Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Log-Analyse und Auswertung: Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Seite 1 von 2 1 2
Alt 14.09.2014, 15:33   #1
Hjalfnar
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Moin moin!

Vor einigen Tagen fing Firefox nach dem Booten an, mich nach einem PC-Neustart auf eine russische Spieleseite zu verweisen. Sonst nichts, keine Pop-Ups oder irgendwas. Aber sowas macht natürlich misstrauisch. Also war ich die folgenden Tage besonders vorsichtig.

Vor zwei Tagen funktionierte dann die Bezahlung eines Spiels auf GoG.com per PayPal nicht korrekt, weshalb ich die letzten Tage ein besonderes Auge darauf hatte. Zwischenzeitlich fand ich in der Registry noch einen Eintrag, der auf die russische Seite verwies und löschte diesen, was mir immerhin diesen Kram zum PC-Start ersparte.

Vorhin nun kam ich gar nicht mehr in meinen PayPal-Account. Es folgte meinerseits eine sofortige Passwort-Rücksetzung via Telefonabfrage und eine Änderung meines E-Mail-Passworts beim dazugehörigen Gmail-Account.

Um auf Nummer Sicher zu gehen, dass die Passwortabschöpfung auch wirklich nicht bei mir geschah, sondern bei GoG.com, habe ich jetzt nach eurer Anleitung die folgenden Scans erhoben.

Defogger
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:42 on 14/09/2014 (Hjalfnar)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
FRST

