| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-ManagerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.12.2014, 20:52
| #1 |
| |  Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Guten Abend zusammmen, am Wochenende meldete mir mein Virenprogramm Avira mehrere Funde. Weiterhin fiel mir auf, das sich in meinem Task-Manager zwei mal die Explorer.exe befand und eine von beiden eine große Arbeitsspeicherkapazität hatte (mind. 600.000 K). Im Ressourcenmonitor sah ich dann auch, dass die Explorer.exe auch einiges an Daten ins Internet schickte, obwohl ich keinen Browser offen hatte. Ich habe daraufhin mit Avira meinen gesamten PC durchsuchen lassen und auch die hier empfohlenen Schritte (Defogger; FRST und GMER) durchgeführt. Hier nun die Logfiles: defogger_disable log: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:16 on 08/12/2014 (*****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
SPTD -> Already disabled
-=E.O.F=-
FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 02
Ran by ***** (administrator) on ***** on 08-12-2014 19:19:06
Running from C:\Users\*****\Downloads
Loaded Profiles: ***** & UpdatusUser (Available profiles: ***** & UpdatusUser & test)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2792448 2009-12-04] (VIA)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-06] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\AnVir Task Manager <====== ATTENTION
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-11-24] (Glarysoft Ltd)
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Run: [{0021A06F-B1E9-A117-3A53-C7CA95E01643}] => C:\Users\*****\AppData\Roaming\Umgiuk\odnuc.exe [184728 2013-02-23] (Fastest tiptronic transmision )
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Policies\Explorer: []
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\MountPoints2: F - F:\LaunchU3.exe -a
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\MountPoints2: {054a771d-03ab-11e0-ad36-0019216cd75e} - K:\Autorun.exe
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\MountPoints2: {54296a72-fbef-11df-b74e-0019216cd75e} - F:\LaunchU3.exe -a
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\MountPoints2: {98b3e988-fbee-11df-8608-806e6f6e6963} - E:\autoplay.exe
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\MountPoints2: {c20908f9-d367-11e2-9673-002522d798ef} - G:\autorun.exe
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\MountPoints2: {cb4072b6-e932-11e0-9ffa-806e6f6e6963} - E:\autorun.exe
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x71E969DC9EF6CD01
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000 -> DefaultScope {9ADEE868-A379-4C6D-968E-A0E0EB49F3DA} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000 -> {9ADEE868-A379-4C6D-968E-A0E0EB49F3DA} URL = https://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~3\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2961250916-3466838546-2982623831-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-2961250916-3466838546-2982623831-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\user.js
FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-24]
FF HKLM-x32\...\Thunderbird\Extensions: [avgthb@avg.com] - C:\Program Files (x86)\AVG\AVG2012\Thunderbird
FF StartMenuInternet: FIREFOX.EXE - C:\Programme\Mozilla Firefox\firefox.exe
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [bicnnkjibmphdeigoodpjlcklcnaobdj] - C:\Program Files (x86)\TornTV.com\torntv10.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [cfdfamfnacokbbbnmpdfmhonipnhmbid] - C:\Users\*****\AppData\LocalLow\Flagfox\CHROME\Flagfox.crx [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2014-11-06] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-06] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2011-09-28] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]
R2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [204304 2012-04-11] (Nitro PDF Software)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-12-16] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2012-12-16] ()
S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2011-09-28] (Creative Labs) [File not signed]
R2 UserAccess7; C:\Windows\SysWOW64\UAService7.exe [221184 2014-11-30] (Sony DADC Austria AG.) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20552 2010-09-06] (Devguru Co., Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-12] (DT Soft Ltd)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-09-29] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-09-28] (FNet Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] () [File not signed]
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2014-12-06] (Glarysoft Ltd)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-05-17] (Duplex Secure Ltd.)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2009-07-14] (Microsoft Corporation)
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S1 ttnfd; system32\drivers\ttnfd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-08 19:19 - 2014-12-08 19:20 - 00014868 _____ () C:\Users\*****\Downloads\FRST.txt
2014-12-08 19:18 - 2014-12-08 19:19 - 00000000 ____D () C:\FRST
2014-12-08 19:18 - 2014-12-08 19:18 - 02119680 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe
2014-12-08 19:13 - 2014-12-08 19:13 - 00000020 _____ () C:\Users\*****\defogger_reenable
2014-12-08 19:12 - 2014-12-08 19:12 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-12-08 13:05 - 2014-12-08 17:10 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Etenqy
