-08-03 12:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable 2014-08-03 12:04 - 2014-08-03 12:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe 2014-08-03 09:57 - 2014-08-03 09:57 - 00000000 ____D () C:\Program Files\Panda Security 2014-08-03 09:57 - 2013-04-29 08:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\System32\Drivers\PSKMAD.sys 2014-08-03 09:43 - 2014-08-03 09:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe 2014-08-03 09:42 - 2014-05-14 17:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\System32\wuaueng.dll 2014-08-03 09:42 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\System32\wuapi.dll 2014-08-03 09:42 - 2014-05-14 17:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\System32\wuauclt.exe 2014-08-03 09:42 - 2014-05-14 17:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\System32\wups2.dll 2014-08-03 09:42 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\System32\wups.dll 2014-08-03 09:42 - 2014-05-14 17:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\System32\wucltux.dll 2014-08-03 09:42 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\System32\wudriver.dll 2014-08-03 09:41 - 2014-05-14 08:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\System32\wuwebv.dll 2014-08-03 09:41 - 2014-05-14 08:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\wuapp.exe 2014-07-31 10:12 - 2014-07-31 10:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-07-24 14:56 - 2014-07-24 14:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-24 14:45 - 2014-07-24 14:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe 2014-07-24 14:28 - 2014-07-24 14:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe 2014-07-24 14:21 - 2014-07-24 14:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe 2014-07-24 00:07 - 2014-07-24 00:07 - 00000000 __SHD () C:\0b64 2014-07-21 19:05 - 2014-07-21 19:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner 2014-07-20 03:40 - 2014-07-20 03:46 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4 2014-07-20 03:35 - 2014-07-20 03:42 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv 2014-07-19 21:08 - 2014-07-19 21:26 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2) 2014-07-19 21:07 - 2014-07-19 21:08 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip 2014-07-19 21:07 - 2014-07-19 21:08 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip 2014-07-19 20:50 - 2014-07-19 20:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2 2014-07-19 19:56 - 2014-07-19 19:57 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe 2014-07-19 00:40 - 2014-07-24 14:57 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog 2014-07-17 16:24 - 2014-07-17 16:24 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-07-17 16:24 - 2014-07-11 02:02 - 00096680 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll 2014-07-17 16:24 - 2014-07-11 01:56 - 00272808 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe 2014-07-17 16:24 - 2014-07-11 01:56 - 00175528 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe 2014-07-17 16:24 - 2014-07-11 01:55 - 00175528 _____ (Oracle Corporation) C:\Windows\System32\java.exe 2014-07-14 18:55 - 2014-07-14 19:06 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-09 12:47 - 2014-08-03 14:55 - 00000000 ____D () C:\FRST 2014-08-09 11:45 - 2014-04-21 11:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\BitTorrent Sync 2014-08-09 11:45 - 2014-01-04 19:06 - 01362569 _____ () C:\Windows\WindowsUpdate.log 2014-08-08 10:06 - 2014-08-08 10:06 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Compiuta\Downloads\tdsskiller.exe 2014-08-08 09:43 - 2010-11-20 22:01 - 01618320 _____ () C:\Windows\System32\PerfStringBackup.INI 2014-08-07 11:06 - 2014-08-07 08:56 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-07 11:06 - 2014-04-21 16:20 - 00000000 ____D () C:\Program Files\Avira 2014-08-07 11:04 - 2014-08-07 11:04 - 00036362 _____ () C:\Users\Compiuta\Desktop\FRST5.txt 2014-08-07 11:03 - 2014-08-03 16:24 - 00036362 _____ () C:\Users\Compiuta\Desktop\FRST.txt 2014-08-07 11:00 - 2014-08-07 11:00 - 00000000 __SHD () C:\Users\Compiuta\AppData\Roaming\0a3 2014-08-07 08:56 - 2014-08-07 08:56 - 00070352 _____ () C:\Users\1\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-07 08:56 - 2014-04-21 16:20 - 00000000 ____D () C:\ProgramData\Avira 2014-08-06 08:14 - 2014-08-06 08:14 - 00035021 _____ () C:\Users\Compiuta\Desktop\FRST4.txt 2014-08-05 15:43 - 2014-08-05 15:42 - 00037787 _____ () C:\Users\Compiuta\Desktop\FRST3.txt 2014-08-05 15:41 - 2014-08-05 15:41 - 00000759 _____ () C:\Users\Compiuta\Desktop\checkup.txt 2014-08-05 15:35 - 2014-08-05 15:35 - 00854410 _____ () C:\Users\Compiuta\Downloads\SecurityCheck.exe 2014-08-05 15:35 - 2009-07-14 05:34 - 00022208 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-05 15:35 - 2009-07-14 05:34 - 00022208 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-05 15:30 - 2014-04-21 20:52 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Skype 2014-08-05 15:28 - 2009-07-14 05:39 - 00041621 _____ () C:\Windows\setupact.log 2014-08-05 14:16 - 2014-08-05 14:16 - 02347384 _____ (ESET) C:\Users\Compiuta\Downloads\esetsmartinstaller_deu.exe 2014-08-04 19:25 - 2014-08-03 16:32 - 00034710 _____ () C:\Users\Compiuta\Desktop\Antivir.odt 2014-08-04 19:17 - 2014-08-04 19:17 - 00036633 _____ () C:\Users\Compiuta\Desktop\FRST2.txt 2014-08-04 19:15 - 2014-08-04 19:15 - 00000828 _____ () C:\Users\Compiuta\Desktop\JRT.txt 2014-08-04 19:12 - 2014-08-04 19:12 - 00000000 ____D () C:\Windows\ERUNT 2014-08-04 19:11 - 2014-08-04 19:11 - 00001446 _____ () C:\Users\Compiuta\Desktop\AdwCleaner[S0].txt 2014-08-04 19:10 - 2010-11-20 22:48 - 00111524 _____ () C:\Windows\PFRO.log 2014-08-04 19:09 - 2014-08-04 19:07 - 00000000 ____D () C:\AdwCleaner 2014-08-04 19:07 - 2014-08-04 19:07 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam2.txt 2014-08-04 19:06 - 2014-08-04 19:06 - 00001161 _____ () C:\Users\Compiuta\Desktop\mbam.txt 2014-08-04 19:03 - 2014-08-04 18:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys 2014-08-04 19:01 - 2014-08-04 19:01 - 01361309 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.302.exe 2014-08-04 19:01 - 2014-08-04 19:01 - 01016261 _____ (Thisisu) C:\Users\Compiuta\Downloads\JRT.exe 2014-08-04 18:32 - 2014-08-04 18:31 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-04 18:31 - 2014-08-04 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-04 18:24 - 2014-08-04 18:23 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-08-03 19:13 - 2014-08-03 19:13 - 00013303 _____ () C:\Users\Compiuta\Desktop\combofix.txt 2014-08-03 19:12 - 2014-08-03 19:12 - 00013303 _____ () C:\ComboFix.txt 2014-08-03 19:12 - 2014-08-03 19:06 - 00000000 ____D () C:\Qoobox 2014-08-03 19:12 - 2009-07-14 03:37 - 00000000 ___RD () C:\users\Public 2014-08-03 19:11 - 2014-08-03 19:05 - 00000000 ____D () C:\Windows\erdnt 2014-08-03 19:11 - 2009-07-14 03:04 - 00000215 _____ () C:\Windows\system.ini 2014-08-03 19:04 - 2014-08-03 19:04 - 00000000 ____D () C:\ProgramData\Panda Security 2014-08-03 19:03 - 2014-08-03 19:03 - 00000000 ____D () C:\Program Files\Panda USB Vaccine 2014-08-03 18:20 - 2014-08-03 18:20 - 05566616 ____R (Swearware) C:\Users\Compiuta\Desktop\ComboFix.exe 2014-08-03 18:20 - 2014-08-03 18:19 - 05566616 _____ (Swearware) C:\Users\Compiuta\Downloads\ComboFix.exe 2014-08-03 18:02 - 2014-08-03 18:03 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Desktop\USBVaccineSetup.exe 2014-08-03 18:02 - 2014-08-03 18:01 - 00848856 _____ (Panda Security ) C:\Users\Compiuta\Downloads\USBVaccineSetup.exe 2014-08-03 17:07 - 2014-08-03 17:07 - 00000993 _____ () C:\Users\Compiuta\Desktop\gmer.txt 2014-08-03 16:28 - 2014-08-03 16:28 - 00380416 _____ () C:\Users\Compiuta\Downloads\Gmer-19357.exe 2014-08-03 14:57 - 2014-08-03 16:24 - 00023276 _____ () C:\Users\Compiuta\Desktop\Addition.txt 2014-08-03 14:57 - 2014-08-03 14:56 - 00023276 _____ () C:\Users\Compiuta\Downloads\Addition.txt 2014-08-03 14:57 - 2014-08-03 14:55 - 00030941 _____ () C:\Users\Compiuta\Downloads\FRST.txt 2014-08-03 14:50 - 2014-08-03 14:50 - 01084928 _____ (Farbar) C:\Users\Compiuta\Desktop\FRST.exe 2014-08-03 12:18 - 2014-08-03 16:27 - 00000478 _____ () C:\Users\Compiuta\Desktop\defogger_disable.log 2014-08-03 12:18 - 2014-08-03 12:18 - 00000478 _____ () C:\Users\Compiuta\Downloads\defogger_disable.log 2014-08-03 12:18 - 2014-08-03 12:18 - 00000000 _____ () C:\Users\Compiuta\defogger_reenable 2014-08-03 12:18 - 2014-01-04 19:28 - 00000000 ____D () C:\users\Compiuta 2014-08-03 12:04 - 2014-08-03 12:04 - 00050477 _____ () C:\Users\Compiuta\Downloads\Defogger.exe 2014-08-03 09:57 - 2014-08-03 09:57 - 00000000 ____D () C:\Program Files\Panda Security 2014-08-03 09:55 - 2014-04-21 14:31 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-08-03 09:48 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\System32\de-DE 2014-08-03 09:43 - 2014-08-03 09:43 - 30412088 _____ (Panda Security ) C:\Users\Compiuta\Downloads\PandaCloudCleaner.exe 2014-07-31 14:53 - 2014-04-23 10:00 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\vlc 2014-07-31 10:12 - 2014-07-31 10:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-07-24 17:50 - 2014-04-21 16:30 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys 2014-07-24 14:57 - 2014-07-19 00:40 - 00000000 ____D () C:\Users\Compiuta\Desktop\abog 2014-07-24 14:56 - 2014-07-24 14:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Compiuta\Downloads\mbam-setup-2.0.2.1012.exe 2014-07-24 14:45 - 2014-07-24 14:45 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(2).exe 2014-07-24 14:28 - 2014-07-24 14:28 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216(1).exe 2014-07-24 14:21 - 2014-07-24 14:21 - 01354223 _____ () C:\Users\Compiuta\Downloads\adwcleaner_3.216.exe 2014-07-24 02:33 - 2014-04-20 18:34 - 00000000 ____D () C:\BtSync 2014-07-24 00:07 - 2014-07-24 00:07 - 00000000 __SHD () C:\0b64 2014-07-23 09:52 - 2014-04-21 14:10 - 00231584 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe 2014-07-21 19:05 - 2014-07-21 19:05 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner 2014-07-20 03:46 - 2014-07-20 03:40 - 00009008 _____ () C:\Users\Compiuta\AppData\Roaming\.freeciv-client-rc-2.4 2014-07-20 03:42 - 2014-07-20 03:35 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\.freeciv 2014-07-19 21:26 - 2014-07-19 21:08 - 00000000 ____D () C:\Users\Compiuta\Desktop\Neuer Ordner (2) 2014-07-19 21:26 - 2014-07-06 18:43 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\XnView 2014-07-19 21:13 - 2014-04-21 15:58 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Paint.NET 2014-07-19 21:09 - 2014-01-04 20:11 - 00000000 ____D () C:\Users\Compiuta\Desktop\Soundfiles 2014-07-19 21:08 - 2014-07-19 21:07 - 11861420 _____ () C:\Users\Compiuta\Downloads\Gmail(1).zip 2014-07-19 21:08 - 2014-07-19 21:07 - 11811633 _____ () C:\Users\Compiuta\Downloads\Gmail.zip 2014-07-19 20:50 - 2014-07-19 20:50 - 00000000 ____D () C:\Program