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Hjalfnar (administrator) on HJALFNAR-PC on 14-09-2014 15:45:19
Running from C:\Users\Hjalfnar\Downloads
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Englisch (USA)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) D:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) D:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Malwarebytes Corporation) D:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\schtasks.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Adobe Systems Incorporated) D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
(Skype Technologies S.A.) D:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
() C:\Users\Hjalfnar\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2352072 2014-05-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7575768 2014-05-14] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SDTray] => D:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3802448 2014-09-04] (LogMeIn Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-418080255-3826421212-1868321458-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-418080255-3826421212-1868321458-1000\...\MountPoints2: {928a2691-c497-11e3-994e-806e6f6e6963} - E:\Bin\ASSETUP.exe
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xCAE8E5A9A858CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM-x32 - No Name - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} -  No File
Winsock: Catalog5 09 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog9 01 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 02 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 03 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 04 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog9 15 C:\Windows\SysWOW64\PrxerDrv.dll [70248] (Initex)
Winsock: Catalog5-x64 09 %SystemRoot%\system32\PrxerNsp.dll [57448] ()
Winsock: Catalog9-x64 01 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 02 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 03 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 04 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Winsock: Catalog9-x64 15 %SystemRoot%\system32\PrxerDrv.dll [76392] (Initex)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Deutsch (DE) Language Pack - C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default\Extensions\langpack-de@firefox.mozilla.org.xpi [2014-06-20]
FF Extension: English (GB) Language Pack - C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default\Extensions\langpack-en-GB@firefox.mozilla.org.xpi [2014-06-20]
FF Extension: Adblock Plus - C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-16]
FF Extension: QuickStores-Toolbar - C:\Program Files (x86)\Mozilla Firefox\extensions\quickstores@quickstores.de [2014-09-12]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
S4 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-05-07] ()
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
S4 DAUpdaterSvc; D:\Spiele\SteamLibrary\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2014-07-01] (BioWare)
R2 Hamachi2Svc; D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2525008 2014-09-04] (LogMeIn Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 MBAMScheduler; D:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; D:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1631008 2014-05-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21055432 2014-05-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-05-31] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2014-05-31] ()
R2 SDScannerService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 TunngleService; D:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2014-08-10] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-15] (Disc Soft Ltd)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2014-08-10] ()
R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [91352 2014-05-12] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-14] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-05-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 RTTEAMPT; C:\Windows\System32\DRIVERS\RtTeam620.sys [58512 2012-07-03] (Realtek Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
U5 UnlockerDriver5; D:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-14 15:45 - 2014-09-14 15:45 - 00016634 _____ () C:\Users\Hjalfnar\Downloads\FRST.txt
2014-09-14 15:42 - 2014-09-14 15:42 - 00000478 _____ () C:\Users\Hjalfnar\Downloads\defogger_disable.log
2014-09-14 15:42 - 2014-09-14 15:42 - 00000000 _____ () C:\Users\Hjalfnar\defogger_reenable
2014-09-14 15:41 - 2014-09-14 15:41 - 00050477 _____ () C:\Users\Hjalfnar\Downloads\Defogger.exe
2014-09-14 15:40 - 2014-09-14 15:45 - 00000000 ____D () C:\FRST
2014-09-14 15:39 - 2014-09-14 15:39 - 02105856 _____ (Farbar) C:\Users\Hjalfnar\Downloads\FRST64.exe
2014-09-14 10:07 - 2014-07-18 06:11 - 00450709 _____ () C:\Windows\system32\Drivers\etc\hosts.20140914-100754.backup
2014-09-14 08:52 - 2014-09-14 10:05 - 00000504 _____ () C:\Windows\setupact.log
2014-09-14 08:52 - 2014-09-14 08:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-12 21:20 - 2014-09-12 21:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 03:03 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 03:03 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-12 03:03 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 03:03 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 03:03 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 03:03 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 03:03 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 03:03 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 03:03 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 03:03 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 03:03 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 03:03 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 03:03 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 03:03 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 03:03 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 03:03 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 03:03 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 03:03 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 03:03 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 03:03 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 03:03 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-12 03:03 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-12 03:03 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-12 03:03 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 03:03 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 03:03 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 03:03 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 03:03 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-12 03:03 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 03:03 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 03:03 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 03:03 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-12 03:03 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 03:03 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 03:03 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 03:03 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 03:03 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 03:03 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-12 03:03 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 03:03 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 03:03 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 03:03 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-12 03:03 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 03:03 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-12 03:02 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 03:02 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 03:02 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 03:02 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 03:02 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 03:02 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 03:02 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 03:02 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 03:02 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 03:02 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 03:02 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 03:02 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 03:00 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 03:00 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 09:59 - 2014-09-14 13:16 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\LogMeIn Hamachi
2014-09-11 09:59 - 2014-09-11 09:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-09-11 08:17 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 08:17 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 08:17 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 08:17 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 08:17 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 08:17 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 08:17 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 08:17 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 08:17 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 08:17 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 08:17 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-07 19:02 - 2014-09-07 19:02 - 00001049 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-07 19:02 - 2014-09-07 19:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-07 19:02 - 2011-02-18 15:07 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2014-09-06 23:08 - 2014-09-06 23:08 - 00003132 _____ () C:\Windows\System32\Tasks\Origin
2014-09-05 16:03 - 2014-09-05 16:03 - 00000222 _____ () C:\Users\Hjalfnar\Desktop\Wargame AirLand Battle.url
2014-09-05 11:56 - 2014-09-05 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The SIMS 4 Deluxe Edition
2014-09-04 23:21 - 2014-09-04 23:21 - 00000000 ____D () C:\Users\Hjalfnar\Documents\Aspyr
2014-09-04 23:19 - 2014-09-04 23:19 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\Aspyr
2014-09-04 18:17 - 2014-09-04 18:17 - 00000839 _____ () C:\Users\Hjalfnar\Desktop\Panzer Corps Collection.lnk
2014-09-04 18:17 - 2014-09-04 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panzer Corps Collection
2014-09-04 14:59 - 2014-09-04 14:59 - 00000221 _____ () C:\Users\Hjalfnar\Desktop\Star Wars The Force Unleashed.url
2014-08-31 19:09 - 2014-08-31 19:09 - 00000222 _____ () C:\Users\Hjalfnar\Desktop\Panzer Corps.url
2014-08-29 16:56 - 2014-09-02 08:59 - 00000132 _____ () C:\Users\Hjalfnar\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-08-28 05:17 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 05:17 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 05:17 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 01:07 - 2014-08-22 01:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP6118.tmp
2014-08-22 01:07 - 2014-08-22 01:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP60C8.tmp
2014-08-22 00:58 - 2014-08-22 00:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D97.tmp
2014-08-22 00:57 - 2014-08-22 00:57 - 00000000 _____ () C:\Windows\SysWOW64\FAPAB4B.tmp
2014-08-22 00:57 - 2014-08-22 00:57 - 00000000 _____ () C:\Windows\SysWOW64\FAPA946.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP85AE.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP83A9.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP7861.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP543C.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPD46C.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPD277.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPC5F7.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPA324.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP84AA.tmp
2014-08-22 00:54 - 2014-08-22 00:54 - 00000000 _____ () C:\Windows\SysWOW64\FAPB6B9.tmp
2014-08-22 00:54 - 2014-08-22 00:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP9958.tmp
2014-08-22 00:43 - 2014-08-22 00:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP8C2C.tmp
2014-08-22 00:43 - 2014-08-22 00:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP8C0B.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAPA5B0.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAPA560.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6DDB.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6DAA.tmp
2014-08-22 00:30 - 2014-08-22 00:31 - 291175499 _____ () C:\Users\Hjalfnar\Downloads\_Divide_et_Impera095.7z
2014-08-22 00:30 - 2014-08-22 00:30 - 00000000 _____ () C:\Windows\SysWOW64\FAPD61A.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP6388.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP588E.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP421F.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP2856.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP2613.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAPDAFA.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAPD8D6.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAP1AAC.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAP1251.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPEB18.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPE72F.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPDB4B.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPD994.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPB965.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPB56D.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPAEB.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP953.tmp
2014-08-21 23:25 - 2014-08-21 23:25 - 00000000 _____ () C:\Windows\SysWOW64\FAPBBD1.tmp
2014-08-21 23:19 - 2014-08-21 23:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP3496.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9DC2.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9DA0.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D8F.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D6E.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPDCEB.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP5B7A.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP37D2.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP2C8A.tmp
2014-08-21 23:04 - 2014-08-21 23:04 - 00000000 _____ () C:\Windows\SysWOW64\FAPBCF4.tmp
2014-08-21 22:54 - 2014-08-21 22:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP3942.tmp
2014-08-21 22:54 - 2014-08-21 22:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP2025.tmp
2014-08-21 22:53 - 2014-08-21 22:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP3548.tmp
2014-08-21 22:51 - 2014-08-21 22:51 - 00000000 _____ () C:\Windows\SysWOW64\FAP32F5.tmp
2014-08-21 22:50 - 2014-08-21 22:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP30F1.tmp
2014-08-21 22:47 - 2014-08-21 22:47 - 00000000 _____ () C:\Windows\SysWOW64\FAPF288.tmp
2014-08-21 22:47 - 2014-08-21 22:47 - 00000000 _____ () C:\Windows\SysWOW64\FAPEB17.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAPF75C.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAPEEE2.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6B4B.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP63EA.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP20C1.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP1A59.tmp
2014-08-21 22:44 - 2014-08-21 22:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP692.tmp
2014-08-21 22:44 - 2014-08-21 22:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP16F9.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAPAF7C.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP9EF6.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CA3.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8603.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP85D2.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8553.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8438.tmp
2014-08-21 19:56 - 2014-08-21 19:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPC78C.tmp
2014-08-21 19:56 - 2014-08-21 19:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPC76B.tmp
2014-08-21 19:49 - 2014-08-21 19:49 - 00000000 _____ () C:\Windows\SysWOW64\FAP679D.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP786D.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP7649.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP75CA.tmp
2014-08-21 19:35 - 2014-08-21 19:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP9E2F.tmp
2014-08-21 19:30 - 2014-08-21 19:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP133D.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAPDABD.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAPD233.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP94C4.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP8519.tmp
2014-08-21 19:25 - 2014-08-21 19:25 - 00000000 _____ () C:\Windows\SysWOW64\FAP5E94.tmp
2014-08-21 19:20 - 2014-08-21 19:20 - 00000000 _____ () C:\Windows\SysWOW64\FAPD45.tmp
2014-08-21 19:20 - 2014-08-21 19:20 - 00000000 _____ () C:\Windows\SysWOW64\FAP162D.tmp
2014-08-21 19:19 - 2014-08-21 19:19 - 00000000 _____ () C:\Windows\SysWOW64\FAPA196.tmp
2014-08-21 19:19 - 2014-08-21 19:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FCF.tmp
2014-08-21 19:00 - 2014-08-21 19:00 - 00000000 _____ () C:\Windows\SysWOW64\FAP739F.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP322A.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP31EA.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP316B.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CE8.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CC7.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9B2F.tmp
2014-08-21 18:54 - 2014-08-21 18:54 - 00000000 _____ () C:\Windows\SysWOW64\FAPDC01.tmp
2014-08-21 18:54 - 2014-08-21 18:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP1636.tmp
2014-08-21 18:44 - 2014-08-21 18:44 - 00000000 _____ () C:\Windows\SysWOW64\FAPEDAB.tmp
2014-08-21 18:34 - 2014-08-21 18:34 - 00000000 _____ () C:\Windows\SysWOW64\FAPCFA.tmp
2014-08-21 18:34 - 2014-08-21 18:34 - 00000000 _____ () C:\Windows\SysWOW64\FAP1AF0.tmp
2014-08-21 18:33 - 2014-08-21 18:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPDC95.tmp
2014-08-21 18:32 - 2014-08-21 18:32 - 00000000 _____ () C:\Windows\SysWOW64\FAPEE8D.tmp
2014-08-21 18:31 - 2014-08-21 18:31 - 00000000 _____ () C:\Windows\SysWOW64\FAPEF37.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP8F88.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP8AD5.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP894D.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3B57.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3B16.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3866.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3806.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3066.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP712B.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6C59.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6AB1.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6A61.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP5D55.tmp
2014-08-21 14:39 - 2014-08-21 14:39 - 00000000 _____ () C:\Windows\SysWOW64\FAP2D00.tmp
2014-08-21 14:36 - 2014-08-21 14:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP4CEC.tmp
2014-08-21 14:35 - 2014-08-21 14:35 - 00000000 _____ () C:\Windows\SysWOW64\FAPDF79.tmp
2014-08-21 14:35 - 2014-08-21 14:35 - 00000000 _____ () C:\Windows\SysWOW64\FAPBA5A.tmp
2014-08-21 14:33 - 2014-08-21 14:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPB385.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP313A.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP2E1C.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP2D6F.tmp
2014-08-21 14:29 - 2014-08-21 14:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4C33.tmp
2014-08-21 14:29 - 2014-08-21 14:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4667.tmp
2014-08-21 14:18 - 2014-08-21 14:18 - 00000000 _____ () C:\Windows\SysWOW64\FAPA8AF.tmp
2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 _____ () C:\Windows\SysWOW64\FAPC80F.tmp
2014-08-21 13:40 - 2014-08-21 13:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP8F32.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP615C.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP613B.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP60FB.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP172D.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP16FC.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP168D.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP6076.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP6035.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP5FD6.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA50.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA00.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPD8D5.tmp
2014-08-21 12:35 - 2014-08-21 12:35 - 00000000 ____D () C:\Users\Hjalfnar\Downloads\Warhammer 40K - 7th Edition - Codex Space Wolves
2014-08-21 12:34 - 2014-08-21 12:34 - 00000000 _____ () C:\Windows\SysWOW64\FAP3248.tmp
2014-08-21 12:33 - 2014-08-21 12:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPE9D1.tmp
2014-08-21 12:26 - 2014-08-21 12:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP38D8.tmp
2014-08-21 12:25 - 2014-08-21 12:25 - 00000000 _____ () C:\Windows\SysWOW64\FAP770E.tmp
2014-08-21 11:52 - 2014-08-21 11:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPEEAA.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPE8EE.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPE5D0.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPC498.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPC052.tmp
2014-08-21 10:39 - 2014-08-21 10:39 - 00000000 _____ () C:\Windows\SysWOW64\FAPDD60.tmp
2014-08-21 10:39 - 2014-08-21 10:39 - 00000000 _____ () C:\Windows\SysWOW64\FAPDD4F.tmp
2014-08-21 10:36 - 2014-08-21 10:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP5B80.tmp
2014-08-21 10:36 - 2014-08-21 10:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP5AF2.tmp
2014-08-21 10:28 - 2014-08-21 10:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP9BE6.tmp
2014-08-21 10:28 - 2014-08-21 10:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP712C.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAPED99.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAPEC9E.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP54B1.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP46F9.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3F39.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E7C.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3086.tmp
2014-08-21 10:25 - 2014-08-21 10:25 - 00000000 _____ () C:\Windows\SysWOW64\FAPE300.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP96CA.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP96B8.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP9697.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP9685.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD984.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD972.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD960.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPC938.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP30BF.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP30AE.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP309C.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP307B.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPD459.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPD274.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAP63DF.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAP1052.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FDD.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89DC.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89DA.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89B9.tmp
2014-08-21 01:03 - 2014-08-21 01:03 - 00000000 _____ () C:\Windows\SysWOW64\FAPC454.tmp
2014-08-20 22:58 - 2014-08-20 22:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP795C.tmp
2014-08-20 22:58 - 2014-08-20 22:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP793B.tmp
2014-08-20 22:29 - 2014-08-20 22:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4656.tmp
2014-08-20 22:28 - 2014-08-20 22:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP92AF.tmp
2014-08-20 22:28 - 2014-08-20 22:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP9156.tmp
2014-08-20 22:27 - 2014-08-20 22:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP9817.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPE931.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPDB98.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPCF47.tmp
2014-08-20 22:19 - 2014-08-20 22:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP4416.tmp
2014-08-20 22:19 - 2014-08-20 22:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP3F82.tmp
2014-08-20 22:09 - 2014-08-20 22:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPE060.tmp
2014-08-20 22:09 - 2014-08-20 22:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPD7C7.tmp
2014-08-20 22:05 - 2014-08-20 22:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPFA61.tmp
2014-08-20 22:05 - 2014-08-20 22:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPEE9D.tmp
2014-08-20 22:02 - 2014-08-20 22:02 - 00000000 _____ () C:\Windows\SysWOW64\FAP2C17.tmp
2014-08-20 21:53 - 2014-08-20 21:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP6FB9.tmp
2014-08-20 21:53 - 2014-08-20 21:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP6EAE.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPED3B.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPEC9D.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPEA1C.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPE9DB.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPE364.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPDCAE.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7CA2.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C52.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C02.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP799F.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP794F.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP71EE.tmp
2014-08-20 20:09 - 2014-08-20 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPED90.tmp
2014-08-20 20:08 - 2014-08-20 20:08 - 00000000 _____ () C:\Windows\SysWOW64\FAP8338.tmp
2014-08-20 20:08 - 2014-08-20 20:08 - 00000000 _____ () C:\Windows\SysWOW64\FAP2204.tmp
2014-08-20 17:45 - 2014-08-20 17:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP77CC.tmp
2014-08-20 17:45 - 2014-08-20 17:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP6100.tmp
2014-08-20 17:44 - 2014-08-20 17:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP1FF9.tmp
2014-08-20 17:37 - 2014-08-20 17:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPECA7.tmp
2014-08-20 16:35 - 2014-08-20 16:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP3EE8.tmp
2014-08-20 14:57 - 2014-08-20 14:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP4F0A.tmp
2014-08-20 14:57 - 2014-08-20 14:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP4E7C.tmp
2014-08-20 13:09 - 2014-08-20 13:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP7308.tmp
2014-08-20 13:09 - 2014-08-20 13:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP72B8.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPEFC1.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPE1CB.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPE18A.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA48.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPD47C.tmp
2014-08-20 12:51 - 2014-08-20 12:51 - 00000000 _____ () C:\Windows\SysWOW64\FAP9BBE.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP86C6.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP8676.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP7F33.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP7BC8.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP79A4.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP77ED.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP77BC.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6FCE.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6956.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPB9A5.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPA50B.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPA4DA.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FF8.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP9971.tmp
2014-08-20 11:59 - 2014-08-20 11:59 - 00000000 _____ () C:\Windows\SysWOW64\FAP2B.tmp
2014-08-20 11:57 - 2014-08-20 11:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP8733.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPDBC6.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD2AF.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD26F.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPCD01.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPC522.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPDAA.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPD5A.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP4779.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E82.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E41.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP37BA.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP1672.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAPFB4.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP1C27.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP1004.tmp
2014-08-20 11:32 - 2014-08-20 11:32 - 00000000 _____ () C:\Windows\SysWOW64\FAPCDC3.tmp
2014-08-20 11:30 - 2014-08-20 11:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP2AFD.tmp
2014-08-20 11:07 - 2014-08-20 11:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP95FC.tmp
2014-08-20 10:47 - 2014-08-23 13:55 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\Adobe
2014-08-19 00:11 - 2014-08-19 00:11 - 03689799 _____ () C:\Users\Hjalfnar\Desktop\OnlineCodexWH40K_Testversion_7.jar
2014-08-15 03:00 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-15 03:00 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-15 03:00 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 03:00 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-15 03:00 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-15 03:00 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-15 03:00 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-15 03:00 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-14 15:45 - 2014-09-14 15:45 - 00016634 _____ () C:\Users\Hjalfnar\Downloads\FRST.txt
2014-09-14 15:45 - 2014-09-14 15:40 - 00000000 ____D () C:\FRST
2014-09-14 15:42 - 2014-09-14 15:42 - 00000478 _____ () C:\Users\Hjalfnar\Downloads\defogger_disable.log
2014-09-14 15:42 - 2014-09-14 15:42 - 00000000 _____ () C:\Users\Hjalfnar\defogger_reenable
2014-09-14 15:42 - 2014-04-15 14:17 - 00000000 ____D () C:\Users\Hjalfnar
2014-09-14 15:41 - 2014-09-14 15:41 - 00050477 _____ () C:\Users\Hjalfnar\Downloads\Defogger.exe
2014-09-14 15:40 - 2014-04-15 15:26 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\Skype
2014-09-14 15:39 - 2014-09-14 15:39 - 02105856 _____ (Farbar) C:\Users\Hjalfnar\Downloads\FRST64.exe
2014-09-14 15:30 - 2014-04-15 16:53 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-14 15:26 - 2014-04-15 16:03 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-14 13:16 - 2014-09-11 09:59 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\LogMeIn Hamachi
2014-09-14 12:40 - 2014-04-15 16:31 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-14 10:12 - 2014-04-15 16:09 - 00698294 _____ () C:\Windows\system32\perfh007.dat
2014-09-14 10:12 - 2014-04-15 16:09 - 00149760 _____ () C:\Windows\system32\perfc007.dat
2014-09-14 10:12 - 2009-07-14 07:13 - 01624034 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-14 10:09 - 2014-07-17 06:28 - 01840885 _____ () C:\Windows\WindowsUpdate.log
2014-09-14 10:05 - 2014-09-14 08:52 - 00000504 _____ () C:\Windows\setupact.log
2014-09-14 10:05 - 2014-04-15 15:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-14 10:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-14 09:14 - 2014-04-15 19:04 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\uTorrent
2014-09-14 09:06 - 2014-08-09 09:25 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\FileAdvisor
2014-09-14 09:06 - 2014-08-08 09:06 - 00000000 ____D () C:\Program Files (x86)\File Type Advisor
2014-09-14 09:03 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-14 08:52 - 2014-09-14 08:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-14 08:52 - 2014-04-15 14:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-14 01:02 - 2014-04-15 16:01 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\DAEMON Tools Lite
2014-09-14 00:58 - 2014-04-16 21:41 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\TS3Client
2014-09-14 00:04 - 2009-07-14 06:45 - 00025936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-14 00:04 - 2009-07-14 06:45 - 00025936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-12 21:20 - 2014-09-12 21:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 03:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-12 03:02 - 2014-04-15 16:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 03:02 - 2014-04-15 14:33 - 01594886 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 03:00 - 2014-05-07 00:57 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-12 03:00 - 2014-04-15 16:16 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-11 09:59 - 2014-09-11 09:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-09-11 09:55 - 2014-06-20 18:52 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\Tunngle
2014-09-11 09:55 - 2014-06-20 18:52 - 00000000 ____D () C:\ProgramData\Tunngle
2014-09-11 09:50 - 2014-06-20 21:10 - 00000000 _____ () C:\Windows\SysWOW64\Access.dat
2014-09-09 22:22 - 2014-05-30 15:07 - 00000000 ____D () C:\ProgramData\Origin
2014-09-07 19:04 - 2014-04-17 17:45 - 00000000 ____D () C:\Users\Hjalfnar\Documents\Electronic Arts
2014-09-07 19:02 - 2014-09-07 19:02 - 00001049 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-07 19:02 - 2014-09-07 19:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-06 23:08 - 2014-09-06 23:08 - 00003132 _____ () C:\Windows\System32\Tasks\Origin
2014-09-06 23:08 - 2014-05-30 15:08 - 00000000 ___HD () C:\Users\Hjalfnar\AppData\Roaming\Origin
2014-09-06 23:04 - 2014-04-15 15:56 - 00000000 ____D () C:\Spiele
2014-09-05 16:46 - 2014-04-15 14:48 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-05 16:03 - 2014-09-05 16:03 - 00000222 _____ () C:\Users\Hjalfnar\Desktop\Wargame AirLand Battle.url
2014-09-05 11:56 - 2014-09-05 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The SIMS 4 Deluxe Edition
2014-09-05 04:10 - 2014-09-11 08:17 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-11 08:17 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-04 23:21 - 2014-09-04 23:21 - 00000000 ____D () C:\Users\Hjalfnar\Documents\Aspyr
2014-09-04 23:19 - 2014-09-04 23:19 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\Aspyr
2014-09-04 18:17 - 2014-09-04 18:17 - 00000839 _____ () C:\Users\Hjalfnar\Desktop\Panzer Corps Collection.lnk
2014-09-04 18:17 - 2014-09-04 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panzer Corps Collection
2014-09-04 18:17 - 2014-04-15 22:57 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-09-04 14:59 - 2014-09-04 14:59 - 00000221 _____ () C:\Users\Hjalfnar\Desktop\Star Wars The Force Unleashed.url
2014-09-02 08:59 - 2014-08-29 16:56 - 00000132 _____ () C:\Users\Hjalfnar\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-08-31 19:28 - 2014-04-15 18:01 - 00000000 ____D () C:\Users\Hjalfnar\Documents\My Games
2014-08-31 19:09 - 2014-08-31 19:09 - 00000222 _____ () C:\Users\Hjalfnar\Desktop\Panzer Corps.url
2014-08-29 07:55 - 2009-07-14 06:45 - 04890344 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-23 13:55 - 2014-08-20 10:47 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\Adobe
2014-08-23 04:07 - 2014-08-28 05:17 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 05:17 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 05:17 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 08:31 - 2014-07-16 09:00 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\2K Games
2014-08-22 01:07 - 2014-08-22 01:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP6118.tmp
2014-08-22 01:07 - 2014-08-22 01:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP60C8.tmp
2014-08-22 00:58 - 2014-08-22 00:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D97.tmp
2014-08-22 00:57 - 2014-08-22 00:57 - 00000000 _____ () C:\Windows\SysWOW64\FAPAB4B.tmp
2014-08-22 00:57 - 2014-08-22 00:57 - 00000000 _____ () C:\Windows\SysWOW64\FAPA946.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP85AE.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP83A9.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP7861.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP543C.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPD46C.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPD277.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPC5F7.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPA324.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP84AA.tmp
2014-08-22 00:54 - 2014-08-22 00:54 - 00000000 _____ () C:\Windows\SysWOW64\FAPB6B9.tmp
2014-08-22 00:54 - 2014-08-22 00:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP9958.tmp
2014-08-22 00:43 - 2014-08-22 00:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP8C2C.tmp
2014-08-22 00:43 - 2014-08-22 00:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP8C0B.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAPA5B0.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAPA560.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6DDB.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6DAA.tmp
2014-08-22 00:31 - 2014-08-22 00:30 - 291175499 _____ () C:\Users\Hjalfnar\Downloads\_Divide_et_Impera095.7z
2014-08-22 00:30 - 2014-08-22 00:30 - 00000000 _____ () C:\Windows\SysWOW64\FAPD61A.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP6388.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP588E.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP421F.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP2856.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP2613.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAPDAFA.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAPD8D6.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAP1AAC.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAP1251.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPEB18.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPE72F.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPDB4B.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPD994.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPB965.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPB56D.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPAEB.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP953.tmp
2014-08-21 23:25 - 2014-08-21 23:25 - 00000000 _____ () C:\Windows\SysWOW64\FAPBBD1.tmp
2014-08-21 23:19 - 2014-08-21 23:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP3496.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9DC2.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9DA0.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D8F.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D6E.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPDCEB.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP5B7A.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP37D2.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP2C8A.tmp
2014-08-21 23:04 - 2014-08-21 23:04 - 00000000 _____ () C:\Windows\SysWOW64\FAPBCF4.tmp
2014-08-21 22:54 - 2014-08-21 22:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP3942.tmp
2014-08-21 22:54 - 2014-08-21 22:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP2025.tmp
2014-08-21 22:53 - 2014-08-21 22:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP3548.tmp
2014-08-21 22:51 - 2014-08-21 22:51 - 00000000 _____ () C:\Windows\SysWOW64\FAP32F5.tmp
2014-08-21 22:50 - 2014-08-21 22:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP30F1.tmp
2014-08-21 22:47 - 2014-08-21 22:47 - 00000000 _____ () C:\Windows\SysWOW64\FAPF288.tmp
2014-08-21 22:47 - 2014-08-21 22:47 - 00000000 _____ () C:\Windows\SysWOW64\FAPEB17.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAPF75C.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAPEEE2.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6B4B.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP63EA.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP20C1.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP1A59.tmp
2014-08-21 22:44 - 2014-08-21 22:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP692.tmp
2014-08-21 22:44 - 2014-08-21 22:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP16F9.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAPAF7C.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP9EF6.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CA3.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8603.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP85D2.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8553.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8438.tmp
2014-08-21 19:56 - 2014-08-21 19:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPC78C.tmp
2014-08-21 19:56 - 2014-08-21 19:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPC76B.tmp
2014-08-21 19:49 - 2014-08-21 19:49 - 00000000 _____ () C:\Windows\SysWOW64\FAP679D.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP786D.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP7649.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP75CA.tmp
2014-08-21 19:35 - 2014-08-21 19:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP9E2F.tmp
2014-08-21 19:30 - 2014-08-21 19:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP133D.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAPDABD.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAPD233.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP94C4.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP8519.tmp
2014-08-21 19:25 - 2014-08-21 19:25 - 00000000 _____ () C:\Windows\SysWOW64\FAP5E94.tmp
2014-08-21 19:20 - 2014-08-21 19:20 - 00000000 _____ () C:\Windows\SysWOW64\FAPD45.tmp
2014-08-21 19:20 - 2014-08-21 19:20 - 00000000 _____ () C:\Windows\SysWOW64\FAP162D.tmp
2014-08-21 19:19 - 2014-08-21 19:19 - 00000000 _____ () C:\Windows\SysWOW64\FAPA196.tmp
2014-08-21 19:19 - 2014-08-21 19:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FCF.tmp
2014-08-21 19:00 - 2014-08-21 19:00 - 00000000 _____ () C:\Windows\SysWOW64\FAP739F.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP322A.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP31EA.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP316B.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CE8.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CC7.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9B2F.tmp
2014-08-21 18:54 - 2014-08-21 18:54 - 00000000 _____ () C:\Windows\SysWOW64\FAPDC01.tmp
2014-08-21 18:54 - 2014-08-21 18:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP1636.tmp
2014-08-21 18:44 - 2014-08-21 18:44 - 00000000 _____ () C:\Windows\SysWOW64\FAPEDAB.tmp
2014-08-21 18:34 - 2014-08-21 18:34 - 00000000 _____ () C:\Windows\SysWOW64\FAPCFA.tmp
2014-08-21 18:34 - 2014-08-21 18:34 - 00000000 _____ () C:\Windows\SysWOW64\FAP1AF0.tmp
2014-08-21 18:33 - 2014-08-21 18:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPDC95.tmp
2014-08-21 18:32 - 2014-08-21 18:32 - 00000000 _____ () C:\Windows\SysWOW64\FAPEE8D.tmp
2014-08-21 18:31 - 2014-08-21 18:31 - 00000000 _____ () C:\Windows\SysWOW64\FAPEF37.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP8F88.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP8AD5.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP894D.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3B57.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3B16.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3866.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3806.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3066.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP712B.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6C59.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6AB1.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6A61.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP5D55.tmp
2014-08-21 14:39 - 2014-08-21 14:39 - 00000000 _____ () C:\Windows\SysWOW64\FAP2D00.tmp
2014-08-21 14:36 - 2014-08-21 14:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP4CEC.tmp
2014-08-21 14:35 - 2014-08-21 14:35 - 00000000 _____ () C:\Windows\SysWOW64\FAPDF79.tmp
2014-08-21 14:35 - 2014-08-21 14:35 - 00000000 _____ () C:\Windows\SysWOW64\FAPBA5A.tmp
2014-08-21 14:33 - 2014-08-21 14:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPB385.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP313A.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP2E1C.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP2D6F.tmp
2014-08-21 14:29 - 2014-08-21 14:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4C33.tmp
2014-08-21 14:29 - 2014-08-21 14:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4667.tmp
2014-08-21 14:18 - 2014-08-21 14:18 - 00000000 _____ () C:\Windows\SysWOW64\FAPA8AF.tmp
2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 _____ () C:\Windows\SysWOW64\FAPC80F.tmp
2014-08-21 13:40 - 2014-08-21 13:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP8F32.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP615C.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP613B.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP60FB.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP172D.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP16FC.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP168D.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP6076.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP6035.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP5FD6.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA50.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA00.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPD8D5.tmp
2014-08-21 12:35 - 2014-08-21 12:35 - 00000000 ____D () C:\Users\Hjalfnar\Downloads\Warhammer 40K - 7th Edition - Codex Space Wolves
2014-08-21 12:34 - 2014-08-21 12:34 - 00000000 _____ () C:\Windows\SysWOW64\FAP3248.tmp
2014-08-21 12:33 - 2014-08-21 12:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPE9D1.tmp
2014-08-21 12:26 - 2014-08-21 12:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP38D8.tmp
2014-08-21 12:25 - 2014-08-21 12:25 - 00000000 _____ () C:\Windows\SysWOW64\FAP770E.tmp
2014-08-21 11:52 - 2014-08-21 11:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPEEAA.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPE8EE.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPE5D0.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPC498.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPC052.tmp
2014-08-21 10:39 - 2014-08-21 10:39 - 00000000 _____ () C:\Windows\SysWOW64\FAPDD60.tmp
2014-08-21 10:39 - 2014-08-21 10:39 - 00000000 _____ () C:\Windows\SysWOW64\FAPDD4F.tmp
2014-08-21 10:36 - 2014-08-21 10:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP5B80.tmp
2014-08-21 10:36 - 2014-08-21 10:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP5AF2.tmp
2014-08-21 10:28 - 2014-08-21 10:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP9BE6.tmp
2014-08-21 10:28 - 2014-08-21 10:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP712C.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAPED99.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAPEC9E.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP54B1.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP46F9.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3F39.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E7C.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3086.tmp
2014-08-21 10:25 - 2014-08-21 10:25 - 00000000 _____ () C:\Windows\SysWOW64\FAPE300.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP96CA.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP96B8.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP9697.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP9685.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD984.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD972.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD960.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPC938.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP30BF.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP30AE.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP309C.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP307B.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPD459.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPD274.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAP63DF.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAP1052.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FDD.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89DC.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89DA.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89B9.tmp
2014-08-21 01:03 - 2014-08-21 01:03 - 00000000 _____ () C:\Windows\SysWOW64\FAPC454.tmp
2014-08-20 22:58 - 2014-08-20 22:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP795C.tmp
2014-08-20 22:58 - 2014-08-20 22:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP793B.tmp
2014-08-20 22:29 - 2014-08-20 22:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4656.tmp
2014-08-20 22:28 - 2014-08-20 22:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP92AF.tmp
2014-08-20 22:28 - 2014-08-20 22:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP9156.tmp
2014-08-20 22:27 - 2014-08-20 22:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP9817.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPE931.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPDB98.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPCF47.tmp
2014-08-20 22:19 - 2014-08-20 22:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP4416.tmp
2014-08-20 22:19 - 2014-08-20 22:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP3F82.tmp
2014-08-20 22:09 - 2014-08-20 22:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPE060.tmp
2014-08-20 22:09 - 2014-08-20 22:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPD7C7.tmp
2014-08-20 22:05 - 2014-08-20 22:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPFA61.tmp
2014-08-20 22:05 - 2014-08-20 22:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPEE9D.tmp
2014-08-20 22:02 - 2014-08-20 22:02 - 00000000 _____ () C:\Windows\SysWOW64\FAP2C17.tmp
2014-08-20 21:53 - 2014-08-20 21:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP6FB9.tmp
2014-08-20 21:53 - 2014-08-20 21:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP6EAE.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPED3B.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPEC9D.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPEA1C.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPE9DB.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPE364.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPDCAE.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7CA2.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C52.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C02.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP799F.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP794F.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP71EE.tmp
2014-08-20 20:09 - 2014-08-20 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPED90.tmp
2014-08-20 20:08 - 2014-08-20 20:08 - 00000000 _____ () C:\Windows\SysWOW64\FAP8338.tmp
2014-08-20 20:08 - 2014-08-20 20:08 - 00000000 _____ () C:\Windows\SysWOW64\FAP2204.tmp
2014-08-20 17:45 - 2014-08-20 17:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP77CC.tmp
2014-08-20 17:45 - 2014-08-20 17:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP6100.tmp
2014-08-20 17:44 - 2014-08-20 17:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP1FF9.tmp
2014-08-20 17:37 - 2014-08-20 17:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPECA7.tmp
2014-08-20 16:35 - 2014-08-20 16:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP3EE8.tmp
2014-08-20 14:57 - 2014-08-20 14:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP4F0A.tmp
2014-08-20 14:57 - 2014-08-20 14:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP4E7C.tmp
2014-08-20 13:09 - 2014-08-20 13:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP7308.tmp
2014-08-20 13:09 - 2014-08-20 13:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP72B8.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPEFC1.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPE1CB.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPE18A.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA48.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPD47C.tmp
2014-08-20 12:51 - 2014-08-20 12:51 - 00000000 _____ () C:\Windows\SysWOW64\FAP9BBE.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP86C6.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP8676.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP7F33.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP7BC8.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP79A4.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP77ED.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP77BC.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6FCE.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6956.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPB9A5.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPA50B.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPA4DA.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FF8.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP9971.tmp
2014-08-20 11:59 - 2014-08-20 11:59 - 00000000 _____ () C:\Windows\SysWOW64\FAP2B.tmp
2014-08-20 11:57 - 2014-08-20 11:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP8733.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPDBC6.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD2AF.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD26F.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPCD01.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPC522.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPDAA.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPD5A.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP4779.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E82.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E41.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP37BA.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP1672.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAPFB4.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP1C27.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP1004.tmp
2014-08-20 11:32 - 2014-08-20 11:32 - 00000000 _____ () C:\Windows\SysWOW64\FAPCDC3.tmp
2014-08-20 11:30 - 2014-08-20 11:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP2AFD.tmp
2014-08-20 11:07 - 2014-08-20 11:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP95FC.tmp
2014-08-20 10:13 - 2014-04-15 16:53 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-20 10:13 - 2014-04-15 16:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-20 10:13 - 2014-04-15 16:53 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-19 20:05 - 2014-09-12 03:03 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 19:39 - 2014-09-12 03:03 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 01:01 - 2014-09-12 03:03 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-12 03:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-12 03:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-12 03:02 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-12 03:02 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-12 03:02 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-12 03:03 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-12 03:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-12 03:03 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-12 03:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:11 - 2014-08-19 00:11 - 03689799 _____ () C:\Users\Hjalfnar\Desktop\OnlineCodexWH40K_Testversion_7.jar
2014-08-19 00:08 - 2014-09-12 03:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-12 03:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:08 - 2014-09-12 03:02 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:05 - 2014-09-12 03:03 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-12 03:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-12 03:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-12 03:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-12 03:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-12 03:03 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-12 03:03 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-12 03:03 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-12 03:03 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-12 03:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-12 03:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-12 03:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-12 03:03 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-12 03:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-12 03:03 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-12 03:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-12 03:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-12 03:03 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-12 03:03 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-12 03:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-12 03:03 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:27 - 2014-09-12 03:03 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-12 03:03 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-12 03:03 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-12 03:03 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:23 - 2014-09-12 03:02 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:22 - 2014-09-12 03:03 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-12 03:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-12 03:03 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-12 03:03 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-12 03:02 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-12 03:02 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-12 03:02 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-12 03:03 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-12 03:02 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-12 03:03 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-12 03:02 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-12 03:02 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-12 03:03 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:38 - 2014-09-12 03:02 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:36 - 2014-09-12 03:03 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-15 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