2014-12-08 13:05 - 2014-12-08 13:05 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Umgiuk
2014-12-08 12:00 - 2014-12-08 12:00 - 00000672 _____ () C:\Users\*****\Downloads\cable.zip
2014-12-08 00:22 - 2014-12-08 00:23 - 00000000 ____D () C:\Users\*****\AppData\Roaming\concept design
2014-12-08 00:22 - 2014-12-08 00:22 - 00001233 _____ () C:\Users\*****\Desktop\onlineTV 10.lnk
2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\concept design
2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\concept design
2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\Program Files (x86)\concept design
2014-12-08 00:03 - 2014-12-08 00:03 - 01174352 _____ () C:\Users\*****\Downloads\Vollversion onlineTV 10 - CHIP-Installer.exe
2014-12-07 16:18 - 2014-12-07 16:18 - 00233737 _____ () C:\Users\*****\AppData\Local\census.cache
2014-12-07 16:17 - 2014-12-07 16:17 - 00125646 _____ () C:\Users\*****\AppData\Local\ars.cache
2014-12-07 15:36 - 2014-12-07 15:36 - 00000036 _____ () C:\Users\*****\AppData\Local\housecall.guid.cache
2014-12-07 15:27 - 2014-12-07 15:27 - 00061970 _____ () C:\Users\*****\Desktop\AVSCAN-20141207-031446-C00237E2.LOG
2014-12-06 21:53 - 2014-12-06 21:53 - 00001281 _____ () C:\Windows\IE11_main.log
2014-12-06 16:52 - 2014-12-08 19:15 - 00007392 _____ () C:\Windows\setupact.log
2014-12-06 16:52 - 2014-12-06 16:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-06 16:50 - 2014-11-24 07:01 - 00028960 _____ (Glarysoft Ltd) C:\Windows\system32\RegBootDefrag.exe
2014-12-06 16:20 - 2014-12-06 16:20 - 00002974 _____ () C:\Windows\System32\Tasks\GU5SkipUAC
2014-12-06 16:20 - 2014-12-06 16:20 - 00001100 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2014-12-06 16:20 - 2014-12-06 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2014-12-06 16:20 - 2014-12-06 16:20 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-12-06 16:19 - 2014-12-08 19:15 - 00000334 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2014-12-06 16:19 - 2014-12-06 20:59 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2014-12-06 16:19 - 2014-12-06 16:20 - 00002632 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5
2014-12-06 16:19 - 2014-12-06 16:19 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2014-12-06 16:19 - 2014-12-06 16:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DiskDefrag
2014-12-05 15:02 - 2014-12-05 15:02 - 00000000 ____D () C:\ProgramData\CayeRfuro
2014-12-05 13:54 - 2014-12-08 19:15 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-12-03 23:08 - 2014-12-03 23:10 - 11254840 _____ () C:\Users\*****\Downloads\Autodesk_Inventor_2015_R1_German_Win_64bit_wi_de-DE_Setup.exe
2014-12-01 20:39 - 2014-12-01 20:39 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-12-01 16:02 - 2014-12-01 16:02 - 00000000 ____D () C:\Users\*****\Documents\Autodesk Application Manager
2014-12-01 15:46 - 2014-12-01 15:46 - 00000000 ____D () C:\Users\*****\Documents\Inventor Server SDK ACAD 2015
2014-12-01 15:45 - 2014-12-02 15:11 - 00000000 ____D () C:\Users\*****\AppData\Local\Autodesk
2014-12-01 15:44 - 2014-12-01 15:44 - 00000000 ____D () C:\Program Files\Common Files\Macrovision Shared
2014-12-01 15:37 - 2014-12-03 23:55 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2014-12-01 15:36 - 2014-12-03 23:12 - 00000000 ____D () C:\Users\Public\Documents\Autodesk
2014-12-01 15:33 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-12-01 15:33 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-12-01 15:04 - 2014-12-03 23:55 - 00000000 ____D () C:\ProgramData\Autodesk
2014-12-01 15:04 - 2014-12-03 23:12 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Autodesk
2014-12-01 00:09 - 2014-12-01 00:09 - 00000458 _____ () C:\memory.txt
2014-11-30 23:54 - 2014-11-30 23:54 - 00000000 __RHD () C:\ProgramData\SecuROM
2014-11-30 23:53 - 2014-11-30 23:53 - 00221184 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe
2014-11-30 23:53 - 2014-11-30 23:53 - 00098304 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt.dll
2014-11-30 23:49 - 2014-11-30 23:49 - 00000000 ____D () C:\Program Files (x86)\Atari
2014-11-30 22:35 - 2014-12-04 02:07 - 00000000 ____D () C:\Autodesk
2014-11-30 22:35 - 2014-11-30 22:35 - 00000000 ____D () C:\Users\*****\AppData\Local\Akamai
2014-11-23 18:05 - 2014-11-23 18:06 - 181886701 _____ () C:\Users\*****\Desktop\Backup_20141123-1804.mvc
2014-11-21 23:58 - 2014-11-21 23:57 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-11-21 23:57 - 2014-11-21 23:57 - 00000000 ____D () C:\Program Files\Java
2014-11-21 23:31 - 2014-11-27 20:00 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe
2014-11-21 20:32 - 2014-12-07 15:25 - 00000000 ____D () C:\ProgramData\YimneLegpo
2014-11-21 20:32 - 2014-12-05 14:44 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
2014-11-21 20:32 - 2014-11-21 20:32 - 00000000 ____D () C:\ProgramData\MafoBajf
2014-11-13 15:54 - 2014-11-13 15:54 - 00000000 ____D () C:\Users\*****\Downloads\Minecraft
2014-11-13 15:30 - 2014-11-23 18:18 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Craften Terminal
2014-11-13 15:30 - 2014-11-13 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Craften Terminal
2014-11-13 15:28 - 2014-12-06 01:19 - 00000000 ____D () C:\Users\*****\Desktop\KL
2014-11-13 15:22 - 2014-11-13 15:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\TunkDesign
2014-11-13 15:18 - 2014-11-13 15:18 - 00098550 _____ () C:\Users\*****\Downloads\xray_1.7.4.zip
2014-11-13 13:19 - 2014-11-13 13:20 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-11-13 13:19 - 2014-11-13 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-08 19:20 - 2010-11-29 20:29 - 01693229 _____ () C:\Windows\WindowsUpdate.log