Files\Freeciv-2.4.2-gtk2 2014-07-19 19:57 - 2014-07-19 19:56 - 28215140 _____ () C:\Users\Compiuta\Downloads\Freeciv-2.4.2-win32-gtk2-setup.exe 2014-07-18 17:03 - 2014-06-13 02:24 - 00000000 ____D () C:\Users\Compiuta\AppData\Local\Adobe 2014-07-17 16:24 - 2014-07-17 16:24 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-07-17 16:24 - 2014-05-02 09:24 - 00000000 ____D () C:\ProgramData\Oracle 2014-07-17 16:24 - 2014-05-02 09:24 - 00000000 ____D () C:\Program Files\Java 2014-07-15 14:54 - 2014-04-21 20:39 - 00000000 ____D () C:\Windows\System32\MRT 2014-07-15 14:52 - 2014-04-21 20:39 - 93585272 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2014-07-15 01:55 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache 2014-07-14 21:33 - 2014-06-03 22:45 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\FileZilla 2014-07-14 19:12 - 2014-06-03 22:45 - 04996210 _____ (Tim Kosse) C:\Users\Compiuta\Downloads\FileZilla_3.8.1_win32-setup.exe 2014-07-14 19:12 - 2014-04-21 14:41 - 00000000 ____D () C:\Program Files\FileZilla FTP Client 2014-07-14 19:06 - 2014-07-14 18:55 - 00000000 ____D () C:\Users\Compiuta\AppData\Roaming\Audacity 2014-07-14 05:12 - 2014-04-27 13:19 - 00000000 ____D () C:\users\1 2014-07-12 04:40 - 2014-01-04 19:58 - 00000000 ____D () C:\Users\Compiuta\Desktop\Flugtickets 2014-07-11 02:02 - 2014-07-17 16:24 - 00096680 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll 2014-07-11 01:56 - 2014-07-17 16:24 - 00272808 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe 2014-07-11 01:56 - 2014-07-17 16:24 - 00175528 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe 2014-07-11 01:55 - 2014-07-17 16:24 - 00175528 _____ (Oracle Corporation) C:\Windows\System32\java.exe 2014-07-10 00:18 - 2010-11-21 01:55 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-10 00:18 - 2009-07-14 05:33 - 00324032 _____ () C:\Windows\System32\FNTCACHE.DAT Some content of TEMP: ==================== C:\Users\1\AppData\Local\Temp\avgnt.exe C:\Users\Compiuta\AppData\Local\Temp\avgnt.exe C:\Users\Compiuta\AppData\Local\Temp\Quarantine.exe ==================== Known DLLs (Whitelisted) ============ ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== Restore Points ========================= Restore point made on: 2014-08-03 09:41:49 Restore point made on: 2014-08-04 08:59:55 Restore point made on: 2014-08-08 09:44:26 ==================== Memory info =========================== Percentage of memory in use: 15% Total physical RAM: 2550.43 MB Available physical RAM: 2158.23 MB Total Pagefile: 2548.71 MB Available Pagefile: 2155.4 MB Total Virtual: 2047.88 MB Available Virtual: 1966.2 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:111.79 GB) (Free:26.45 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive e: () (Removable) (Total:3.75 GB) (Free:3.75 GB) FAT Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 3F673AB5) Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 4 GB) (Disk ID: 018F9277) Partition 1: (Active) - (Size=4 GB) - (Type=06) LastRegBack: 2014-07-15 00:40 ==================== End Of Log ============================ Danke und schoenen Samstag! LG Fred |
|
| Themen zu Windows 7: USB-Stick zeigt nur noch Verknüpfungen an + avira hat TR/Crypt.ZPACK.82398 gefunden |
| adware, avira, browser, desktop, dnsapi.dll, firefox 31.0, flash player, ftp, google, hdd0(c:, hdd0(c:), hängt, installation, mozilla, netzwerk, problem, programm, prozesse, registry, rojaner gefunden, rundll, scan, security, sich automatisch, software, starten, svchost.exe, trojaner/virus, trojanerfund avira, usb stick nur verknüpfungen, virus, warnung, windows, wuauclt.exe |
WARNUNG an die MITLESER: 
Linear-Darstellung