Files to move or delete:
====================
C:\Users\Hjalfnar\AppData\Roaming\Origin\update.vbe


Some content of TEMP:
====================
C:\Users\Hjalfnar\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-06 18:05

==================== End Of Log ============================
--- --- ---

--- --- ---


Edit: Weitere Logfiles auf Modanweisung weiter unten!

Danke schon im Voraus von meiner Seite!
Geändert von Hjalfnar (14.09.2014 um 15:42 Uhr)

Alt 14.09.2014, 15:34   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Hi und

Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 14.09.2014, 15:41   #3
Hjalfnar
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Alles klar!

Addition:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Hjalfnar at 2014-09-14 15:45:41
Running from C:\Users\Hjalfnar\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKCU\...\uTorrent) (Version: 3.4.2.32239 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
ACW 3.0  Brothers vs Brothers Music (HKLM-x32\...\ACW 3.0  Brothers vs Brothers Music(only)) (Version: (only) - ACW mod Team)
ACW Brothers vs Brothers (HKLM-x32\...\ACW Brothers vs Brothers3.3) (Version: 3.3 - ACW mod Team)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version:  - Ensemble Studios)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Avira (HKLM-x32\...\{142be4a8-895b-4ed9-b1ff-11c76357e3df}) (Version: 1.1.17.31000 - Avira Operations GmbH & Co. KG)
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
calibre 64bit (HKLM\...\{2B73426A-9499-4875-BAE9-8DD729009399}) (Version: 1.47.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Codename Panzers Cold War (HKLM\...\Codename Panzers Cold War_is1) (Version:  - )
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version:  - Paradox Development Studio)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Darkest Hour A Hearts of Iron Game (HKCU\...\Darkest Hour A Hearts of Iron Game) (Version:  - Paradox Interactive AB)
DarthMod: Shogun II (HKLM-x32\...\DarthMod: Shogun II) (Version:  - )
Defraggler (HKLM\...\Defraggler) (Version: 2.17 - Piriform)
Deponia (HKLM-x32\...\Steam App 214340) (Version:  - Daedalic Entertainment)
Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.0.671.10 - Electronic Arts Inc.)
Dragon Age Redesigned © Morrigan (HKCU\...\Dragon Age Redesigned © Morrigan) (Version:  - )
Dragon Age Redesigned Oghren© (HKCU\...\Dragon Age Redesigned Oghren©) (Version:  - )
Dragon Age Redesigned©  Zevran (HKCU\...\Dragon Age Redesigned©  Zevran) (Version:  - )
Dragon Age Redesigned© (HKCU\...\Dragon Age Redesigned©) (Version:  - )
Dragon Age Redesigned© Leliana (HKCU\...\Dragon Age Redesigned© Leliana) (Version:  - )
Dragon Age Redesigned© Sten (HKCU\...\Dragon Age Redesigned© Sten) (Version:  - )
Dragon Age Redesigned© Wynne (HKCU\...\Dragon Age Redesigned© Wynne) (Version:  - )
Dragon Age: Origins - Ultimate Edition (HKLM-x32\...\Steam App 47810) (Version:  - BioWare)
Empire: Total War (HKLM-x32\...\Steam App 10500) (Version:  - The Creative Assembly)
Fallout 2 (HKLM-x32\...\Fallout 2_is1) (Version:  - GOG.com)
File Type Advisor 1.4 (HKLM-x32\...\File Type Advisor_is1) (Version:  - filetypeadvisor.com)
FO2 Restoration Project 2.3.2 (HKLM-x32\...\Fallout 2 Restoration Project_is1) (Version:  - killap)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Free M4a to MP3 Converter 8.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
Free YouTube to MP3 Converter version 3.12.38.530 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.38.530 - DVDVideoSoft Ltd.)
Freemake Video Converter Version 4.1.4 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.4 - Ellora Assets Corporation)
Hearts of Iron III (HKLM-x32\...\Steam App 25890) (Version:  - Paradox Development Studio)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3186 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation) Hidden
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.31.8.1 - Intel Corporation) Hidden
Java 7 Update 60 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417060FF}) (Version: 7.0.600 - Oracle)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.236 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.236 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 14.6.22 (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA Update 14.6.22 (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.)
Panzer Corps (HKLM-x32\...\Steam App 268400) (Version:  - Flashback Games)
Panzer Corps Collection version 1.14 + ALL DLC (HKLM-x32\...\Panzer Corps Collection_is1) (Version: 1.14 + ALL DLC - )
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.5.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Proxifier version 3.21 (HKLM-x32\...\Proxifier_is1) (Version: 3.21 - Initex)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 2.0.2.6 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
Setup - The SIMS 4  Deluxe Edition ... (HKLM-x32\...\Setup - The SIMS 4  Deluxe Edition ...) (Version: ... - Electronic Arts)
SHIELD Streaming (Version: 2.1.214 - NVIDIA Corporation) Hidden
Silent Hunter 4 Wolves of the Pacific (HKLM-x32\...\{0D005F09-A5F4-473B-A901-5735C6AF5628}) (Version: 1.05.0000 - Ubisoft)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
SOUP - Share-Online Uploader (HKCU\...\ab1af244d47f0c33) (Version: 1.0.0.26 - Xlice Corp.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Star Wars: The Force Unleashed Ultimate Sith Edition (HKLM-x32\...\Steam App 32430) (Version:  - LucasArts)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
The Sims™ 3 Кино Каталог (HKLM-x32\...\{D0087539-3C57-44E0-BEE7-D779D546CBE1}) (Version: 20.0.53 - Electronic Arts)
Total War: ROME II (HKLM-x32\...\Steam App 214950) (Version:  - Creative Assembly)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Uplay (HKLM-x32\...\Uplay) (Version: 4.6 - Ubisoft)
Vegas Pro 13.0 (64-bit) (HKLM\...\{CE92F061-BFBC-11E3-8FF3-F04DA23A5C58}) (Version: 13.0.290 - Sony)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
Wargame: AirLand Battle (HKLM-x32\...\Steam App 222750) (Version:  - Eugen Systems)
Windows Live Communications Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Wolfenstein: The New Order German Edition (HKLM-x32\...\Steam App 288570) (Version:  - MachineGames)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

09-09-2014 06:07:54 Windows Update
11-09-2014 07:57:07 Removed LogMeIn Hamachi
11-09-2014 07:59:03 Installed LogMeIn Hamachi
12-09-2014 01:00:11 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-09-14 10:07 - 00450709 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {010D6386-90CF-4816-AB6D-2A22D69AFD2D} - System32\Tasks\FileAdvisorUpdate => C:\Program Files (x86)\File Type Advisor\fileadvisor.exe [2013-09-04] (File Type Advisor)
Task: {22B8B89F-437F-4B87-B6FA-BA1CEA4EEEBD} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {2692649C-5804-43B8-8B2B-95F1B4A4828D} - System32\Tasks\Origin => C:\Users\Hjalfnar\AppData\Roaming\Origin\update.vbe [2014-09-06] () <==== ATTENTION
Task: {69246FFB-17AF-4332-9C22-C2FC5F9ED3BE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => D:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {8E58DDBA-D122-4CF5-9EBE-444988935D6D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-20] (Adobe Systems Incorporated)
Task: {8FA49973-C018-4B07-A511-E548137CC028} - System32\Tasks\CCleanerSkipUAC => D:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {9A062267-36A6-45A0-98C3-46C95E08DB16} - System32\Tasks\FileAdvisorCheck => C:\Program Files (x86)\File Type Advisor\file-type-advisor.exe [2013-09-04] (filetypeadvisor.com                                         )
Task: {F19AA483-C0AB-4A34-9F2A-6CC46EAE63C5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => D:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-07-15 15:50 - 2012-11-22 18:57 - 00057448 _____ () C:\Windows\system32\PrxerNsp.dll
2014-04-15 15:33 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-31 08:42 - 2014-05-31 08:42 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-05-31 08:42 - 2014-05-31 08:42 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-09-14 15:41 - 2014-09-14 15:41 - 00050477 _____ () C:\Users\Hjalfnar\Downloads\Defogger.exe
2014-07-18 06:05 - 2014-05-13 12:04 - 00109400 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-07-18 06:05 - 2014-05-13 12:04 - 00416600 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-07-18 06:05 - 2014-05-13 12:04 - 00167768 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-07-18 06:05 - 2012-08-23 10:38 - 00574840 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-07-18 06:05 - 2012-04-03 17:06 - 00565640 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-09-12 21:20 - 2014-09-12 21:20 - 03716720 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-04-15 14:32 - 2013-09-16 12:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-04-15 16:31 - 2014-08-21 00:38 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-05-22 00:49 - 2014-08-28 13:48 - 02224320 _____ () C:\Program Files (x86)\Steam\video.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-04-15 16:31 - 2014-08-28 13:48 - 00678080 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2014-04-15 16:31 - 2014-08-21 00:38 - 34589376 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-08-14 22:46 - 2014-08-21 00:38 - 00837824 _____ () C:\Program Files (x86)\Steam\bin\ffmpegsumo.dll
2014-08-20 10:47 - 2014-08-20 10:47 - 09496576 _____ () C:\Users\Hjalfnar\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_rdlang32.deu
2014-05-08 13:21 - 2014-05-08 13:21 - 00305520 _____ () D:\Program Files (x86)\Adobe\Reader 10.0\Reader\sqlite.dll
2014-08-20 10:47 - 2014-08-20 10:47 - 00014336 _____ () C:\Users\Hjalfnar\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_Updater.DEU

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Hjalfnar\Desktop\Selbstauskunft_Fam.Weiberg.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Hjalfnar\Desktop\Selbstauskunft_Fam.Weiberg.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: asComSvc => 2
MSCONFIG\Services: DAUpdaterSvc => 3
MSCONFIG\Services: Hamachi2Svc => 2
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: DAEMON Tools Lite => "D:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: EADM => "D:\Spiele\Origin\Origin.exe" -AutoStart
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: PDFPrint => D:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SwitchBoard => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/14/2014 10:07:16 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (09/14/2014 10:05:49 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (09/14/2014 10:05:49 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/14/2014 10:05:49 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (09/14/2014 09:35:55 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/14/2014 09:35:55 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (09/14/2014 09:35:54 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (09/14/2014 08:52:46 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (09/14/2014 08:52:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/14/2014 08:52:14 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.


System errors:
=============
Error: (09/14/2014 08:52:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/14/2014 08:52:44 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LogMeIn Hamachi Tunneling Engine erreicht.

Error: (09/14/2014 00:59:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/14/2014 00:59:48 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LogMeIn Hamachi Tunneling Engine erreicht.

Error: (09/14/2014 00:59:10 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎14.‎09.‎2014 um 00:58:20 unerwartet heruntergefahren.

Error: (09/13/2014 11:08:03 AM) (Source: DCOM) (EventID: 10001) (User: )
Description: C:\Windows\System32\slui.exe -Embedding5{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}

Error: (09/12/2014 07:15:19 AM) (Source: DCOM) (EventID: 10001) (User: )
Description: C:\Windows\System32\slui.exe -Embedding5{F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}

Error: (09/11/2014 09:59:20 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/11/2014 09:59:20 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LogMeIn Hamachi Tunneling Engine erreicht.

Error: (09/11/2014 09:59:17 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================
Error: (09/14/2014 10:07:16 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exeC:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe.Config0

Error: (09/14/2014 10:05:49 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (09/14/2014 10:05:49 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/14/2014 10:05:49 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exeC:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe.Config0

Error: (09/14/2014 09:35:55 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/14/2014 09:35:55 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exeC:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe.Config0

Error: (09/14/2014 09:35:54 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (09/14/2014 08:52:46 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (09/14/2014 08:52:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/14/2014 08:52:14 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exeC:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe.Config0


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz
Percentage of memory in use: 32%
Total physical RAM: 8130.72 MB
Available physical RAM: 5528.03 MB
Total Pagefile: 16259.62 MB
Available Pagefile: 13139.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.47 GB) (Free:67.46 GB) NTFS
Drive d: () (Fixed) (Total:465.76 GB) (Free:190.32 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive i: (Volume) (Fixed) (Total:279.46 GB) (Free:260.15 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 223.6 GB) (Disk ID: E253E6B6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=223.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 760ACF0C)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 279.5 GB) (Disk ID: FFE99422)
Partition 1: (Not Active) - (Size=279.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
GMER:

Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-14 16:05:25
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000073 Crucial_ rev.MU03 223,57GB
Running: 30gyot8r.exe; Driver: C:\Users\Hjalfnar\AppData\Local\Temp\kxldykod.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                     fffff800031a4000 45 bytes [00, 00, 13, 02, 49, 72, 70, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                                     fffff800031a402f 17 bytes [00, E0, 37, 91, 0A, 80, FA, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\SysWOW64\PnkBstrA.exe[1948] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                0000000070381a22 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1948] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                0000000070381ad0 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1948] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                0000000070381b08 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1948] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                0000000070381bba 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[1948] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                0000000070381bda 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrB.exe[2056] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                0000000070381a22 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrB.exe[2056] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                0000000070381ad0 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrB.exe[2056] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                0000000070381b08 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrB.exe[2056] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                0000000070381bba 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrB.exe[2056] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                0000000070381bda 2 bytes [38, 70]
.text     C:\Windows\SysWOW64\PnkBstrB.exe[2056] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                         0000000076c11465 2 bytes [C1, 76]
.text     C:\Windows\SysWOW64\PnkBstrB.exe[2056] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                        0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2
.text     D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2080] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                           0000000076c11465 2 bytes [C1, 76]
.text     D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2080] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                          0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                      0000000076c11465 2 bytes [C1, 76]
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                     0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69            0000000076c11465 2 bytes [C1, 76]
.text     C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155           0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076c11465 2 bytes [C1, 76]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[4580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files (x86)\Steam\Steam.exe[2708] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                   0000000076c11465 2 bytes [C1, 76]
.text     C:\Program Files (x86)\Steam\Steam.exe[2708] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                  0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2340] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000076c11465 2 bytes [C1, 76]
.text     C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2340] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2
.text     C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[1540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000076c11465 2 bytes [C1, 76]
.text     C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[1540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2
.text     D:\Program Files (x86)\Skype\Phone\Skype.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                             0000000076c11465 2 bytes [C1, 76]
.text     D:\Program Files (x86)\Skype\Phone\Skype.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                            0000000076c114bb 2 bytes [C1, 76]
.text     ...                                                                                                                                                    * 2

---- Threads - GMER 2.1 ----

Thread    C:\Windows\SysWOW64\ntdll.dll [1800:1804]                                                                                                              0000000000fdc18f
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:3112]                                                                                                              000000006fa45880
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:3116]                                                                                                              000000006fa45880
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:3120]                                                                                                              000000006fa45880
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:3124]                                                                                                              000000006fa43520
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:3148]                                                                                                              0000000071ba34b0
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:5388]                                                                                                              000000007253e69f
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:3744]                                                                                                              00000000721a5570
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:2392]                                                                                                              00000000721a5d50
Thread    C:\Windows\SysWOW64\ntdll.dll [1800:4844]                                                                                                              0000000071d662ee
Thread    C:\Windows\SysWOW64\ntdll.dll [2032:2036]                                                                                                              00000000009387b2
Thread    C:\Windows\SysWOW64\ntdll.dll [2032:2156]                                                                                                              00000000008cd800
Thread    C:\Windows\SysWOW64\ntdll.dll [2032:2164]                                                                                                              00000000008d2560

---- EOF - GMER 2.1 ----
__________________
Alt 14.09.2014, 15:46   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Dann bitte jetzt Combofix ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 14.09.2014, 15:51   #5
Hjalfnar
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Bin anscheinend nicht in der Lage, das zu tun. Avira blockt alles, lässt sich auch nicht vollständig abschalten.