2014-12-08 19:15 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-08 19:13 - 2013-05-15 18:39 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-08 19:13 - 2010-11-29 20:41 - 00000000 ____D () C:\Users\*****
2014-12-08 15:26 - 2014-09-11 13:22 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2BB45ECA-2C65-44E6-AA63-BC2D7A26E258}
2014-12-08 15:01 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-08 15:01 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-08 14:52 - 2013-03-21 13:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-08 14:52 - 2013-03-21 13:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-08 13:38 - 2013-03-21 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-08 12:24 - 2012-09-02 20:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Nitro PDF
2014-12-08 11:50 - 2010-11-29 23:37 - 00007602 _____ () C:\Users\*****\AppData\Local\Resmon.ResmonCfg
2014-12-07 01:19 - 2014-05-13 15:47 - 00085304 _____ () C:\Users\test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-07 01:11 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-06 16:52 - 2013-01-20 18:23 - 00000298 _____ () C:\Windows\Tasks\ROC_REG_JAN_DELETE.job
2014-12-06 16:52 - 2009-07-14 03:34 - 78381056 _____ () C:\Windows\system32\config\software.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 22020096 _____ () C:\Windows\system32\config\system.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 01835008 _____ () C:\Windows\system32\config\default.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.gu.bak
2014-12-06 16:51 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.gu.bak
2014-12-06 16:46 - 2012-12-15 16:03 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-12-06 16:39 - 2012-08-12 14:25 - 00000000 ____D () C:\Users\*****\AppData\Local\Nero
2014-12-06 16:36 - 2014-05-12 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Counter-Strike 1.6
2014-12-06 16:22 - 2013-01-20 18:23 - 00002708 _____ () C:\Windows\System32\Tasks\ROC_REG_JAN_DELETE
2014-12-06 16:20 - 2012-12-20 15:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\GlarySoft
2014-12-06 13:31 - 2011-08-19 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty - United Offensive
2014-12-06 01:13 - 2011-10-15 00:08 - 00000000 ____D () C:\Users\*****\AppData\Local\CrashDumps
2014-12-05 17:43 - 2011-12-19 18:15 - 00000000 ___RD () C:\Users\*****\Dropbox
2014-12-05 15:13 - 2011-12-19 18:11 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-12-05 11:39 - 2009-07-14 18:58 - 09519834 _____ () C:\Windows\system32\perfh007.dat
2014-12-05 11:39 - 2009-07-14 18:58 - 02902158 _____ () C:\Windows\system32\perfc007.dat
2014-12-05 11:39 - 2009-07-14 06:13 - 00006276 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-05 11:27 - 2010-11-30 18:37 - 00085304 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-05 11:16 - 2009-07-14 05:45 - 00344656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-03 22:17 - 2012-06-27 00:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Spotify
2014-12-03 13:36 - 2012-10-18 11:30 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-03 13:22 - 2012-06-27 00:23 - 00000000 ____D () C:\Users\*****\AppData\Local\Spotify
2014-12-01 16:01 - 2014-05-13 15:14 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-01 15:12 - 2010-11-29 22:11 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-11-28 17:02 - 2012-12-15 16:27 - 00000000 ____D () C:\Users\*****\Desktop\Musik
2014-11-28 16:11 - 2006-08-11 20:42 - 00000000 ___RD () C:\Programme
2014-11-23 19:49 - 2014-09-24 20:28 - 00000000 ____D () C:\AdwCleaner
2014-11-23 18:24 - 2014-11-02 23:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\.minecraft
2014-11-21 23:57 - 2014-02-01 13:13 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-21 23:57 - 2014-02-01 13:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-11-21 23:34 - 2012-11-09 17:08 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-21 23:34 - 2011-06-06 17:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-21 23:33 - 2014-02-03 21:45 - 00000000 ____D () C:\Users\*****\Desktop\FF
2014-11-21 23:33 - 2012-09-20 17:25 - 00000000 ____D () C:\Users\*****\Desktop\Spiele
2014-11-19 21:08 - 2013-05-15 18:39 - 00001849 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-11-19 21:08 - 2013-04-06 18:13 - 00000872 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-11 15:12 - 2014-05-13 15:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-11 15:12 - 2014-05-13 15:14 - 00000000 ____D () C:\Program Files (x86)\Avira
Files to move or delete:
====================
C:\ProgramData\j62j6xbe.fee
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\test\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-05 11:56
==================== End Of Log ============================
Additions.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2014 02
Ran by **** at 2014-12-08 19:21:37
Running from C:\Users\****\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.202 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader X (10.1.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
Advanced PDF Password Recovery (HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Advanced PDF Password Recovery) (Version: 5.0 - ElcomSoft Co. Ltd.)
AnVir Task Manager (HKLM-x32\...\AnVir Task Manager) (Version: - AnVir Software)
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASRock App Charger v1.0.4 (HKLM\...\ASRock App Charger_is1) (Version: - ASRock Inc.)
ASRock IES v2.0.69 (HKLM-x32\...\ASRock IES_is1) (Version: - )
ASRock InstantBoot v1.24 (HKLM-x32\...\ASRock InstantBoot_is1) (Version: - )
ASRock OC Tuner v2.3.91 (HKLM-x32\...\ASRock OC Tuner_is1) (Version: - )
Assassin's Creed II (HKLM-x32\...\{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}) (Version: 1.00 - Ubisoft)
Avira (HKLM-x32\...\{9480d4af-12b9-4e56-8034-4031ef6ab39d}) (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Call of Duty - United Offensive (HKLM-x32\...\InstallShield_{A662E280-64A8-4CF5-8407-13D0808602B3}) (Version: 1.00.0000 - Activision)
Call of Duty - United Offensive (x32 Version: 1.00.0000 - Activision) Hidden
Call of Duty (HKLM-x32\...\Call of Duty) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 3.00 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Cisco AnyConnect Diagnostics and Reporting Tool (HKLM-x32\...\{B1512C8C-F477-4BAC-8C5A-0DF6B4F7F4A0}) (Version: 3.1.02026 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.02026 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.02026 - Cisco Systems, Inc.) Hidden
concept/design onlineTV 10 (HKLM-x32\...\{DCAB9AAC-1D1C-4B94-99B7-AA7D2617BD64}_is1) (Version: 10.6.0.0 - concept/design GmbH)
Counter-Strike 1.6 (HKLM-x32\...\Counter-Strike 1.6) (Version: - )
Craften Terminal 4.0.2 (HKLM-x32\...\{4e7c3936-7c06-4ef0-928b-c5d92f372578}_is1) (Version: 4.0.2 - Craften.de)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
Die Siedler IV (HKLM-x32\...\S4Uninst) (Version: - )
Dropbox (HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
Emergency 2 (HKLM-x32\...\{874F0C23-7CA8-4639-9D77-E032E272A3FD}) (Version: 2.00.000 - )
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
FanFictionDownloader version 0.8.9 (HKLM-x32\...\{1D868954-1083-4BBA-8379-C7A9B2705CBA}_is1) (Version: 0.8.9 - Raimond Eisele)
FIFA 10 (HKLM-x32\...\{11202615-E557-4ECF-9B86-F59C81E52909}) (Version: 1.0.0.0 - Electronic Arts)
Free Video to MP3 Converter version 5.0.32.1230 (HKLM-x32\...\Free Video to MP3 Converter_is1) (Version: 5.0.32.1230 - DVDVideoSoft Ltd.)
Glary Utilities PRO 5.13 (HKLM-x32\...\Glary Utilities 5) (Version: 5.13.0.26 - Glarysoft Ltd)
Gothic (HKLM-x32\...\Gothic) (Version: 1.32 - JoWooD Software Productions AG)
Gothic 2 Gold (HKLM-x32\...\{40FE74B5-71A1-4393-A0AB-21D6E1DA5A66}) (Version: 1.0.0 - JoWood)
Gothic 3 (HKLM-x32\...\{13F59927-CFBE-44D1-8417-7203AD4F1795}) (Version: 1.0.0 - JoWooD)
Grand Theft Auto San Andreas (HKLM-x32\...\{086BADF8-9B1F-4E89-B207-2EDA520972D6}) (Version: 1.00.00001 - Rockstar Games)
Herrscher des Olymp - Zeus (HKLM-x32\...\Herrscher des Olymp - Zeus) (Version: - )
High-Definition Video Playback (x32 Version: 11.1.11100.4.196 - Nero AG) Hidden
iTunes (HKLM\...\{7FCDABCC-1A1E-4D61-909D-BA9495172774}) (Version: 11.0.3.42 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217021FF}) (Version: 7.0.510 - Oracle)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Landwirtschafts Simulator 2011 (HKLM-x32\...\FarmingSimulator2011_PLATINUMDE_is1) (Version: 1.0 - GIANTS Software)
LEGO Rock Raiders (HKLM-x32\...\LEGO Rock Raiders) (Version: - )
Maple 15 (HKLM\...\Maple 15) (Version: - Maplesoft)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Age of Empires (HKLM-x32\...\Age of Empires) (Version: - )
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.30730.0 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{A106D33E-6B43-42C0-9BFC-D03303261FA7}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{0125D081-30D0-4A97-82A8-C28D444B6256}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (HKLM\...\{C3EAE456-7E7A-451F-80EF-F34C7A13C558}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft Visual Basic 2010 Express - DEU (HKLM-x32\...\Microsoft Visual Basic 2010 Express - DEU) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Runtime - 10.0.30319 (HKLM\...\{94D70749-4281-39AC-AD90-B56A0E0A402E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (HKLM-x32\...\{616C6F39-4CE1-3434-A665-2F6A04C09A7F}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (HKLM\...\{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Service Pack 1 (HKLM-x32\...\Microsoft Visual Studio 2010 Service Pack 1) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Thunderbird 15.0.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 15.0.1 (x86 de)) (Version: 15.0.1 - Mozilla)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
Need for Speed™ Most Wanted (HKLM-x32\...\{ADE91A13-434D-4229-00BC-182BAD607303}) (Version: - )
Nero 11 (HKLM-x32\...\{FC18AB8F-9BA3-423B-91F2-622990F57978}) (Version: 11.2.01000 - Nero AG)
Nitro Reader 2 (HKLM\...\{E274777F-0D6E-4509-A954-36B6DDEE8DAF}) (Version: 2.3.1.7 - Nitro PDF Software)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
OpenOffice.org 3.2 (HKLM-x32\...\{8D1E61D1-1395-4E97-997F-D002DB3A5074}) (Version: 3.2.9502 - OpenOffice.org)
Opera 12.17 (HKLM-x32\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
Patrizier II Gold (HKLM-x32\...\Patrizier II Gold_is1) (Version: - )
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Project64 1.6 (HKLM-x32\...\{9559F7CA-5E34-4237-A2D9-D856464AD727}) (Version: 1.6 - Project64)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
Race Driver 3 (HKLM-x32\...\{0297C87B-CC40-446F-865A-031B4FC0CF22}) (Version: 1.00.0000 - Codemasters)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.0.12114_1 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.0.12114_1 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
Sid Meier's Railroads! (HKLM-x32\...\{EE3FBD3C-782E-4A90-9507-0ECFE1FECCE4}) (Version: 1.00 - Firaxis Games)
Sid Meier's Railroads! (x32 Version: 1.00 - Firaxis Games) Hidden
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
SpeechRedist (HKLM-x32\...\{8795CBED-55E2-4693-9F14-84EC446935BE}) (Version: 1.0.0 - Epic Games Inc.)