Alt 14.09.2014, 16:01   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Dann Avira bitte deinstallieren. Gibt es bessere Virenscanner...
__________________
--> Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet

Alt 14.09.2014, 16:46   #7
Hjalfnar
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Doch noch hingekriegt.

Combofix Logfile:
Code:
ATTFilter
ComboFix 14-09-12.01 - Hjalfnar 14.09.2014  17:38:34.1.4 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1033.18.8131.6094 [GMT 2:00]
ausgeführt von:: c:\users\Hjalfnar\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
D:\install.exe
I:\install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-08-14 bis 2014-09-14  ))))))))))))))))))))))))))))))
.
.
2014-09-14 15:42 . 2014-09-14 15:42	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-09-14 15:35 . 2014-09-14 15:35	--------	d-----w-	c:\users\Hjalfnar\AppData\Roaming\AVAST Software
2014-09-14 15:35 . 2014-09-14 15:35	427360	----a-w-	c:\windows\system32\drivers\aswsp.sys
2014-09-14 15:35 . 2014-09-14 15:34	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-09-14 15:35 . 2014-09-14 15:34	92008	----a-w-	c:\windows\system32\drivers\aswStm.sys
2014-09-14 15:35 . 2014-09-14 15:34	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-09-14 15:35 . 2014-09-14 15:34	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-09-14 15:35 . 2014-09-14 15:34	307344	----a-w-	c:\windows\system32\aswBoot.exe
2014-09-14 15:35 . 2014-09-14 15:34	29208	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2014-09-14 15:35 . 2014-09-14 15:34	224896	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-09-14 15:35 . 2014-09-14 15:34	1041168	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-09-14 15:34 . 2014-09-14 15:34	43152	----a-w-	c:\windows\avastSS.scr
2014-09-14 15:28 . 2014-09-14 15:35	--------	d-----w-	c:\program files\AVAST Software
2014-09-14 15:15 . 2014-09-14 15:28	--------	d-----w-	c:\programdata\AVAST Software
2014-09-14 13:40 . 2014-09-14 13:46	--------	d-----w-	C:\FRST
2014-09-12 18:46 . 2014-08-21 03:43	11319192	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CBE0C252-1E7C-47F5-B3DF-12E9E478734B}\mpengine.dll
2014-09-12 01:02 . 2014-08-19 18:05	810168	----a-w-	c:\program files\Internet Explorer\iexplore.exe
2014-09-12 01:00 . 2014-06-27 02:08	2777088	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2014-09-12 01:00 . 2014-06-27 01:45	2285056	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-11 07:59 . 2014-09-14 15:42	--------	d-----w-	c:\users\Hjalfnar\AppData\Local\LogMeIn Hamachi
2014-09-11 06:17 . 2014-08-01 11:53	1031168	----a-w-	c:\windows\system32\TSWorkspace.dll
2014-09-11 06:17 . 2014-08-01 11:35	793600	----a-w-	c:\windows\SysWow64\TSWorkspace.dll
2014-09-11 06:17 . 2014-06-24 03:29	2565120	----a-w-	c:\windows\system32\d3d10warp.dll
2014-09-11 06:17 . 2014-06-24 02:59	1987584	----a-w-	c:\windows\SysWow64\d3d10warp.dll
2014-09-11 06:17 . 2014-07-07 02:06	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-09-11 06:17 . 2014-07-07 02:06	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-09-11 06:17 . 2014-07-07 01:40	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-09-11 06:17 . 2014-07-07 01:40	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-09-11 06:17 . 2014-07-07 01:39	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-09-11 06:17 . 2014-09-05 02:10	578048	----a-w-	c:\windows\system32\aepdu.dll
2014-09-11 06:17 . 2014-09-05 02:05	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-09-07 17:02 . 2011-02-18 13:07	447752	----a-w-	c:\windows\SysWow64\vp6vfw.dll
2014-09-04 21:19 . 2014-09-04 21:19	--------	d-----w-	c:\users\Hjalfnar\AppData\Local\Aspyr
2014-08-28 03:17 . 2014-08-23 02:07	404480	----a-w-	c:\windows\system32\gdi32.dll
2014-08-28 03:17 . 2014-08-23 01:45	311808	----a-w-	c:\windows\SysWow64\gdi32.dll
2014-08-28 03:17 . 2014-08-23 00:59	3163648	----a-w-	c:\windows\system32\win32k.sys
2014-08-21 23:07 . 2014-08-21 23:07	0	----a-w-	c:\windows\SysWow64\FAP6118.tmp
2014-08-21 23:07 . 2014-08-21 23:07	0	----a-w-	c:\windows\SysWow64\FAP60C8.tmp
2014-08-21 22:58 . 2014-08-21 22:58	0	----a-w-	c:\windows\SysWow64\FAP9D97.tmp
2014-08-21 22:57 . 2014-08-21 22:57	0	----a-w-	c:\windows\SysWow64\FAPAB4B.tmp
2014-08-21 22:57 . 2014-08-21 22:57	0	----a-w-	c:\windows\SysWow64\FAPA946.tmp
2014-08-21 22:56 . 2014-08-21 22:56	0	----a-w-	c:\windows\SysWow64\FAP85AE.tmp
2014-08-21 22:56 . 2014-08-21 22:56	0	----a-w-	c:\windows\SysWow64\FAP83A9.tmp
2014-08-21 22:56 . 2014-08-21 22:56	0	----a-w-	c:\windows\SysWow64\FAP7861.tmp
2014-08-21 22:56 . 2014-08-21 22:56	0	----a-w-	c:\windows\SysWow64\FAP543C.tmp
2014-08-21 22:55 . 2014-08-21 22:55	0	----a-w-	c:\windows\SysWow64\FAPA324.tmp
2014-08-21 22:55 . 2014-08-21 22:55	0	----a-w-	c:\windows\SysWow64\FAP84AA.tmp
2014-08-21 22:55 . 2014-08-21 22:55	0	----a-w-	c:\windows\SysWow64\FAPD46C.tmp
2014-08-21 22:55 . 2014-08-21 22:55	0	----a-w-	c:\windows\SysWow64\FAPD277.tmp
2014-08-21 22:55 . 2014-08-21 22:55	0	----a-w-	c:\windows\SysWow64\FAPC5F7.tmp
2014-08-21 22:54 . 2014-08-21 22:54	0	----a-w-	c:\windows\SysWow64\FAPB6B9.tmp
2014-08-21 22:54 . 2014-08-21 22:54	0	----a-w-	c:\windows\SysWow64\FAP9958.tmp
2014-08-21 22:43 . 2014-08-21 22:43	0	----a-w-	c:\windows\SysWow64\FAP8C2C.tmp
2014-08-21 22:43 . 2014-08-21 22:43	0	----a-w-	c:\windows\SysWow64\FAP8C0B.tmp
2014-08-21 22:40 . 2014-08-21 22:40	0	----a-w-	c:\windows\SysWow64\FAPA5B0.tmp
2014-08-21 22:40 . 2014-08-21 22:40	0	----a-w-	c:\windows\SysWow64\FAPA560.tmp
2014-08-21 22:40 . 2014-08-21 22:40	0	----a-w-	c:\windows\SysWow64\FAP6DDB.tmp
2014-08-21 22:40 . 2014-08-21 22:40	0	----a-w-	c:\windows\SysWow64\FAP6DAA.tmp
2014-08-21 22:30 . 2014-08-21 22:30	0	----a-w-	c:\windows\SysWow64\FAPD61A.tmp
2014-08-21 22:27 . 2014-08-21 22:27	0	----a-w-	c:\windows\SysWow64\FAP6388.tmp
2014-08-21 22:27 . 2014-08-21 22:27	0	----a-w-	c:\windows\SysWow64\FAP588E.tmp
2014-08-21 22:27 . 2014-08-21 22:27	0	----a-w-	c:\windows\SysWow64\FAP421F.tmp
2014-08-21 22:27 . 2014-08-21 22:27	0	----a-w-	c:\windows\SysWow64\FAP2856.tmp
2014-08-21 22:27 . 2014-08-21 22:27	0	----a-w-	c:\windows\SysWow64\FAP2613.tmp
2014-08-21 22:22 . 2014-08-21 22:22	0	----a-w-	c:\windows\SysWow64\FAP1AAC.tmp
2014-08-21 22:22 . 2014-08-21 22:22	0	----a-w-	c:\windows\SysWow64\FAP1251.tmp
2014-08-21 22:22 . 2014-08-21 22:22	0	----a-w-	c:\windows\SysWow64\FAPDAFA.tmp
2014-08-21 22:22 . 2014-08-21 22:22	0	----a-w-	c:\windows\SysWow64\FAPD8D6.tmp
2014-08-21 21:56 . 2014-08-21 21:56	0	----a-w-	c:\windows\SysWow64\FAPAEB.tmp
2014-08-21 21:56 . 2014-08-21 21:56	0	----a-w-	c:\windows\SysWow64\FAP953.tmp
2014-08-21 21:56 . 2014-08-21 21:56	0	----a-w-	c:\windows\SysWow64\FAPEB18.tmp
2014-08-21 21:56 . 2014-08-21 21:56	0	----a-w-	c:\windows\SysWow64\FAPE72F.tmp
2014-08-21 21:56 . 2014-08-21 21:56	0	----a-w-	c:\windows\SysWow64\FAPDB4B.tmp
2014-08-21 21:56 . 2014-08-21 21:56	0	----a-w-	c:\windows\SysWow64\FAPD994.tmp
2014-08-21 21:56 . 2014-08-21 21:56	0	----a-w-	c:\windows\SysWow64\FAPB965.tmp
2014-08-21 21:56 . 2014-08-21 21:56	0	----a-w-	c:\windows\SysWow64\FAPB56D.tmp
2014-08-21 21:25 . 2014-08-21 21:25	0	----a-w-	c:\windows\SysWow64\FAPBBD1.tmp
2014-08-21 21:19 . 2014-08-21 21:19	0	----a-w-	c:\windows\SysWow64\FAP3496.tmp
2014-08-21 21:10 . 2014-08-21 21:10	0	----a-w-	c:\windows\SysWow64\FAP9DC2.tmp
2014-08-21 21:10 . 2014-08-21 21:10	0	----a-w-	c:\windows\SysWow64\FAP9DA0.tmp
2014-08-21 21:10 . 2014-08-21 21:10	0	----a-w-	c:\windows\SysWow64\FAP9D8F.tmp
2014-08-21 21:10 . 2014-08-21 21:10	0	----a-w-	c:\windows\SysWow64\FAP9D6E.tmp
2014-08-21 21:05 . 2014-08-21 21:05	0	----a-w-	c:\windows\SysWow64\FAPDCEB.tmp
2014-08-21 21:05 . 2014-08-21 21:05	0	----a-w-	c:\windows\SysWow64\FAP5B7A.tmp
2014-08-21 21:05 . 2014-08-21 21:05	0	----a-w-	c:\windows\SysWow64\FAP37D2.tmp
2014-08-21 21:05 . 2014-08-21 21:05	0	----a-w-	c:\windows\SysWow64\FAP2C8A.tmp
2014-08-21 21:04 . 2014-08-21 21:04	0	----a-w-	c:\windows\SysWow64\FAPBCF4.tmp
2014-08-21 20:54 . 2014-08-21 20:54	0	----a-w-	c:\windows\SysWow64\FAP3942.tmp
2014-08-21 20:54 . 2014-08-21 20:54	0	----a-w-	c:\windows\SysWow64\FAP2025.tmp
2014-08-21 20:53 . 2014-08-21 20:53	0	----a-w-	c:\windows\SysWow64\FAP3548.tmp
2014-08-21 20:51 . 2014-08-21 20:51	0	----a-w-	c:\windows\SysWow64\FAP32F5.tmp
2014-08-21 20:50 . 2014-08-21 20:50	0	----a-w-	c:\windows\SysWow64\FAP30F1.tmp
2014-08-21 20:47 . 2014-08-21 20:47	0	----a-w-	c:\windows\SysWow64\FAPF288.tmp
2014-08-21 20:47 . 2014-08-21 20:47	0	----a-w-	c:\windows\SysWow64\FAPEB17.tmp
2014-08-21 20:46 . 2014-08-21 20:46	0	----a-w-	c:\windows\SysWow64\FAP6B4B.tmp
2014-08-21 20:46 . 2014-08-21 20:46	0	----a-w-	c:\windows\SysWow64\FAP63EA.tmp
2014-08-21 20:46 . 2014-08-21 20:46	0	----a-w-	c:\windows\SysWow64\FAP20C1.tmp
2014-08-21 20:46 . 2014-08-21 20:46	0	----a-w-	c:\windows\SysWow64\FAP1A59.tmp
2014-08-21 20:46 . 2014-08-21 20:46	0	----a-w-	c:\windows\SysWow64\FAPF75C.tmp
2014-08-21 20:46 . 2014-08-21 20:46	0	----a-w-	c:\windows\SysWow64\FAPEEE2.tmp
2014-08-21 20:44 . 2014-08-21 20:44	0	----a-w-	c:\windows\SysWow64\FAP16F9.tmp
2014-08-21 20:44 . 2014-08-21 20:44	0	----a-w-	c:\windows\SysWow64\FAP692.tmp
2014-08-21 20:43 . 2014-08-21 20:43	0	----a-w-	c:\windows\SysWow64\FAPAF7C.tmp
2014-08-21 20:43 . 2014-08-21 20:43	0	----a-w-	c:\windows\SysWow64\FAP9EF6.tmp
2014-08-21 20:43 . 2014-08-21 20:43	0	----a-w-	c:\windows\SysWow64\FAP9CA3.tmp
2014-08-21 18:09 . 2014-08-21 18:09	0	----a-w-	c:\windows\SysWow64\FAP8603.tmp
2014-08-21 18:09 . 2014-08-21 18:09	0	----a-w-	c:\windows\SysWow64\FAP85D2.tmp
2014-08-21 18:09 . 2014-08-21 18:09	0	----a-w-	c:\windows\SysWow64\FAP8553.tmp
2014-08-21 18:09 . 2014-08-21 18:09	0	----a-w-	c:\windows\SysWow64\FAP8438.tmp
2014-08-21 17:56 . 2014-08-21 17:56	0	----a-w-	c:\windows\SysWow64\FAPC78C.tmp
2014-08-21 17:56 . 2014-08-21 17:56	0	----a-w-	c:\windows\SysWow64\FAPC76B.tmp
2014-08-21 17:49 . 2014-08-21 17:49	0	----a-w-	c:\windows\SysWow64\FAP679D.tmp
2014-08-21 17:41 . 2014-08-21 17:41	0	----a-w-	c:\windows\SysWow64\FAP786D.tmp
2014-08-21 17:41 . 2014-08-21 17:41	0	----a-w-	c:\windows\SysWow64\FAP7649.tmp
2014-08-21 17:41 . 2014-08-21 17:41	0	----a-w-	c:\windows\SysWow64\FAP75CA.tmp
2014-08-21 17:35 . 2014-08-21 17:35	0	----a-w-	c:\windows\SysWow64\FAP9E2F.tmp
2014-08-21 17:30 . 2014-08-21 17:30	0	----a-w-	c:\windows\SysWow64\FAP133D.tmp
2014-08-21 17:27 . 2014-08-21 17:27	0	----a-w-	c:\windows\SysWow64\FAPDABD.tmp
2014-08-21 17:27 . 2014-08-21 17:27	0	----a-w-	c:\windows\SysWow64\FAPD233.tmp
2014-08-21 17:27 . 2014-08-21 17:27	0	----a-w-	c:\windows\SysWow64\FAP94C4.tmp
2014-08-21 17:27 . 2014-08-21 17:27	0	----a-w-	c:\windows\SysWow64\FAP8519.tmp
2014-08-21 17:25 . 2014-08-21 17:25	0	----a-w-	c:\windows\SysWow64\FAP5E94.tmp
2014-08-21 17:20 . 2014-08-21 17:20	0	----a-w-	c:\windows\SysWow64\FAP162D.tmp
2014-08-21 17:20 . 2014-08-21 17:20	0	----a-w-	c:\windows\SysWow64\FAPD45.tmp
2014-08-21 17:19 . 2014-08-21 17:19	0	----a-w-	c:\windows\SysWow64\FAPA196.tmp
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-14 15:33 . 2014-04-15 14:03	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-12 01:00 . 2014-04-15 14:16	101694776	----a-w-	c:\windows\system32\MRT.exe
2014-08-20 08:13 . 2014-04-15 14:53	699568	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-08-20 08:13 . 2014-04-15 14:53	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-08-10 18:39 . 2014-08-10 18:39	88480	----a-w-	c:\windows\system32\drivers\atksgt.sys
2014-08-10 18:39 . 2014-08-10 18:39	46400	----a-w-	c:\windows\system32\drivers\lirsgt.sys
2014-08-05 07:20 . 2010-11-21 03:27	270496	------w-	c:\windows\system32\MpSigStub.exe
2014-07-25 00:35 . 2014-07-25 00:35	875688	----a-w-	c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47	869544	----a-w-	c:\windows\system32\msvcr120_clr0400.dll
2014-07-16 03:23 . 2014-08-14 08:03	2048	----a-w-	c:\windows\system32\tzres.dll
2014-07-16 02:46 . 2014-08-14 08:03	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-07-14 10:56 . 2014-07-14 10:56	111016	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2014-07-14 10:56 . 2014-07-14 10:56	313256	----a-w-	c:\windows\system32\javaws.exe
2014-07-14 10:56 . 2014-07-14 10:56	189352	----a-w-	c:\windows\system32\javaw.exe
2014-07-14 10:56 . 2014-07-14 10:56	189352	----a-w-	c:\windows\system32\java.exe
2014-07-14 02:02 . 2014-08-14 08:03	1216000	----a-w-	c:\windows\system32\rpcrt4.dll
2014-07-14 01:40 . 2014-08-14 08:03	664064	----a-w-	c:\windows\SysWow64\rpcrt4.dll
2014-07-09 14:30 . 2014-07-09 14:30	5659136	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-07-09 02:03 . 2014-08-14 08:03	7168	----a-w-	c:\windows\system32\KBDYAK.DLL
2014-07-09 02:03 . 2014-08-14 08:03	7168	----a-w-	c:\windows\system32\KBDTAT.DLL
2014-07-09 02:03 . 2014-08-14 08:03	7168	----a-w-	c:\windows\system32\KBDRU1.DLL
2014-07-09 02:03 . 2014-08-14 08:03	6656	----a-w-	c:\windows\system32\KBDRU.DLL
2014-07-09 02:03 . 2014-08-14 08:03	7168	----a-w-	c:\windows\system32\KBDBASH.DLL
2014-07-09 01:31 . 2014-08-14 08:03	7168	----a-w-	c:\windows\SysWow64\KBDYAK.DLL
2014-07-09 01:31 . 2014-08-14 08:03	6656	----a-w-	c:\windows\SysWow64\KBDBASH.DLL
2014-06-30 22:24 . 2014-08-15 01:00	8856	----a-w-	c:\windows\system32\icardres.dll
2014-06-30 22:14 . 2014-08-15 01:00	8856	----a-w-	c:\windows\SysWow64\icardres.dll
2014-06-28 09:38 . 2012-07-17 12:37	23264	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-06-25 02:05 . 2014-08-14 08:03	14175744	----a-w-	c:\windows\system32\shell32.dll
2014-06-18 02:18 . 2014-07-09 09:58	692736	----a-w-	c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-09 09:58	646144	----a-w-	c:\windows\SysWow64\osk.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-21 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[-] 2014-04-15 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
[-] 2014-04-15 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-21 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2013-04-26 292848]
"SDTray"="d:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2014-06-24 4101576]
"LogMeIn Hamachi Ui"="d:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2014-09-04 3802448]
"AvastUI.exe"="c:\program files\AVAST Software\AvastUI.exe" [2014-09-14 4086432]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0sdnclean64.exe\0aswBoot.exe /M:393cdb77 /wow /dir:C:\Program
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
R2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;d:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;d:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
R2 MBAMService;MBAMService;d:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;d:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.20);c:\windows\system32\DRIVERS\RtTeam620.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam620.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;tsusbhub [x]
R4 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe;c:\program files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [x]
R4 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:\spiele\SteamLibrary\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe;d:\spiele\SteamLibrary\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;d:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;d:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;d:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;d:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;d:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;d:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;d:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - ASWHWID
*NewlyCreated* - ASWMONFLT
*NewlyCreated* - ASWRDR
*NewlyCreated* - ASWSNX
*NewlyCreated* - ASWSTM
*NewlyCreated* - ASWVMM
*NewlyCreated* - EGZNXDSN
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-15 08:13]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-09-14 15:34	634872	----a-w-	c:\program files\AVAST Software\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-05-24 165872]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-05-24 407536]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-05-24 444400]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2013-08-07 36352]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-05-29 2352072]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-05-29 1279480]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2014-05-14 7575768]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = localhost:21320
LSP: %SystemRoot%\system32\PrxerDrv.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default\
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Notify-SDWinLogon - SDWinLogon.dll
AddRemove-{D0087539-3C57-44E0-BEE7-D779D546CBE1} - c:\program files\InstallShield Installation Information\{D0087539-3C57-44E0-BEE7-D779D546CBE1}\Sims3SP09Setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-09-14  17:43:56
ComboFix-quarantined-files.txt  2014-09-14 15:43
.
Vor Suchlauf: 10 Verzeichnis(se), 71.891.533.824 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 71.822.262.272 Bytes frei
.
- - End Of File - - D50EE01B169EBA4B387C5578A7685620
--- --- ---
A36C5E4F47E84449FF07ED3517B43A31

Alt 14.09.2014, 16:51   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 14.09.2014, 17:10   #9
Hjalfnar
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.310 - Report created 14/09/2014 at 17:59:39
# Updated 12/09/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Hjalfnar - HJALFNAR-PC
# Running from : C:\Users\Hjalfnar\Downloads\AdwCleaner_3.310.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Windows\assembly\GAC_MSIL\QuickStoresToolbar
Folder Deleted : C:\Program Files (x86)\Mozilla Firefox\Extensions\quickstores@quickstores.de
File Deleted : C:\Users\Hjalfnar\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{22511E2E-7970-414E-BC7C-28D16C4AF54D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{23C5311E-016D-4999-BCB1-499898429D6C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{5180FE16-2E09-497B-9C8B-5A6F029ECECB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{ED0D2C81-7DB5-4599-B7C0-1033418B5672}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Deleted : HKCU\Software\OCS

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17280


-\\ Mozilla Firefox v32.0.1 (x86 de)

[ File : C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [2783 octets] - [14/09/2014 17:58:26]
AdwCleaner[S0].txt - [2643 octets] - [14/09/2014 17:59:39]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2703 octets] ##########
--- --- ---JRT Logfile:
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by Hjalfnar on 14.09.2014 at 18:01:55,72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Hjalfnar\AppData\Roaming\mozilla\firefox\profiles\pndtqmn4.default\minidumps [36 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.09.2014 at 18:05:42,12
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- --- ---



FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Hjalfnar (administrator) on HJALFNAR-PC on 14-09-2014 18:07:28
Running from C:\Users\Hjalfnar\Desktop
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Englisch (USA)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(LogMeIn, Inc.) D:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Safer-Networking Ltd.) D:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(AVAST Software) C:\Program Files\AVAST Software\avastui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2352072 2014-05-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7575768 2014-05-14] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [SDTray] => D:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3802448 2014-09-04] (LogMeIn Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\AvastUI.exe [4085896 2014-09-14] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exeaswBoot.exe /M:393cdb77 /wow /dir:C:\Program

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: localhost:21320
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xCAE8E5A9A858CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Winsock: Catalog5 09 C:\Windows\SysWOW64\PrxerNsp.dll [56424] ()
Winsock: Catalog5-x64 09 %SystemRoot%\system32\PrxerNsp.dll [57448] ()