Spotify (HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold 2 Deluxe (HKLM-x32\...\{16D2C649-CBA8-44EE-B730-12584667D487}) (Version: 1.40.100 - Firefly Studios)
Stronghold Crusader (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: - )
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab CYRI (HKLM-x32\...\{943A8D28-80D6-41DC-AE94-81FEB42041BF}) (Version: 4.5.1.0 - Husdawg, LLC)
Unity Web Player (HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
VirtualDJ Home FREE (HKLM-x32\...\{5E1375CB-6792-4464-8715-CC3EC83D48FA}) (Version: 7.0.5 - Atomix Productions)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (HKLM-x32\...\{CFCB8616-A5D1-4281-80E8-389F685BFAE2}) (Version: 4.0.8080.0 - Microsoft Corporation)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.2 (HKLM-x32\...\VLC media player) (Version: 2.0.2 - VideoLAN)
Welcome App (Start-up experience) (x32 Version: 11.0.23500.0.0 - Nero AG) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
Worms Armageddon - New Edition (HKLM-x32\...\Worms Armageddon - New Edition) (Version: 3.6.28.0 - Team17)
XFastUsb (HKLM-x32\...\XFastUsb) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\wdigest.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
06-12-2014 14:14:08 Windows Update
06-12-2014 21:04:35 Windows Anytime Upgrade
08-12-2014 12:35:16 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2013-06-28 20:46 - 00000644 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 static3.cdn.ubi.com
127.0.0.1 ubisoft-orbit.s3.amazonaws.com
127.0.0.1 onlineconfigservice.ubi.com
127.0.0.1 orbitservice.ubi.com
127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com
127.0.0.1 ubis.pointlimit.com
127.0.0.1 ownageserv.ubis.pointlimit.com
127.0.0.1 ownserv.ubis.pointlimit.com
127.0.0.1 oubis.pointlimit.com
127.0.0.1 save-game.ownageserv.ubis.pointlimit.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0415BFA8-3677-41FB-9090-98EA0B5BA624} - System32\Tasks\GlaryInitialize 5 => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2014-11-24] (Glarysoft Ltd)
Task: {04F1B2B6-2206-4D04-B15B-DF7F1F4EF761} - System32\Tasks\{13BB2B98-5F15-487E-9F08-08C95795430F} => D:\Spiele\Donald Duck\Donald.exe
Task: {07D4E065-BD26-42F3-9CAE-E4D55BB0DAFB} - System32\Tasks\{FF25B19F-FC87-46CA-B587-C826D7E17CA6} => E:\SETUP.EXE
Task: {08DC5D9E-B4A3-43BE-86C7-81DCD5EEF457} - System32\Tasks\{8D419F8F-B781-4909-A0AA-C9954C1F487B} => C:\Users\****\Desktop\Crashday\crashday-setup.exe
Task: {0ADD30E0-07EF-4D17-A8B5-C26E54BEDA1D} - System32\Tasks\{0A1926F5-37CE-4DB3-B165-A62C0988B044} => C:\Users\****\Desktop\Heim\HEIMARCH.EXE
Task: {0C75E650-0210-46C2-AA3A-6AFC59EFD24D} - System32\Tasks\{A4857274-BE90-4001-B9C5-44D3D009C237} => E:\SBK2001.exe
Task: {1008A5AC-D373-469B-BFB0-2B845C387506} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
Task: {12ACFDF0-97D6-4F28-9BDD-9A6981175394} - System32\Tasks\{4FC08126-A258-46C4-B954-554E31169B5B} => D:\Spiele\Crashday\Crashday.exe
Task: {2A7F80C4-B793-4241-9F9E-B38CB71B82EB} - System32\Tasks\{EB268299-7C27-4398-95C3-794A21C5CD0D} => D:\Spiele\Crashday\Crashday.exe
Task: {399840DB-E253-47A1-B15A-DDAEF20644D3} - System32\Tasks\{AABC3B2B-21B4-4F0B-8689-48B8F0675938} => C:\Users\****\Desktop\Crashday\Crack etc\Crack version 1.1\Crashday.exe
Task: {4CAD7681-C2FF-4E99-8D80-D44F69FD913D} - System32\Tasks\{E74B6DEB-22C9-4E93-8F1D-4F5710820F33} => D:\Spiele\Crashday\Crashday.exe