FireFox:
========
FF ProfilePath: C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Deutsch (DE) Language Pack - C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default\Extensions\langpack-de@firefox.mozilla.org.xpi [2014-06-20]
FF Extension: English (GB) Language Pack - C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default\Extensions\langpack-en-GB@firefox.mozilla.org.xpi [2014-06-20]
FF Extension: Adblock Plus - C:\Users\Hjalfnar\AppData\Roaming\Mozilla\Firefox\Profiles\pndtqmn4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-16]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\WebRep\FF [2014-09-14]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\WebRep\Chrome\aswWebRepChrome.crx [2014-09-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-05-07] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\AvastSvc.exe [50344 2014-09-14] (AVAST Software)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
S4 DAUpdaterSvc; D:\Spiele\SteamLibrary\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2014-07-01] (BioWare)
R2 Hamachi2Svc; D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2525008 2014-09-04] (LogMeIn Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 MBAMScheduler; D:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; D:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1631008 2014-05-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21055432 2014-05-30] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-05-31] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2014-05-31] ()
R2 SDScannerService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; D:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 TunngleService; D:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-09-14] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-09-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-09-14] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-09-14] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-09-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-09-14] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-09-14] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-09-14] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2014-08-10] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-15] (Disc Soft Ltd)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2014-08-10] ()
R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [91352 2014-05-12] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-05-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 RTTEAMPT; C:\Windows\System32\DRIVERS\RtTeam620.sys [58512 2012-07-03] (Realtek Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-14 18:05 - 2014-09-14 18:05 - 00000759 _____ () C:\Users\Hjalfnar\Desktop\JRT.txt
2014-09-14 18:01 - 2014-09-14 18:01 - 01016261 _____ (Thisisu) C:\Users\Hjalfnar\Downloads\JRT.exe
2014-09-14 18:01 - 2014-09-14 18:01 - 00000000 ____D () C:\Windows\ERUNT
2014-09-14 17:58 - 2014-09-14 17:59 - 00000000 ____D () C:\AdwCleaner
2014-09-14 17:57 - 2014-09-14 17:57 - 01373475 _____ () C:\Users\Hjalfnar\Downloads\AdwCleaner_3.310.exe
2014-09-14 17:43 - 2014-09-14 17:43 - 00025504 _____ () C:\ComboFix.txt
2014-09-14 17:37 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-14 17:37 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-14 17:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-14 17:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-14 17:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-14 17:37 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-14 17:37 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-14 17:37 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-14 17:35 - 2014-09-14 17:35 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-09-14 17:35 - 2014-09-14 17:35 - 00004170 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-09-14 17:35 - 2014-09-14 17:35 - 00001848 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-09-14 17:35 - 2014-09-14 17:35 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\AVAST Software
2014-09-14 17:35 - 2014-09-14 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-09-14 17:35 - 2014-09-14 17:34 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-09-14 17:35 - 2014-09-14 17:34 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-09-14 17:35 - 2014-09-14 17:34 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-09-14 17:35 - 2014-09-14 17:34 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-09-14 17:35 - 2014-09-14 17:34 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-09-14 17:35 - 2014-09-14 17:34 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-09-14 17:35 - 2014-09-14 17:34 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-09-14 17:35 - 2014-09-14 17:34 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-09-14 17:34 - 2014-09-14 17:34 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-09-14 17:32 - 2014-09-14 18:00 - 00001098 _____ () C:\Windows\PFRO.log
2014-09-14 17:28 - 2014-09-14 18:00 - 00000000 ____D () C:\Program Files\AVAST Software
2014-09-14 17:15 - 2014-09-14 17:28 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-09-14 17:10 - 2014-09-14 17:11 - 91906368 _____ (AVAST Software) C:\Users\Public\Desktop\avast_free_antivirus_setup_9_0_2021.exe
2014-09-14 17:10 - 2014-09-14 17:11 - 91906368 _____ (AVAST Software) C:\Users\Hjalfnar\Downloads\avast_free_antivirus_setup_9_0_2021.exe
2014-09-14 16:48 - 2014-09-14 17:43 - 00000000 ____D () C:\Qoobox
2014-09-14 16:48 - 2014-09-14 17:42 - 00000000 ____D () C:\Windows\erdnt
2014-09-14 16:47 - 2014-09-14 16:47 - 05577449 ____R (Swearware) C:\Users\Hjalfnar\Downloads\ComboFix.exe
2014-09-14 16:32 - 2014-09-14 16:32 - 00008908 _____ () C:\Users\Hjalfnar\Desktop\Addition.zip
2014-09-14 16:25 - 2014-09-14 16:25 - 00001290 _____ () C:\Users\Hjalfnar\Desktop\GMER.zip
2014-09-14 16:04 - 2014-09-14 16:04 - 00000000 ____D () C:\Users\Hjalfnar\Documents\ProcAlyzer Dumps
2014-09-14 15:47 - 2014-09-14 15:47 - 00380416 _____ () C:\Users\Hjalfnar\Downloads\30gyot8r.exe
2014-09-14 15:45 - 2014-09-14 18:07 - 00015138 _____ () C:\Users\Hjalfnar\Desktop\FRST.txt
2014-09-14 15:42 - 2014-09-14 15:42 - 00000000 _____ () C:\Users\Hjalfnar\defogger_reenable
2014-09-14 15:41 - 2014-09-14 15:41 - 00050477 _____ () C:\Users\Hjalfnar\Desktop\Defogger.exe
2014-09-14 15:40 - 2014-09-14 18:07 - 00000000 ____D () C:\FRST
2014-09-14 15:39 - 2014-09-14 15:39 - 02105856 _____ (Farbar) C:\Users\Hjalfnar\Desktop\FRST64.exe
2014-09-14 10:07 - 2014-07-18 06:11 - 00450709 _____ () C:\Windows\system32\Drivers\etc\hosts.20140914-100754.backup
2014-09-14 08:52 - 2014-09-14 18:00 - 00000840 _____ () C:\Windows\setupact.log
2014-09-14 08:52 - 2014-09-14 08:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-12 21:20 - 2014-09-12 21:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 03:03 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 03:03 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-12 03:03 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 03:03 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 03:03 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 03:03 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 03:03 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 03:03 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 03:03 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 03:03 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 03:03 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 03:03 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 03:03 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 03:03 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 03:03 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 03:03 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 03:03 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 03:03 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 03:03 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 03:03 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 03:03 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-12 03:03 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-12 03:03 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-12 03:03 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 03:03 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 03:03 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 03:03 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 03:03 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-12 03:03 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 03:03 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 03:03 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 03:03 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-12 03:03 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 03:03 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 03:03 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 03:03 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 03:03 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 03:03 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-12 03:03 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 03:03 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 03:03 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 03:03 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-12 03:03 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 03:03 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-12 03:02 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 03:02 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 03:02 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 03:02 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 03:02 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 03:02 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 03:02 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 03:02 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 03:02 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 03:02 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 03:02 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 03:02 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 03:00 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 03:00 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 09:59 - 2014-09-14 18:01 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\LogMeIn Hamachi
2014-09-11 09:59 - 2014-09-11 09:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-09-11 08:17 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 08:17 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 08:17 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 08:17 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 08:17 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 08:17 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 08:17 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 08:17 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 08:17 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 08:17 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 08:17 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-07 19:02 - 2014-09-07 19:02 - 00001049 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-07 19:02 - 2014-09-07 19:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-07 19:02 - 2011-02-18 15:07 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2014-09-05 16:03 - 2014-09-05 16:03 - 00000222 _____ () C:\Users\Hjalfnar\Desktop\Wargame AirLand Battle.url
2014-09-05 11:56 - 2014-09-05 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The SIMS 4 Deluxe Edition
2014-09-04 23:21 - 2014-09-04 23:21 - 00000000 ____D () C:\Users\Hjalfnar\Documents\Aspyr
2014-09-04 23:19 - 2014-09-04 23:19 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\Aspyr
2014-09-04 18:17 - 2014-09-04 18:17 - 00000839 _____ () C:\Users\Hjalfnar\Desktop\Panzer Corps Collection.lnk
2014-09-04 18:17 - 2014-09-04 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panzer Corps Collection
2014-09-04 14:59 - 2014-09-04 14:59 - 00000221 _____ () C:\Users\Hjalfnar\Desktop\Star Wars The Force Unleashed.url
2014-08-31 19:09 - 2014-08-31 19:09 - 00000222 _____ () C:\Users\Hjalfnar\Desktop\Panzer Corps.url
2014-08-29 16:56 - 2014-09-02 08:59 - 00000132 _____ () C:\Users\Hjalfnar\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-08-28 05:17 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 05:17 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 05:17 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 01:07 - 2014-08-22 01:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP6118.tmp
2014-08-22 01:07 - 2014-08-22 01:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP60C8.tmp
2014-08-22 00:58 - 2014-08-22 00:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D97.tmp
2014-08-22 00:57 - 2014-08-22 00:57 - 00000000 _____ () C:\Windows\SysWOW64\FAPAB4B.tmp
2014-08-22 00:57 - 2014-08-22 00:57 - 00000000 _____ () C:\Windows\SysWOW64\FAPA946.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP85AE.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP83A9.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP7861.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP543C.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPD46C.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPD277.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPC5F7.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPA324.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP84AA.tmp
2014-08-22 00:54 - 2014-08-22 00:54 - 00000000 _____ () C:\Windows\SysWOW64\FAPB6B9.tmp
2014-08-22 00:54 - 2014-08-22 00:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP9958.tmp
2014-08-22 00:43 - 2014-08-22 00:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP8C2C.tmp
2014-08-22 00:43 - 2014-08-22 00:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP8C0B.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAPA5B0.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAPA560.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6DDB.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6DAA.tmp
2014-08-22 00:30 - 2014-08-22 00:31 - 291175499 _____ () C:\Users\Hjalfnar\Downloads\_Divide_et_Impera095.7z
2014-08-22 00:30 - 2014-08-22 00:30 - 00000000 _____ () C:\Windows\SysWOW64\FAPD61A.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP6388.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP588E.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP421F.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP2856.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP2613.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAPDAFA.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAPD8D6.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAP1AAC.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAP1251.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPEB18.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPE72F.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPDB4B.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPD994.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPB965.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPB56D.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPAEB.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP953.tmp
2014-08-21 23:25 - 2014-08-21 23:25 - 00000000 _____ () C:\Windows\SysWOW64\FAPBBD1.tmp
2014-08-21 23:19 - 2014-08-21 23:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP3496.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9DC2.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9DA0.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D8F.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D6E.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPDCEB.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP5B7A.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP37D2.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP2C8A.tmp
2014-08-21 23:04 - 2014-08-21 23:04 - 00000000 _____ () C:\Windows\SysWOW64\FAPBCF4.tmp
2014-08-21 22:54 - 2014-08-21 22:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP3942.tmp
2014-08-21 22:54 - 2014-08-21 22:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP2025.tmp
2014-08-21 22:53 - 2014-08-21 22:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP3548.tmp
2014-08-21 22:51 - 2014-08-21 22:51 - 00000000 _____ () C:\Windows\SysWOW64\FAP32F5.tmp
2014-08-21 22:50 - 2014-08-21 22:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP30F1.tmp
2014-08-21 22:47 - 2014-08-21 22:47 - 00000000 _____ () C:\Windows\SysWOW64\FAPF288.tmp
2014-08-21 22:47 - 2014-08-21 22:47 - 00000000 _____ () C:\Windows\SysWOW64\FAPEB17.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAPF75C.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAPEEE2.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6B4B.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP63EA.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP20C1.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP1A59.tmp
2014-08-21 22:44 - 2014-08-21 22:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP692.tmp
2014-08-21 22:44 - 2014-08-21 22:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP16F9.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAPAF7C.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP9EF6.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CA3.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8603.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP85D2.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8553.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8438.tmp
2014-08-21 19:56 - 2014-08-21 19:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPC78C.tmp
2014-08-21 19:56 - 2014-08-21 19:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPC76B.tmp
2014-08-21 19:49 - 2014-08-21 19:49 - 00000000 _____ () C:\Windows\SysWOW64\FAP679D.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP786D.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP7649.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP75CA.tmp
2014-08-21 19:35 - 2014-08-21 19:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP9E2F.tmp
2014-08-21 19:30 - 2014-08-21 19:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP133D.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAPDABD.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAPD233.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP94C4.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP8519.tmp
2014-08-21 19:25 - 2014-08-21 19:25 - 00000000 _____ () C:\Windows\SysWOW64\FAP5E94.tmp
2014-08-21 19:20 - 2014-08-21 19:20 - 00000000 _____ () C:\Windows\SysWOW64\FAPD45.tmp
2014-08-21 19:20 - 2014-08-21 19:20 - 00000000 _____ () C:\Windows\SysWOW64\FAP162D.tmp
2014-08-21 19:19 - 2014-08-21 19:19 - 00000000 _____ () C:\Windows\SysWOW64\FAPA196.tmp
2014-08-21 19:19 - 2014-08-21 19:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FCF.tmp
2014-08-21 19:00 - 2014-08-21 19:00 - 00000000 _____ () C:\Windows\SysWOW64\FAP739F.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP322A.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP31EA.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP316B.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CE8.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CC7.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9B2F.tmp
2014-08-21 18:54 - 2014-08-21 18:54 - 00000000 _____ () C:\Windows\SysWOW64\FAPDC01.tmp
2014-08-21 18:54 - 2014-08-21 18:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP1636.tmp
2014-08-21 18:44 - 2014-08-21 18:44 - 00000000 _____ () C:\Windows\SysWOW64\FAPEDAB.tmp
2014-08-21 18:34 - 2014-08-21 18:34 - 00000000 _____ () C:\Windows\SysWOW64\FAPCFA.tmp
2014-08-21 18:34 - 2014-08-21 18:34 - 00000000 _____ () C:\Windows\SysWOW64\FAP1AF0.tmp
2014-08-21 18:33 - 2014-08-21 18:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPDC95.tmp
2014-08-21 18:32 - 2014-08-21 18:32 - 00000000 _____ () C:\Windows\SysWOW64\FAPEE8D.tmp
2014-08-21 18:31 - 2014-08-21 18:31 - 00000000 _____ () C:\Windows\SysWOW64\FAPEF37.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP8F88.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP8AD5.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP894D.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3B57.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3B16.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3866.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3806.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3066.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP712B.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6C59.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6AB1.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6A61.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP5D55.tmp
2014-08-21 14:39 - 2014-08-21 14:39 - 00000000 _____ () C:\Windows\SysWOW64\FAP2D00.tmp
2014-08-21 14:36 - 2014-08-21 14:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP4CEC.tmp
2014-08-21 14:35 - 2014-08-21 14:35 - 00000000 _____ () C:\Windows\SysWOW64\FAPDF79.tmp
2014-08-21 14:35 - 2014-08-21 14:35 - 00000000 _____ () C:\Windows\SysWOW64\FAPBA5A.tmp
2014-08-21 14:33 - 2014-08-21 14:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPB385.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP313A.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP2E1C.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP2D6F.tmp
2014-08-21 14:29 - 2014-08-21 14:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4C33.tmp
2014-08-21 14:29 - 2014-08-21 14:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4667.tmp
2014-08-21 14:18 - 2014-08-21 14:18 - 00000000 _____ () C:\Windows\SysWOW64\FAPA8AF.tmp
2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 _____ () C:\Windows\SysWOW64\FAPC80F.tmp
2014-08-21 13:40 - 2014-08-21 13:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP8F32.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP615C.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP613B.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP60FB.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP172D.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP16FC.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP168D.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP6076.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP6035.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP5FD6.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA50.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA00.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPD8D5.tmp
2014-08-21 12:35 - 2014-08-21 12:35 - 00000000 ____D () C:\Users\Hjalfnar\Downloads\Warhammer 40K - 7th Edition - Codex Space Wolves
2014-08-21 12:34 - 2014-08-21 12:34 - 00000000 _____ () C:\Windows\SysWOW64\FAP3248.tmp
2014-08-21 12:33 - 2014-08-21 12:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPE9D1.tmp
2014-08-21 12:26 - 2014-08-21 12:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP38D8.tmp
2014-08-21 12:25 - 2014-08-21 12:25 - 00000000 _____ () C:\Windows\SysWOW64\FAP770E.tmp
2014-08-21 11:52 - 2014-08-21 11:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPEEAA.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPE8EE.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPE5D0.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPC498.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPC052.tmp
2014-08-21 10:39 - 2014-08-21 10:39 - 00000000 _____ () C:\Windows\SysWOW64\FAPDD60.tmp
2014-08-21 10:39 - 2014-08-21 10:39 - 00000000 _____ () C:\Windows\SysWOW64\FAPDD4F.tmp
2014-08-21 10:36 - 2014-08-21 10:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP5B80.tmp
2014-08-21 10:36 - 2014-08-21 10:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP5AF2.tmp
2014-08-21 10:28 - 2014-08-21 10:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP9BE6.tmp
2014-08-21 10:28 - 2014-08-21 10:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP712C.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAPED99.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAPEC9E.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP54B1.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP46F9.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3F39.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E7C.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3086.tmp
2014-08-21 10:25 - 2014-08-21 10:25 - 00000000 _____ () C:\Windows\SysWOW64\FAPE300.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP96CA.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP96B8.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP9697.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP9685.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD984.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD972.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD960.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPC938.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP30BF.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP30AE.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP309C.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP307B.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPD459.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPD274.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAP63DF.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAP1052.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FDD.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89DC.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89DA.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89B9.tmp
2014-08-21 01:03 - 2014-08-21 01:03 - 00000000 _____ () C:\Windows\SysWOW64\FAPC454.tmp
2014-08-20 22:58 - 2014-08-20 22:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP795C.tmp
2014-08-20 22:58 - 2014-08-20 22:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP793B.tmp
2014-08-20 22:29 - 2014-08-20 22:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4656.tmp
2014-08-20 22:28 - 2014-08-20 22:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP92AF.tmp
2014-08-20 22:28 - 2014-08-20 22:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP9156.tmp
2014-08-20 22:27 - 2014-08-20 22:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP9817.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPE931.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPDB98.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPCF47.tmp
2014-08-20 22:19 - 2014-08-20 22:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP4416.tmp
2014-08-20 22:19 - 2014-08-20 22:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP3F82.tmp
2014-08-20 22:09 - 2014-08-20 22:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPE060.tmp
2014-08-20 22:09 - 2014-08-20 22:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPD7C7.tmp
2014-08-20 22:05 - 2014-08-20 22:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPFA61.tmp
2014-08-20 22:05 - 2014-08-20 22:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPEE9D.tmp
2014-08-20 22:02 - 2014-08-20 22:02 - 00000000 _____ () C:\Windows\SysWOW64\FAP2C17.tmp
2014-08-20 21:53 - 2014-08-20 21:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP6FB9.tmp
2014-08-20 21:53 - 2014-08-20 21:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP6EAE.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPED3B.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPEC9D.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPEA1C.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPE9DB.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPE364.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPDCAE.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7CA2.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C52.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C02.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP799F.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP794F.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP71EE.tmp
2014-08-20 20:09 - 2014-08-20 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPED90.tmp
2014-08-20 20:08 - 2014-08-20 20:08 - 00000000 _____ () C:\Windows\SysWOW64\FAP8338.tmp
2014-08-20 20:08 - 2014-08-20 20:08 - 00000000 _____ () C:\Windows\SysWOW64\FAP2204.tmp
2014-08-20 17:45 - 2014-08-20 17:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP77CC.tmp
2014-08-20 17:45 - 2014-08-20 17:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP6100.tmp
2014-08-20 17:44 - 2014-08-20 17:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP1FF9.tmp
2014-08-20 17:37 - 2014-08-20 17:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPECA7.tmp
2014-08-20 16:35 - 2014-08-20 16:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP3EE8.tmp
2014-08-20 14:57 - 2014-08-20 14:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP4F0A.tmp
2014-08-20 14:57 - 2014-08-20 14:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP4E7C.tmp
2014-08-20 13:09 - 2014-08-20 13:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP7308.tmp
2014-08-20 13:09 - 2014-08-20 13:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP72B8.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPEFC1.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPE1CB.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPE18A.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA48.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPD47C.tmp
2014-08-20 12:51 - 2014-08-20 12:51 - 00000000 _____ () C:\Windows\SysWOW64\FAP9BBE.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP86C6.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP8676.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP7F33.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP7BC8.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP79A4.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP77ED.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP77BC.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6FCE.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6956.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPB9A5.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPA50B.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPA4DA.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FF8.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP9971.tmp
2014-08-20 11:59 - 2014-08-20 11:59 - 00000000 _____ () C:\Windows\SysWOW64\FAP2B.tmp
2014-08-20 11:57 - 2014-08-20 11:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP8733.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPDBC6.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD2AF.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD26F.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPCD01.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPC522.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPDAA.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPD5A.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP4779.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E82.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E41.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP37BA.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP1672.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAPFB4.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP1C27.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP1004.tmp
2014-08-20 11:32 - 2014-08-20 11:32 - 00000000 _____ () C:\Windows\SysWOW64\FAPCDC3.tmp
2014-08-20 11:30 - 2014-08-20 11:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP2AFD.tmp
2014-08-20 11:07 - 2014-08-20 11:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP95FC.tmp
2014-08-20 10:47 - 2014-08-23 13:55 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\Adobe
2014-08-19 00:11 - 2014-08-19 00:11 - 03689799 _____ () C:\Users\Hjalfnar\Desktop\OnlineCodexWH40K_Testversion_7.jar
2014-08-15 03:00 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-15 03:00 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-15 03:00 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 03:00 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-15 03:00 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-15 03:00 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-15 03:00 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-15 03:00 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-14 18:07 - 2014-09-14 15:45 - 00015138 _____ () C:\Users\Hjalfnar\Desktop\FRST.txt
2014-09-14 18:07 - 2014-09-14 15:40 - 00000000 ____D () C:\FRST
2014-09-14 18:06 - 2014-04-15 16:09 - 00698294 _____ () C:\Windows\system32\perfh007.dat
2014-09-14 18:06 - 2014-04-15 16:09 - 00149760 _____ () C:\Windows\system32\perfc007.dat
2014-09-14 18:06 - 2009-07-14 07:13 - 01624034 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-14 18:05 - 2014-09-14 18:05 - 00000759 _____ () C:\Users\Hjalfnar\Desktop\JRT.txt
2014-09-14 18:01 - 2014-09-14 18:01 - 01016261 _____ (Thisisu) C:\Users\Hjalfnar\Downloads\JRT.exe
2014-09-14 18:01 - 2014-09-14 18:01 - 00000000 ____D () C:\Windows\ERUNT