Task: {5149E504-F602-42F2-B898-003D78DDA438} - System32\Tasks\{5A6EFD6C-B4ED-498C-820A-6B81DF842604} => E:\Superbike 2001_EZ.exe
Task: {60AEDA0B-ACD8-4829-8983-CE92DFFBDD1C} - System32\Tasks\{2BFCE2A9-AD09-4631-962E-1A81FA5610E1} => E:\Superbike 2001_EZ.exe
Task: {64B56933-D235-4420-AAE8-705828CA0EFF} - System32\Tasks\{971092C5-FC75-4CA5-89D4-1DEF34428CFB} => C:\Program Files (x86)\Fifa Master\Manager Master 10\ManagerMaster10.exe
Task: {6E79C52C-855D-4918-9F14-05BF6AD49D80} - System32\Tasks\{A24A5E44-BCA4-4ABA-A071-D93E105A9006} => C:\Users\****\Desktop\Heim\HEIMARCH.EXE
Task: {77D1E36C-15C4-4DF1-B01D-00EF0D2DBA01} - System32\Tasks\{38F3E04A-236F-46AD-8DC0-E7A093F78844} => E:\Superbike 2001_EZ.exe
Task: {78588564-B6F3-477E-85D3-51FF434DA2CC} - System32\Tasks\{68DC886A-7B92-4429-81F7-B87C4FBB6293} => C:\Program Files (x86)\Cossacks\dmcr.exe
Task: {7B064CC5-971C-4764-BC57-74227D385122} - System32\Tasks\{C2256E19-B77A-42D4-A27E-CAC73CA095E5} => C:\Program Files (x86)\Core Design\Tomb Raider - The Last Revelation\tomb4.exe
Task: {7BDC800D-D27C-4006-8D15-75843D74BA60} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
Task: {7CFE8D41-633E-4FEF-A8E0-566D487DC875} - System32\Tasks\{868FD3CD-C55A-4E6C-9ECB-4436AC36DD33} => E:\Superbike 2001_EZ.exe
Task: {7F75B03C-5E56-4F37-AF06-7D6977CEE99C} - System32\Tasks\{1D2B6429-2FC8-4CD6-89D1-711B35762E36} => D:\Spiele\Donald Duck\Donald.exe
Task: {81C6BC23-8E84-4913-81B3-E6FB370CC58B} - System32\Tasks\{CAEA1068-B037-4C01-9CCD-9137B0D3BACD} => E:\SETUP.EXE
Task: {83297758-0BB4-4FC7-8DF1-F9E222F43A70} - System32\Tasks\{DBAFCFDF-EDD2-4F53-AB7D-A3BF6C5A4979} => D:\Spiele\Donald Duck\Donald.exe
Task: {870B69AD-4170-48F7-AC3E-67CEF1EE64B2} - System32\Tasks\{0F66B35E-14A1-4EF6-BDCD-7BEB89345B74} => C:\Users\****\Desktop\Heim\HEIMARCH.EXE
Task: {8BBA0335-8624-4177-9DA5-0FF0330D98CC} - System32\Tasks\{9E19ED60-460A-405A-9375-4F37E0C7D134} => C:\Users\****\Desktop\Crashday\crashday-setup.exe
Task: {8C89F43F-DF12-4180-A971-320E6A9536E5} - System32\Tasks\{A69F569F-A1BA-4342-BDC9-4F188F2FEE82} => E:\SBK2001.exe
Task: {91C2D4CE-BB19-489D-BA9F-1340A44AA14B} - System32\Tasks\{B3D28324-84B9-4D8D-92B7-6F971C105A21} => C:\Users\****\Desktop\Heim\HEIMARCH.EXE
Task: {9A2CA632-F6D1-444E-9901-54AEE74C6CF2} - System32\Tasks\{8CEE12BF-CF8F-475C-B2C8-7A03ABCDDBC7} => E:\Superbike 2001_EZ.exe
Task: {9CB80231-C0E5-47A0-8E38-58FF4CDB8B3E} - System32\Tasks\{DD9FA408-0D7C-472A-A9FB-37F5EAC1BB0B} => C:\Users\****\Desktop\Crashday\crashday-setup.exe
Task: {A12F450F-09D8-498A-94E6-260212BCE2D3} - System32\Tasks\{4EEA3EEE-2279-41F3-8F8B-830511AC91F7} => C:\Users\****\Desktop\Crashday\crashday-setup.exe
Task: {A376ECC3-3D50-4330-BC93-B81AE76F3A70} - System32\Tasks\GU5SkipUAC => C:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2014-11-24] (Glarysoft Ltd)
Task: {AA07DC1F-459D-45A4-80BD-081DC1222AC1} - System32\Tasks\{4F6374A9-08EE-4C34-BFBD-64D971D22084} => E:\Superbike 2001_EZ.exe
Task: {B0258455-9807-403D-9822-77D5D3F37361} - System32\Tasks\{9FD251D2-4178-46D9-9D69-E3AC66C0BDCB} => C:\Users\****\Desktop\Crashday\Crack etc\Crack Version 1.0\Crashday.exe
Task: {BC70082B-ED4E-4853-B166-A1C54A974C05} - System32\Tasks\{E1CE9A8A-D67E-4E49-8D9E-F579B288E7DB} => E:\INSTALL.EXE
Task: {C3E0DCBB-245C-43F4-A2E4-916EB6B7774C} - System32\Tasks\{434760EA-AB22-46F6-BF4B-8883B3EBC933} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-07-24] (Skype Technologies S.A.)