2014-09-14 18:01 - 2014-09-11 09:59 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\LogMeIn Hamachi
2014-09-14 18:00 - 2014-09-14 17:32 - 00001098 _____ () C:\Windows\PFRO.log
2014-09-14 18:00 - 2014-09-14 17:28 - 00000000 ____D () C:\Program Files\AVAST Software
2014-09-14 18:00 - 2014-09-14 08:52 - 00000840 _____ () C:\Windows\setupact.log
2014-09-14 18:00 - 2014-04-15 16:03 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-14 18:00 - 2014-04-15 15:33 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-14 18:00 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-14 17:59 - 2014-09-14 17:58 - 00000000 ____D () C:\AdwCleaner
2014-09-14 17:59 - 2014-07-17 06:28 - 01878239 _____ () C:\Windows\WindowsUpdate.log
2014-09-14 17:57 - 2014-09-14 17:57 - 01373475 _____ () C:\Users\Hjalfnar\Downloads\AdwCleaner_3.310.exe
2014-09-14 17:57 - 2014-04-15 15:26 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\Skype
2014-09-14 17:43 - 2014-09-14 17:43 - 00025504 _____ () C:\ComboFix.txt
2014-09-14 17:43 - 2014-09-14 16:48 - 00000000 ____D () C:\Qoobox
2014-09-14 17:43 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-14 17:42 - 2014-09-14 16:48 - 00000000 ____D () C:\Windows\erdnt
2014-09-14 17:42 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-14 17:36 - 2014-05-30 15:08 - 00000000 ___HD () C:\Users\Hjalfnar\AppData\Roaming\Origin
2014-09-14 17:35 - 2014-09-14 17:35 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-09-14 17:35 - 2014-09-14 17:35 - 00004170 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-09-14 17:35 - 2014-09-14 17:35 - 00001848 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-09-14 17:35 - 2014-09-14 17:35 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\AVAST Software
2014-09-14 17:35 - 2014-09-14 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-09-14 17:34 - 2014-09-14 17:35 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-09-14 17:34 - 2014-09-14 17:35 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-09-14 17:34 - 2014-09-14 17:35 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-09-14 17:34 - 2014-09-14 17:35 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-09-14 17:34 - 2014-09-14 17:35 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-09-14 17:34 - 2014-09-14 17:35 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-09-14 17:34 - 2014-09-14 17:35 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-09-14 17:34 - 2014-09-14 17:35 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-09-14 17:34 - 2014-09-14 17:34 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-09-14 17:30 - 2014-04-15 16:53 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-14 17:28 - 2014-09-14 17:15 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-09-14 17:15 - 2014-04-15 14:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-14 17:15 - 2014-04-15 14:50 - 00000000 ____D () C:\ProgramData\Avira
2014-09-14 17:11 - 2014-09-14 17:10 - 91906368 _____ (AVAST Software) C:\Users\Public\Desktop\avast_free_antivirus_setup_9_0_2021.exe
2014-09-14 17:11 - 2014-09-14 17:10 - 91906368 _____ (AVAST Software) C:\Users\Hjalfnar\Downloads\avast_free_antivirus_setup_9_0_2021.exe
2014-09-14 16:47 - 2014-09-14 16:47 - 05577449 ____R (Swearware) C:\Users\Hjalfnar\Downloads\ComboFix.exe
2014-09-14 16:32 - 2014-09-14 16:32 - 00008908 _____ () C:\Users\Hjalfnar\Desktop\Addition.zip
2014-09-14 16:25 - 2014-09-14 16:25 - 00001290 _____ () C:\Users\Hjalfnar\Desktop\GMER.zip
2014-09-14 16:04 - 2014-09-14 16:04 - 00000000 ____D () C:\Users\Hjalfnar\Documents\ProcAlyzer Dumps
2014-09-14 15:47 - 2014-09-14 15:47 - 00380416 _____ () C:\Users\Hjalfnar\Downloads\30gyot8r.exe
2014-09-14 15:42 - 2014-09-14 15:42 - 00000000 _____ () C:\Users\Hjalfnar\defogger_reenable
2014-09-14 15:42 - 2014-04-15 14:17 - 00000000 ____D () C:\Users\Hjalfnar
2014-09-14 15:41 - 2014-09-14 15:41 - 00050477 _____ () C:\Users\Hjalfnar\Desktop\Defogger.exe
2014-09-14 15:39 - 2014-09-14 15:39 - 02105856 _____ (Farbar) C:\Users\Hjalfnar\Desktop\FRST64.exe
2014-09-14 12:40 - 2014-04-15 16:31 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-14 09:14 - 2014-04-15 19:04 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\uTorrent
2014-09-14 09:06 - 2014-08-09 09:25 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\FileAdvisor
2014-09-14 09:06 - 2014-08-08 09:06 - 00000000 ____D () C:\Program Files (x86)\File Type Advisor
2014-09-14 09:03 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-14 08:52 - 2014-09-14 08:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-14 08:52 - 2014-04-15 14:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-14 01:02 - 2014-04-15 16:01 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\DAEMON Tools Lite
2014-09-14 00:58 - 2014-04-16 21:41 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\TS3Client
2014-09-14 00:04 - 2009-07-14 06:45 - 00025936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-14 00:04 - 2009-07-14 06:45 - 00025936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-12 21:20 - 2014-09-12 21:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-12 03:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-12 03:02 - 2014-04-15 16:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 03:02 - 2014-04-15 14:33 - 01594886 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 03:00 - 2014-05-07 00:57 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-12 03:00 - 2014-04-15 16:16 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-11 09:59 - 2014-09-11 09:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-09-11 09:55 - 2014-06-20 18:52 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Roaming\Tunngle
2014-09-11 09:55 - 2014-06-20 18:52 - 00000000 ____D () C:\ProgramData\Tunngle
2014-09-11 09:50 - 2014-06-20 21:10 - 00000000 _____ () C:\Windows\SysWOW64\Access.dat
2014-09-09 22:22 - 2014-05-30 15:07 - 00000000 ____D () C:\ProgramData\Origin
2014-09-07 19:04 - 2014-04-17 17:45 - 00000000 ____D () C:\Users\Hjalfnar\Documents\Electronic Arts
2014-09-07 19:02 - 2014-09-07 19:02 - 00001049 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-09-07 19:02 - 2014-09-07 19:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-09-06 23:04 - 2014-04-15 15:56 - 00000000 ____D () C:\Spiele
2014-09-05 16:46 - 2014-04-15 14:48 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-05 16:03 - 2014-09-05 16:03 - 00000222 _____ () C:\Users\Hjalfnar\Desktop\Wargame AirLand Battle.url
2014-09-05 11:56 - 2014-09-05 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The SIMS 4 Deluxe Edition
2014-09-05 04:10 - 2014-09-11 08:17 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-11 08:17 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-04 23:21 - 2014-09-04 23:21 - 00000000 ____D () C:\Users\Hjalfnar\Documents\Aspyr
2014-09-04 23:19 - 2014-09-04 23:19 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\Aspyr
2014-09-04 18:17 - 2014-09-04 18:17 - 00000839 _____ () C:\Users\Hjalfnar\Desktop\Panzer Corps Collection.lnk
2014-09-04 18:17 - 2014-09-04 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panzer Corps Collection
2014-09-04 18:17 - 2014-04-15 22:57 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-09-04 14:59 - 2014-09-04 14:59 - 00000221 _____ () C:\Users\Hjalfnar\Desktop\Star Wars The Force Unleashed.url
2014-09-02 08:59 - 2014-08-29 16:56 - 00000132 _____ () C:\Users\Hjalfnar\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-08-31 19:28 - 2014-04-15 18:01 - 00000000 ____D () C:\Users\Hjalfnar\Documents\My Games
2014-08-31 19:09 - 2014-08-31 19:09 - 00000222 _____ () C:\Users\Hjalfnar\Desktop\Panzer Corps.url
2014-08-29 07:55 - 2009-07-14 06:45 - 04890344 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-23 13:55 - 2014-08-20 10:47 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\Adobe
2014-08-23 04:07 - 2014-08-28 05:17 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 05:17 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 05:17 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 08:31 - 2014-07-16 09:00 - 00000000 ____D () C:\Users\Hjalfnar\AppData\Local\2K Games
2014-08-22 01:07 - 2014-08-22 01:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP6118.tmp
2014-08-22 01:07 - 2014-08-22 01:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP60C8.tmp
2014-08-22 00:58 - 2014-08-22 00:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D97.tmp
2014-08-22 00:57 - 2014-08-22 00:57 - 00000000 _____ () C:\Windows\SysWOW64\FAPAB4B.tmp
2014-08-22 00:57 - 2014-08-22 00:57 - 00000000 _____ () C:\Windows\SysWOW64\FAPA946.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP85AE.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP83A9.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP7861.tmp
2014-08-22 00:56 - 2014-08-22 00:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP543C.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPD46C.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPD277.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPC5F7.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAPA324.tmp
2014-08-22 00:55 - 2014-08-22 00:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP84AA.tmp
2014-08-22 00:54 - 2014-08-22 00:54 - 00000000 _____ () C:\Windows\SysWOW64\FAPB6B9.tmp
2014-08-22 00:54 - 2014-08-22 00:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP9958.tmp
2014-08-22 00:43 - 2014-08-22 00:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP8C2C.tmp
2014-08-22 00:43 - 2014-08-22 00:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP8C0B.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAPA5B0.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAPA560.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6DDB.tmp
2014-08-22 00:40 - 2014-08-22 00:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6DAA.tmp
2014-08-22 00:31 - 2014-08-22 00:30 - 291175499 _____ () C:\Users\Hjalfnar\Downloads\_Divide_et_Impera095.7z
2014-08-22 00:30 - 2014-08-22 00:30 - 00000000 _____ () C:\Windows\SysWOW64\FAPD61A.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP6388.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP588E.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP421F.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP2856.tmp
2014-08-22 00:27 - 2014-08-22 00:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP2613.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAPDAFA.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAPD8D6.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAP1AAC.tmp
2014-08-22 00:22 - 2014-08-22 00:22 - 00000000 _____ () C:\Windows\SysWOW64\FAP1251.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPEB18.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPE72F.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPDB4B.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPD994.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPB965.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPB56D.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPAEB.tmp
2014-08-21 23:56 - 2014-08-21 23:56 - 00000000 _____ () C:\Windows\SysWOW64\FAP953.tmp
2014-08-21 23:25 - 2014-08-21 23:25 - 00000000 _____ () C:\Windows\SysWOW64\FAPBBD1.tmp
2014-08-21 23:19 - 2014-08-21 23:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP3496.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9DC2.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9DA0.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D8F.tmp
2014-08-21 23:10 - 2014-08-21 23:10 - 00000000 _____ () C:\Windows\SysWOW64\FAP9D6E.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPDCEB.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP5B7A.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP37D2.tmp
2014-08-21 23:05 - 2014-08-21 23:05 - 00000000 _____ () C:\Windows\SysWOW64\FAP2C8A.tmp
2014-08-21 23:04 - 2014-08-21 23:04 - 00000000 _____ () C:\Windows\SysWOW64\FAPBCF4.tmp
2014-08-21 22:54 - 2014-08-21 22:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP3942.tmp
2014-08-21 22:54 - 2014-08-21 22:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP2025.tmp
2014-08-21 22:53 - 2014-08-21 22:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP3548.tmp
2014-08-21 22:51 - 2014-08-21 22:51 - 00000000 _____ () C:\Windows\SysWOW64\FAP32F5.tmp
2014-08-21 22:50 - 2014-08-21 22:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP30F1.tmp
2014-08-21 22:47 - 2014-08-21 22:47 - 00000000 _____ () C:\Windows\SysWOW64\FAPF288.tmp
2014-08-21 22:47 - 2014-08-21 22:47 - 00000000 _____ () C:\Windows\SysWOW64\FAPEB17.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAPF75C.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAPEEE2.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6B4B.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP63EA.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP20C1.tmp
2014-08-21 22:46 - 2014-08-21 22:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP1A59.tmp
2014-08-21 22:44 - 2014-08-21 22:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP692.tmp
2014-08-21 22:44 - 2014-08-21 22:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP16F9.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAPAF7C.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP9EF6.tmp
2014-08-21 22:43 - 2014-08-21 22:43 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CA3.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8603.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP85D2.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8553.tmp
2014-08-21 20:09 - 2014-08-21 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP8438.tmp
2014-08-21 19:56 - 2014-08-21 19:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPC78C.tmp
2014-08-21 19:56 - 2014-08-21 19:56 - 00000000 _____ () C:\Windows\SysWOW64\FAPC76B.tmp
2014-08-21 19:49 - 2014-08-21 19:49 - 00000000 _____ () C:\Windows\SysWOW64\FAP679D.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP786D.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP7649.tmp
2014-08-21 19:41 - 2014-08-21 19:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP75CA.tmp
2014-08-21 19:35 - 2014-08-21 19:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP9E2F.tmp
2014-08-21 19:30 - 2014-08-21 19:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP133D.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAPDABD.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAPD233.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP94C4.tmp
2014-08-21 19:27 - 2014-08-21 19:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP8519.tmp
2014-08-21 19:25 - 2014-08-21 19:25 - 00000000 _____ () C:\Windows\SysWOW64\FAP5E94.tmp
2014-08-21 19:20 - 2014-08-21 19:20 - 00000000 _____ () C:\Windows\SysWOW64\FAPD45.tmp
2014-08-21 19:20 - 2014-08-21 19:20 - 00000000 _____ () C:\Windows\SysWOW64\FAP162D.tmp
2014-08-21 19:19 - 2014-08-21 19:19 - 00000000 _____ () C:\Windows\SysWOW64\FAPA196.tmp
2014-08-21 19:19 - 2014-08-21 19:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FCF.tmp
2014-08-21 19:00 - 2014-08-21 19:00 - 00000000 _____ () C:\Windows\SysWOW64\FAP739F.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP322A.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP31EA.tmp
2014-08-21 18:58 - 2014-08-21 18:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP316B.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CE8.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9CC7.tmp
2014-08-21 18:55 - 2014-08-21 18:55 - 00000000 _____ () C:\Windows\SysWOW64\FAP9B2F.tmp
2014-08-21 18:54 - 2014-08-21 18:54 - 00000000 _____ () C:\Windows\SysWOW64\FAPDC01.tmp
2014-08-21 18:54 - 2014-08-21 18:54 - 00000000 _____ () C:\Windows\SysWOW64\FAP1636.tmp
2014-08-21 18:44 - 2014-08-21 18:44 - 00000000 _____ () C:\Windows\SysWOW64\FAPEDAB.tmp
2014-08-21 18:34 - 2014-08-21 18:34 - 00000000 _____ () C:\Windows\SysWOW64\FAPCFA.tmp
2014-08-21 18:34 - 2014-08-21 18:34 - 00000000 _____ () C:\Windows\SysWOW64\FAP1AF0.tmp
2014-08-21 18:33 - 2014-08-21 18:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPDC95.tmp
2014-08-21 18:32 - 2014-08-21 18:32 - 00000000 _____ () C:\Windows\SysWOW64\FAPEE8D.tmp
2014-08-21 18:31 - 2014-08-21 18:31 - 00000000 _____ () C:\Windows\SysWOW64\FAPEF37.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP8F88.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP8AD5.tmp
2014-08-21 18:30 - 2014-08-21 18:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP894D.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3B57.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3B16.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3866.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3806.tmp
2014-08-21 14:46 - 2014-08-21 14:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP3066.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP712B.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6C59.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6AB1.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP6A61.tmp
2014-08-21 14:40 - 2014-08-21 14:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP5D55.tmp
2014-08-21 14:39 - 2014-08-21 14:39 - 00000000 _____ () C:\Windows\SysWOW64\FAP2D00.tmp
2014-08-21 14:36 - 2014-08-21 14:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP4CEC.tmp
2014-08-21 14:35 - 2014-08-21 14:35 - 00000000 _____ () C:\Windows\SysWOW64\FAPDF79.tmp
2014-08-21 14:35 - 2014-08-21 14:35 - 00000000 _____ () C:\Windows\SysWOW64\FAPBA5A.tmp
2014-08-21 14:33 - 2014-08-21 14:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPB385.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP313A.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP2E1C.tmp
2014-08-21 14:32 - 2014-08-21 14:32 - 00000000 _____ () C:\Windows\SysWOW64\FAP2D6F.tmp
2014-08-21 14:29 - 2014-08-21 14:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4C33.tmp
2014-08-21 14:29 - 2014-08-21 14:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4667.tmp
2014-08-21 14:18 - 2014-08-21 14:18 - 00000000 _____ () C:\Windows\SysWOW64\FAPA8AF.tmp
2014-08-21 14:13 - 2014-08-21 14:13 - 00000000 _____ () C:\Windows\SysWOW64\FAPC80F.tmp
2014-08-21 13:40 - 2014-08-21 13:40 - 00000000 _____ () C:\Windows\SysWOW64\FAP8F32.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP615C.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP613B.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP60FB.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP172D.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP16FC.tmp
2014-08-21 13:26 - 2014-08-21 13:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP168D.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP6076.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP6035.tmp
2014-08-21 13:19 - 2014-08-21 13:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP5FD6.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA50.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA00.tmp
2014-08-21 12:58 - 2014-08-21 12:58 - 00000000 _____ () C:\Windows\SysWOW64\FAPD8D5.tmp
2014-08-21 12:35 - 2014-08-21 12:35 - 00000000 ____D () C:\Users\Hjalfnar\Downloads\Warhammer 40K - 7th Edition - Codex Space Wolves
2014-08-21 12:34 - 2014-08-21 12:34 - 00000000 _____ () C:\Windows\SysWOW64\FAP3248.tmp
2014-08-21 12:33 - 2014-08-21 12:33 - 00000000 _____ () C:\Windows\SysWOW64\FAPE9D1.tmp
2014-08-21 12:26 - 2014-08-21 12:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP38D8.tmp
2014-08-21 12:25 - 2014-08-21 12:25 - 00000000 _____ () C:\Windows\SysWOW64\FAP770E.tmp
2014-08-21 11:52 - 2014-08-21 11:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPEEAA.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPE8EE.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPE5D0.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPC498.tmp
2014-08-21 11:38 - 2014-08-21 11:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPC052.tmp
2014-08-21 10:39 - 2014-08-21 10:39 - 00000000 _____ () C:\Windows\SysWOW64\FAPDD60.tmp
2014-08-21 10:39 - 2014-08-21 10:39 - 00000000 _____ () C:\Windows\SysWOW64\FAPDD4F.tmp
2014-08-21 10:36 - 2014-08-21 10:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP5B80.tmp
2014-08-21 10:36 - 2014-08-21 10:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP5AF2.tmp
2014-08-21 10:28 - 2014-08-21 10:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP9BE6.tmp
2014-08-21 10:28 - 2014-08-21 10:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP712C.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAPED99.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAPEC9E.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP54B1.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP46F9.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3F39.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E7C.tmp
2014-08-21 10:26 - 2014-08-21 10:26 - 00000000 _____ () C:\Windows\SysWOW64\FAP3086.tmp
2014-08-21 10:25 - 2014-08-21 10:25 - 00000000 _____ () C:\Windows\SysWOW64\FAPE300.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP96CA.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP96B8.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP9697.tmp
2014-08-21 02:42 - 2014-08-21 02:42 - 00000000 _____ () C:\Windows\SysWOW64\FAP9685.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD984.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD972.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD960.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPC938.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP30BF.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP30AE.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP309C.tmp
2014-08-21 02:41 - 2014-08-21 02:41 - 00000000 _____ () C:\Windows\SysWOW64\FAP307B.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPD459.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAPD274.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAP63DF.tmp
2014-08-21 02:38 - 2014-08-21 02:38 - 00000000 _____ () C:\Windows\SysWOW64\FAP1052.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FDD.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89DC.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89DA.tmp
2014-08-21 02:37 - 2014-08-21 02:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP89B9.tmp
2014-08-21 01:03 - 2014-08-21 01:03 - 00000000 _____ () C:\Windows\SysWOW64\FAPC454.tmp
2014-08-20 22:58 - 2014-08-20 22:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP795C.tmp
2014-08-20 22:58 - 2014-08-20 22:58 - 00000000 _____ () C:\Windows\SysWOW64\FAP793B.tmp
2014-08-20 22:29 - 2014-08-20 22:29 - 00000000 _____ () C:\Windows\SysWOW64\FAP4656.tmp
2014-08-20 22:28 - 2014-08-20 22:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP92AF.tmp
2014-08-20 22:28 - 2014-08-20 22:28 - 00000000 _____ () C:\Windows\SysWOW64\FAP9156.tmp
2014-08-20 22:27 - 2014-08-20 22:27 - 00000000 _____ () C:\Windows\SysWOW64\FAP9817.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPE931.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPDB98.tmp
2014-08-20 22:21 - 2014-08-20 22:21 - 00000000 _____ () C:\Windows\SysWOW64\FAPCF47.tmp
2014-08-20 22:19 - 2014-08-20 22:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP4416.tmp
2014-08-20 22:19 - 2014-08-20 22:19 - 00000000 _____ () C:\Windows\SysWOW64\FAP3F82.tmp
2014-08-20 22:09 - 2014-08-20 22:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPE060.tmp
2014-08-20 22:09 - 2014-08-20 22:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPD7C7.tmp
2014-08-20 22:05 - 2014-08-20 22:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPFA61.tmp
2014-08-20 22:05 - 2014-08-20 22:05 - 00000000 _____ () C:\Windows\SysWOW64\FAPEE9D.tmp
2014-08-20 22:02 - 2014-08-20 22:02 - 00000000 _____ () C:\Windows\SysWOW64\FAP2C17.tmp
2014-08-20 21:53 - 2014-08-20 21:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP6FB9.tmp
2014-08-20 21:53 - 2014-08-20 21:53 - 00000000 _____ () C:\Windows\SysWOW64\FAP6EAE.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPED3B.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPEC9D.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPEA1C.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPE9DB.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPE364.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAPDCAE.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7CA2.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C52.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C02.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP799F.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP794F.tmp
2014-08-20 20:11 - 2014-08-20 20:11 - 00000000 _____ () C:\Windows\SysWOW64\FAP71EE.tmp
2014-08-20 20:09 - 2014-08-20 20:09 - 00000000 _____ () C:\Windows\SysWOW64\FAPED90.tmp
2014-08-20 20:08 - 2014-08-20 20:08 - 00000000 _____ () C:\Windows\SysWOW64\FAP8338.tmp
2014-08-20 20:08 - 2014-08-20 20:08 - 00000000 _____ () C:\Windows\SysWOW64\FAP2204.tmp
2014-08-20 17:45 - 2014-08-20 17:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP77CC.tmp
2014-08-20 17:45 - 2014-08-20 17:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP6100.tmp
2014-08-20 17:44 - 2014-08-20 17:44 - 00000000 _____ () C:\Windows\SysWOW64\FAP1FF9.tmp
2014-08-20 17:37 - 2014-08-20 17:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPECA7.tmp
2014-08-20 16:35 - 2014-08-20 16:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP3EE8.tmp
2014-08-20 14:57 - 2014-08-20 14:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP4F0A.tmp
2014-08-20 14:57 - 2014-08-20 14:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP4E7C.tmp
2014-08-20 13:09 - 2014-08-20 13:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP7308.tmp
2014-08-20 13:09 - 2014-08-20 13:09 - 00000000 _____ () C:\Windows\SysWOW64\FAP72B8.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPEFC1.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPE1CB.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPE18A.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPDA48.tmp
2014-08-20 12:52 - 2014-08-20 12:52 - 00000000 _____ () C:\Windows\SysWOW64\FAPD47C.tmp
2014-08-20 12:51 - 2014-08-20 12:51 - 00000000 _____ () C:\Windows\SysWOW64\FAP9BBE.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP86C6.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP8676.tmp
2014-08-20 12:50 - 2014-08-20 12:50 - 00000000 _____ () C:\Windows\SysWOW64\FAP7F33.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP7BC8.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP79A4.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP77ED.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP77BC.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6FCE.tmp
2014-08-20 12:46 - 2014-08-20 12:46 - 00000000 _____ () C:\Windows\SysWOW64\FAP6956.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPB9A5.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPA50B.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAPA4DA.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP9FF8.tmp
2014-08-20 12:45 - 2014-08-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\FAP9971.tmp
2014-08-20 11:59 - 2014-08-20 11:59 - 00000000 _____ () C:\Windows\SysWOW64\FAP2B.tmp
2014-08-20 11:57 - 2014-08-20 11:57 - 00000000 _____ () C:\Windows\SysWOW64\FAP8733.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPDBC6.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD2AF.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPD26F.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPCD01.tmp
2014-08-20 11:41 - 2014-08-20 11:41 - 00000000 _____ () C:\Windows\SysWOW64\FAPC522.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPDAA.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAPD5A.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP4779.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E82.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP3E41.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP37BA.tmp
2014-08-20 11:37 - 2014-08-20 11:37 - 00000000 _____ () C:\Windows\SysWOW64\FAP1672.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAPFB4.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP1C27.tmp
2014-08-20 11:36 - 2014-08-20 11:36 - 00000000 _____ () C:\Windows\SysWOW64\FAP1004.tmp
2014-08-20 11:32 - 2014-08-20 11:32 - 00000000 _____ () C:\Windows\SysWOW64\FAPCDC3.tmp
2014-08-20 11:30 - 2014-08-20 11:30 - 00000000 _____ () C:\Windows\SysWOW64\FAP2AFD.tmp
2014-08-20 11:07 - 2014-08-20 11:07 - 00000000 _____ () C:\Windows\SysWOW64\FAP95FC.tmp
2014-08-20 10:13 - 2014-04-15 16:53 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-20 10:13 - 2014-04-15 16:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-20 10:13 - 2014-04-15 16:53 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-19 20:05 - 2014-09-12 03:03 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 19:39 - 2014-09-12 03:03 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-19 01:01 - 2014-09-12 03:03 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:29 - 2014-09-12 03:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-19 00:29 - 2014-09-12 03:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-19 00:26 - 2014-09-12 03:02 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-19 00:20 - 2014-09-12 03:02 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-19 00:19 - 2014-09-12 03:02 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-19 00:15 - 2014-09-12 03:03 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-19 00:15 - 2014-09-12 03:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-19 00:14 - 2014-09-12 03:03 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-19 00:14 - 2014-09-12 03:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-19 00:11 - 2014-08-19 00:11 - 03689799 _____ () C:\Users\Hjalfnar\Desktop\OnlineCodexWH40K_Testversion_7.jar
2014-08-19 00:08 - 2014-09-12 03:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-19 00:08 - 2014-09-12 03:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-19 00:08 - 2014-09-12 03:02 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-19 00:05 - 2014-09-12 03:03 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-19 00:03 - 2014-09-12 03:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-19 00:03 - 2014-09-12 03:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-19 00:03 - 2014-09-12 03:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:57 - 2014-09-12 03:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-18 23:56 - 2014-09-12 03:03 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:51 - 2014-09-12 03:03 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:46 - 2014-09-12 03:03 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-18 23:45 - 2014-09-12 03:03 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:45 - 2014-09-12 03:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-18 23:44 - 2014-09-12 03:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-12 03:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-12 03:03 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-18 23:40 - 2014-09-12 03:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:39 - 2014-09-12 03:03 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:39 - 2014-09-12 03:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-18 23:39 - 2014-09-12 03:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-18 23:38 - 2014-09-12 03:03 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:37 - 2014-09-12 03:03 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-18 23:36 - 2014-09-12 03:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-18 23:35 - 2014-09-12 03:03 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-18 23:27 - 2014-09-12 03:03 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-18 23:25 - 2014-09-12 03:03 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:25 - 2014-09-12 03:03 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:23 - 2014-09-12 03:03 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 23:23 - 2014-09-12 03:02 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:22 - 2014-09-12 03:03 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-12 03:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-18 23:17 - 2014-09-12 03:03 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-18 23:17 - 2014-09-12 03:03 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-18 23:16 - 2014-09-12 03:02 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:15 - 2014-09-12 03:02 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-18 23:15 - 2014-09-12 03:02 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 23:09 - 2014-09-12 03:03 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-18 23:08 - 2014-09-12 03:02 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-18 23:07 - 2014-09-12 03:03 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-18 22:55 - 2014-09-12 03:02 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:46 - 2014-09-12 03:02 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-18 22:38 - 2014-09-12 03:03 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-18 22:38 - 2014-09-12 03:02 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-18 22:36 - 2014-09-12 03:03 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-15 03:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

Some content of TEMP:
====================
C:\Users\Hjalfnar\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-06 18:05

==================== End Of Log ============================
--- --- ---

--- --- ---

Alt 14.09.2014, 22:25   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 15.09.2014, 06:25   #11
Hjalfnar
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


FRST Additions Logfile:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Hjalfnar at 2014-09-15 07:25:08
Running from C:\Users\Hjalfnar\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKCU\...\uTorrent) (Version: 3.4.2.32239 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
ACW 3.0  Brothers vs Brothers Music (HKLM-x32\...\ACW 3.0  Brothers vs Brothers Music(only)) (Version: (only) - ACW mod Team)
ACW Brothers vs Brothers (HKLM-x32\...\ACW Brothers vs Brothers3.3) (Version: 3.3 - ACW mod Team)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.11) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.11 - Adobe Systems Incorporated)
Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version:  - Ensemble Studios)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
Avira (HKLM-x32\...\{142be4a8-895b-4ed9-b1ff-11c76357e3df}) (Version: 1.1.17.31000 - Avira Operations GmbH & Co. KG)
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
calibre 64bit (HKLM\...\{2B73426A-9499-4875-BAE9-8DD729009399}) (Version: 1.47.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Codename Panzers Cold War (HKLM\...\Codename Panzers Cold War_is1) (Version:  - )
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version:  - Paradox Development Studio)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Darkest Hour A Hearts of Iron Game (HKCU\...\Darkest Hour A Hearts of Iron Game) (Version:  - Paradox Interactive AB)
DarthMod: Shogun II (HKLM-x32\...\DarthMod: Shogun II) (Version:  - )
Defraggler (HKLM\...\Defraggler) (Version: 2.17 - Piriform)
Deponia (HKLM-x32\...\Steam App 214340) (Version:  - Daedalic Entertainment)
Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.0.671.10 - Electronic Arts Inc.)
Dragon Age Redesigned © Morrigan (HKCU\...\Dragon Age Redesigned © Morrigan) (Version:  - )
Dragon Age Redesigned Oghren© (HKCU\...\Dragon Age Redesigned Oghren©) (Version:  - )
Dragon Age Redesigned©  Zevran (HKCU\...\Dragon Age Redesigned©  Zevran) (Version:  - )
Dragon Age Redesigned© (HKCU\...\Dragon Age Redesigned©) (Version:  - )
Dragon Age Redesigned© Leliana (HKCU\...\Dragon Age Redesigned© Leliana) (Version:  - )
Dragon Age Redesigned© Sten (HKCU\...\Dragon Age Redesigned© Sten) (Version:  - )
Dragon Age Redesigned© Wynne (HKCU\...\Dragon Age Redesigned© Wynne) (Version:  - )
Dragon Age: Origins - Ultimate Edition (HKLM-x32\...\Steam App 47810) (Version:  - BioWare)
Empire: Total War (HKLM-x32\...\Steam App 10500) (Version:  - The Creative Assembly)
Fallout 2 (HKLM-x32\...\Fallout 2_is1) (Version:  - GOG.com)
File Type Advisor 1.4 (HKLM-x32\...\File Type Advisor_is1) (Version:  - filetypeadvisor.com)
FO2 Restoration Project 2.3.2 (HKLM-x32\...\Fallout 2 Restoration Project_is1) (Version:  - killap)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )
Free M4a to MP3 Converter 8.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
Free YouTube to MP3 Converter version 3.12.38.530 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.38.530 - DVDVideoSoft Ltd.)
Freemake Video Converter Version 4.1.4 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.4 - Ellora Assets Corporation)
Hearts of Iron III (HKLM-x32\...\Steam App 25890) (Version:  - Paradox Development Studio)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3186 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation) Hidden
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.31.8.1 - Intel Corporation) Hidden
Java 7 Update 60 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417060FF}) (Version: 7.0.600 - Oracle)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.236 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.236 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.1 (x86 de)) (Version: 32.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 14.6.22 (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA Update 14.6.22 (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.)
Panzer Corps (HKLM-x32\...\Steam App 268400) (Version:  - Flashback Games)
Panzer Corps Collection version 1.14 + ALL DLC (HKLM-x32\...\Panzer Corps Collection_is1) (Version: 1.14 + ALL DLC - )
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.5.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Proxifier version 3.21 (HKLM-x32\...\Proxifier_is1) (Version: 3.21 - Initex)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 2.0.2.6 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
Setup - The SIMS 4  Deluxe Edition ... (HKLM-x32\...\Setup - The SIMS 4  Deluxe Edition ...) (Version: ... - Electronic Arts)
SHIELD Streaming (Version: 2.1.214 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Silent Hunter 4 Wolves of the Pacific (HKLM-x32\...\{0D005F09-A5F4-473B-A901-5735C6AF5628}) (Version: 1.05.0000 - Ubisoft)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
SOUP - Share-Online Uploader (HKCU\...\ab1af244d47f0c33) (Version: 1.0.0.26 - Xlice Corp.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Star Wars: The Force Unleashed Ultimate Sith Edition (HKLM-x32\...\Steam App 32430) (Version:  - LucasArts)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
The Sims™ 3 Кино Каталог (HKLM-x32\...\{D0087539-3C57-44E0-BEE7-D779D546CBE1}) (Version: 20.0.53 - Electronic Arts)
Total War: ROME II (HKLM-x32\...\Steam App 214950) (Version:  - Creative Assembly)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Uplay (HKLM-x32\...\Uplay) (Version: 4.6 - Ubisoft)
Vegas Pro 13.0 (64-bit) (HKLM\...\{CE92F061-BFBC-11E3-8FF3-F04DA23A5C58}) (Version: 13.0.290 - Sony)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
Wargame: AirLand Battle (HKLM-x32\...\Steam App 222750) (Version:  - Eugen Systems)
Windows Live Communications Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Wolfenstein: The New Order German Edition (HKLM-x32\...\Steam App 288570) (Version:  - MachineGames)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

09-09-2014 06:07:54 Windows Update
11-09-2014 07:57:07 Removed LogMeIn Hamachi
11-09-2014 07:59:03 Installed LogMeIn Hamachi
12-09-2014 01:00:11 Windows Update
14-09-2014 15:34:46 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-09-14 17:42 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {010D6386-90CF-4816-AB6D-2A22D69AFD2D} - System32\Tasks\FileAdvisorUpdate => C:\Program Files (x86)\File Type Advisor\fileadvisor.exe [2013-09-04] (File Type Advisor)
Task: {22B8B89F-437F-4B87-B6FA-BA1CEA4EEEBD} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => D:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {69246FFB-17AF-4332-9C22-C2FC5F9ED3BE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => D:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {8E58DDBA-D122-4CF5-9EBE-444988935D6D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-20] (Adobe Systems Incorporated)
Task: {8FA49973-C018-4B07-A511-E548137CC028} - System32\Tasks\CCleanerSkipUAC => D:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {9A062267-36A6-45A0-98C3-46C95E08DB16} - System32\Tasks\FileAdvisorCheck => C:\Program Files (x86)\File Type Advisor\file-type-advisor.exe [2013-09-04] (filetypeadvisor.com                                         )
Task: {CC850E06-98AE-4CAB-9563-E06F4D7D1DD8} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\AvastEmUpdate.exe [2014-09-14] (AVAST Software)
Task: {F19AA483-C0AB-4A34-9F2A-6CC46EAE63C5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => D:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-07-15 15:50 - 2012-11-22 18:57 - 00057448 _____ () C:\Windows\system32\PrxerNsp.dll
2014-04-15 15:33 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-05-31 08:42 - 2014-05-31 08:42 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-05-31 08:42 - 2014-05-31 08:42 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-09-14 17:34 - 2014-09-14 17:34 - 00301152 _____ () C:\Program Files\AVAST Software\aswProperty.dll
2014-09-14 17:35 - 2014-09-14 17:35 - 02862592 _____ () C:\Program Files\AVAST Software\defs\14091401\algo.dll
2014-07-18 06:05 - 2014-05-13 12:04 - 00109400 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-07-18 06:05 - 2014-05-13 12:04 - 00416600 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-07-18 06:05 - 2014-05-13 12:04 - 00167768 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-07-18 06:05 - 2012-08-23 10:38 - 00574840 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-07-18 06:05 - 2012-04-03 17:06 - 00565640 _____ () D:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-09-14 17:34 - 2014-09-14 17:34 - 19329904 _____ () C:\Program Files\AVAST Software\libcef.dll
2014-04-15 14:32 - 2013-09-16 12:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-09-12 21:20 - 2014-09-12 21:20 - 03716720 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-04-15 16:31 - 2014-08-21 00:38 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-05-22 00:49 - 2014-08-28 13:48 - 02224320 _____ () C:\Program Files (x86)\Steam\video.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-08-28 23:57 - 2014-08-21 20:15 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-04-15 16:31 - 2014-08-28 13:48 - 00678080 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2014-04-15 16:31 - 2014-08-21 00:38 - 34589376 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-08-14 22:46 - 2014-08-21 00:38 - 00837824 _____ () C:\Program Files (x86)\Steam\bin\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Hjalfnar\Desktop\Selbstauskunft_Fam.Weiberg.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Hjalfnar\Desktop\Selbstauskunft_Fam.Weiberg.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: asComSvc => 2
MSCONFIG\Services: DAUpdaterSvc => 3
MSCONFIG\Services: Hamachi2Svc => 2
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: DAEMON Tools Lite => "D:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: EADM => "D:\Spiele\Origin\Origin.exe" -AutoStart
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "D:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: PDFPrint => D:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SwitchBoard => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (09/15/2014 06:44:54 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.

Error: (09/15/2014 06:36:33 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.

Error: (09/15/2014 06:34:58 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-09-14 17:42:16.869
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-09-14 17:42:16.822
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz
Percentage of memory in use: 31%
Total physical RAM: 8130.72 MB
Available physical RAM: 5574.91 MB
Total Pagefile: 16259.62 MB
Available Pagefile: 13280.38 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.47 GB) (Free:66.45 GB) NTFS
Drive d: () (Fixed) (Total:465.76 GB) (Free:206.8 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive i: (Volume) (Fixed) (Total:279.46 GB) (Free:260.15 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 223.6 GB) (Disk ID: E253E6B6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=223.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 760ACF0C)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 279.5 GB) (Disk ID: FFE99422)
Partition 1: (Not Active) - (Size=279.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
--- --- ---
Alt 15.09.2014, 09:18   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Zitat:
Proxifier version 3.21 (HKLM-x32\...\Proxifier_is1) (Version: 3.21 - Initex)
Ist diese Software gewollt?
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 15.09.2014, 09:36   #13
Hjalfnar
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Ja.

Alt 15.09.2014, 09:43   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 15.09.2014, 11:52   #15
Hjalfnar
 
Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Standard

Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Suchlauf Datum: 15.09.2014
Suchlauf-Zeit: 10:46:33
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.15.04
Rootkit Datenbank: v2014.09.13.01
Lizenz: Premium
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Aktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Hjalfnar

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 318287
Verstrichene Zeit: 3 Min, 11 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=91c9fbef354ab744942e5b8e9ab9b4cc
# engine=20157
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-15 10:49:00
# local_time=2014-09-15 12:49:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 95 67730 69324 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 15650 162407990 0 0
# scanned=664229
# found=0
# cleaned=0
# scan_time=6537

Malwarebytes habe ich in der Premiumversion mit täglichen Scans und Updates laufen, deshalb war ich ja so erschrocken...

Antwort
Seite 1 von 2 1 2

Themen zu Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet
.dll, adobe, antivir, avira, booten, browser, desktop, explorer, firefox, flash player, format, mozilla, realtek, registry, rundll, secur, services.exe, software, svchost.exe, system, temp, trojaner, usb, wargame, windows, winlogon.exe


« Windows 7: Internet seit fast 2 Monaten sehr langsam | Fehler bei Windowsstart: RegWvr32 »


Ähnliche Themen: Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet


  1. eventueller Trojaner befall
    Plagegeister aller Art und deren Bekämpfung - 30.10.2015 (3)
  2. Windows 7: Steam Account durch Virus gehackt und entwendet, Steam infiziert : Win32:Malware-gen
    Log-Analyse und Auswertung - 14.09.2015 (16)
  3. One Touch: Paypal erlaubt Bezahlen ohne Passwort
    Nachrichten - 26.08.2015 (0)
  4. Battle.net Passwort wurde durch dritte geändert
    Log-Analyse und Auswertung - 17.08.2014 (4)
  5. Windows 7: Eventueller Virenbefall durch Netzwerk?
    Log-Analyse und Auswertung - 04.07.2014 (11)
  6. PayPal Phishing-Mail erhalten, auf Link geklickt und Passwort eingegeben
    Plagegeister aller Art und deren Bekämpfung - 12.04.2014 (9)
  7. Problem mit Trojaner Windows Passwort funktioniert nicht
    Plagegeister aller Art und deren Bekämpfung - 05.04.2014 (6)
  8. Passwort wurde geklaut ..
    Log-Analyse und Auswertung - 27.06.2013 (14)
  9. Admin Passwort wurde geändert
    Plagegeister aller Art und deren Bekämpfung - 18.10.2012 (3)
  10. GVU nach Kapersky Nutzung als Gast anmelden OK ohne Passwort, nicht als Administrator mit Passwort
    Plagegeister aller Art und deren Bekämpfung - 05.07.2012 (33)
  11. PayPal Phishing Mail -> Passwort geändert Frage zu weitere Folgen
    Plagegeister aller Art und deren Bekämpfung - 19.06.2012 (1)
  12. Achtung! Ihr Windowssystem wurde blockiert. 50 Euro mit PayPal oder Ukash zahlen
    Log-Analyse und Auswertung - 12.02.2012 (5)
  13. Kundendaten bei der Citibank entwendet
    Nachrichten - 09.06.2011 (0)
  14. mein computer passwort wurde geändert....
    Plagegeister aller Art und deren Bekämpfung - 18.01.2011 (2)
  15. An alle Paypal Verkäufer! Neue Paypal Bertugs Methode mit Phishing Mails
    Plagegeister aller Art und deren Bekämpfung - 09.11.2010 (3)
  16. Musik aus dem off/ Offenbar Trojaner
    Plagegeister aller Art und deren Bekämpfung - 29.07.2010 (17)
  17. Passwort wurde geklaut
    Plagegeister aller Art und deren Bekämpfung - 03.05.2010 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet - Moin moin! Vor einigen Tagen fing Firefox nach dem Booten an, mich nach einem PC-Neustart auf eine russische Spieleseite zu verweisen. Sonst nichts, keine Pop-Ups oder irgendwas. Aber sowas macht - Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet...
Archiv
Du betrachtest: Windows 7: Eventueller Trojaner, Paypal-Passwort wurde offenbar entwendet auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55