Task: {C83A29ED-FE13-46DE-A08F-0DC8A98C4923} - System32\Tasks\{4F5592AF-650C-496F-84BB-D786B7BDCA2A} => E:\INSTALL.EXE
Task: {CCCA2E0A-F240-4F5B-B7C7-DE9F370AC634} - System32\Tasks\{B6442EF7-C597-4550-8B5E-77BD89C2E357} => C:\Program Files (x86)\Fifa Master\Manager Master 10\ManagerMaster10.exe
Task: {CE156161-134B-4127-BE59-17BAF9774CD9} - System32\Tasks\{455F7C4E-0B69-4D0E-A0C1-71C338D33C5C} => C:\Users\****\Desktop\Heim\HEIMARCH.EXE
Task: {D3435E56-5960-42C9-AF2A-5CD08AABEE8A} - System32\Tasks\{9C54C6DF-5F95-4C32-BB1D-B525114F7A70} => D:\Spiele\Call of Duty\CoDSP.exe [2004-03-02] ()
Task: {DE66BB63-C480-4D3E-AB33-43D9E3C29081} - System32\Tasks\{39D0EB32-DD1A-4B7E-B6CE-CE2C328EF7DF} => C:\Program Files (x86)\Cossacks\dmcr.exe
Task: {DE83E8A3-3277-4C57-AD22-AFDBD414F7B2} - System32\Tasks\{C6EFCD6D-BC60-43EB-83BC-1FF85EE0331C} => D:\Spiele\Crashday\Crashday.exe
Task: {E5599498-27DC-496A-A80E-145D21D7E830} - System32\Tasks\{7090ADC9-695D-42E7-9D42-08FF977124BD} => E:\Superbike 2001_EZ.exe
Task: {EB874BD3-0873-4A04-B9F3-29FBA4A51495} - System32\Tasks\{5218DC41-8F35-4C49-A2F2-0B087123E492} => C:\Users\****\Desktop\Crashday\crashday-setup.exe
Task: {F732C5D7-065C-46A4-8C44-C748E8479E13} - System32\Tasks\{6CAD78D0-A404-4027-9D84-FBF4C0ED0349} => C:\Users\****\Desktop\Crashday\Crack etc\Crack Version 1.0\Crashday.exe
Task: {FEC81293-6F8B-477F-9DC3-66326410655E} - System32\Tasks\{7D1DF6B4-41DF-426D-968E-EC36EE278669} => C:\Program Files (x86)\Fifa Master\Manager Master 10\ManagerMaster10.exe
Task: C:\Windows\Tasks\GlaryInitialize 5.job => C:\Program Files (x86)\Glary Utilities 5\Initialize.exe
Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
==================== Loaded Modules (whitelisted) =============
2013-07-16 22:05 - 2013-01-31 10:25 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-12-16 13:39 - 2012-12-16 13:39 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2012-12-16 13:39 - 2012-12-16 13:39 - 00189248 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2011-09-28 19:26 - 2009-05-07 09:51 - 00071680 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2011-09-28 19:26 - 2009-05-07 09:53 - 00379392 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2011-09-28 19:26 - 2008-01-18 07:50 - 00098816 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2011-09-28 19:26 - 2009-11-03 04:12 - 47601664 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2012-12-13 14:45 - 2012-12-13 14:45 - 00063560 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: FlashPlayerUpdate => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_223_Plugin.exe -update plugin
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: XFastUsb => C:\Program Files (x86)\XFastUsb\XFastUsb.exe
========================= Accounts: ==========================
Administrator (S-1-5-21-2961250916-3466838546-2982623831-500 - Administrator - Disabled)
**** (S-1-5-21-2961250916-3466838546-2982623831-1000 - Administrator - Enabled) => C:\Users\****
Gast (S-1-5-21-2961250916-3466838546-2982623831-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2961250916-3466838546-2982623831-1005 - Limited - Enabled)
test (S-1-5-21-2961250916-3466838546-2982623831-1007 - Administrator - Enabled) => C:\Users\test
UpdatusUser (S-1-5-21-2961250916-3466838546-2982623831-1006 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: ttnfd
Description: ttnfd
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ttnfd
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/07/2014 03:14:03 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm avcenter.exe, Version 14.0.7.312 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: f50
Startzeit: 01d011c3246f148c
Endzeit: 6750
Anwendungspfad: C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
Berichts-ID: b0eba65a-7db6-11e4-984f-002522d798ef
Error: (12/06/2014 10:28:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm perfmon.exe, Version 6.1.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 10a4
Startzeit: 01d0119a33f873ee
Endzeit: 47
Anwendungspfad: C:\Windows\System32\perfmon.exe
Berichts-ID: cede73f1-7d8e-11e4-ae01-002522d798ef
Error: (12/06/2014 09:47:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm systempropertiesprotection.exe, Version 6.1.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: d0c
Startzeit: 01d01195ba343530
Endzeit: 10
Anwendungspfad: C:\Windows\system32\systempropertiesprotection.exe
Berichts-ID: 242d6e8b-7d89-11e4-ae01-002522d798ef
Error: (12/06/2014 07:21:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: rasppp.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5be03e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000300e4
ID des fehlerhaften Prozesses: 0x3b8
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0
Pfad der fehlerhaften Anwendung: svchost.exe1
Pfad des fehlerhaften Moduls: svchost.exe2
Berichtskennung: svchost.exe3
Error: (12/06/2014 01:31:49 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 9.0.8112.16470 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 954
Startzeit: 01d010eaf0f7dded
Endzeit: 458
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID: 421311a0-7cdf-11e4-acd7-002522d798ef
Error: (12/06/2014 01:13:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.1.1.5430, Zeitstempel: 0x54656826
Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.1.1.5430, Zeitstempel: 0x54654321
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x136c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (12/06/2014 01:13:03 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 33.1.1.5430 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: a38
Startzeit: 01d010e93cfabe07
Endzeit: 32
Anwendungspfad: C:\Programme\Mozilla Firefox\firefox.exe
Berichts-ID: a3bb5609-7cdc-11e4-b90a-002522d798ef
Error: (12/06/2014 01:10:40 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 9.0.8112.16470 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 11c8
Startzeit: 01d010e784515a3b
Endzeit: 235
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID: 4e0fce9a-7cdc-11e4-b90a-002522d798ef
Error: (12/06/2014 01:10:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.1.1.5430, Zeitstempel: 0x54656826
Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.1.1.5430, Zeitstempel: 0x54654321
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x136c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (12/06/2014 01:10:27 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 33.1.1.5430 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 4d8
Startzeit: 01d010e8e55a3c78
Endzeit: 47
Anwendungspfad: C:\Programme\Mozilla Firefox\firefox.exe
Berichts-ID: 45ade40c-7cdc-11e4-b90a-002522d798ef
System errors:
=============
Error: (12/08/2014 07:16:36 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ttnfd
Error: (12/08/2014 07:15:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%5
Error: (12/08/2014 05:49:37 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "SSDP-Suche" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (12/08/2014 05:49:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "UPnP-Gerätehost" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/08/2014 05:49:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "SSDP-Suche" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/08/2014 05:49:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows-Dienst für Schriftartencache" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/08/2014 05:49:27 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (12/08/2014 03:02:31 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {4991D34B-80A1-4291-83B6-3328366B9097}
Error: (12/08/2014 03:00:31 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {03CA98D6-FF5D-49B8-ABC6-03DD84127020}
Error: (12/08/2014 02:58:31 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {659CDEA7-489E-11D9-A9CD-000D56965251}
Microsoft Office Sessions:
=========================
Error: (12/07/2014 03:14:03 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: avcenter.exe14.0.7.312f5001d011c3246f148c6750C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exeb0eba65a-7db6-11e4-984f-002522d798ef
Error: (12/06/2014 10:28:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: perfmon.exe6.1.7600.1638510a401d0119a33f873ee47C:\Windows\System32\perfmon.execede73f1-7d8e-11e4-ae01-002522d798ef
Error: (12/06/2014 09:47:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: systempropertiesprotection.exe6.1.7600.16385d0c01d01195ba34353010C:\Windows\system32\systempropertiesprotection.exe242d6e8b-7d89-11e4-ae01-002522d798ef
Error: (12/06/2014 07:21:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe6.1.7600.163854a5bc3c1rasppp.dll6.1.7600.163854a5be03ec000000500000000000300e43b801d0116ca96c0234C:\Windows\system32\svchost.exeC:\Windows\system32\rasppp.dlla2cbe10a-7d74-11e4-ae01-002522d798ef
Error: (12/06/2014 01:31:49 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE9.0.8112.1647095401d010eaf0f7dded458C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE421311a0-7cdf-11e4-acd7-002522d798ef
Error: (12/06/2014 01:13:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe33.1.1.543054656826mozalloc.dll33.1.1.5430546543218000000300001425136c01d010e93d988babC:\Programme\Mozilla Firefox\plugin-container.exeC:\Programme\Mozilla Firefox\mozalloc.dlla4f3aa16-7cdc-11e4-b90a-002522d798ef
Error: (12/06/2014 01:13:03 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: firefox.exe33.1.1.5430a3801d010e93cfabe0732C:\Programme\Mozilla Firefox\firefox.exea3bb5609-7cdc-11e4-b90a-002522d798ef
Error: (12/06/2014 01:10:40 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE9.0.8112.1647011c801d010e784515a3b235C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE4e0fce9a-7cdc-11e4-b90a-002522d798ef
Error: (12/06/2014 01:10:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe33.1.1.543054656826mozalloc.dll33.1.1.5430546543218000000300001425136c01d010e8e925a495C:\Programme\Mozilla Firefox\plugin-container.exeC:\Programme\Mozilla Firefox\mozalloc.dll48080bf6-7cdc-11e4-b90a-002522d798ef
Error: (12/06/2014 01:10:27 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: firefox.exe33.1.1.54304d801d010e8e55a3c7847C:\Programme\Mozilla Firefox\firefox.exe45ade40c-7cdc-11e4-b90a-002522d798ef
CodeIntegrity Errors:
===================================
Date: 2013-02-17 18:08:40.401
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:40.275
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:37.513
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:37.389
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:34.418
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:34.292
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:31.743
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:31.617
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:29.353
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-02-17 18:08:29.224
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4600+
Percentage of memory in use: 67%
Total physical RAM: 2047.3 MB
Available physical RAM: 673.53 MB
Total Pagefile: 4094.61 MB
Available Pagefile: 2294 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:113.76 GB) (Free:8.4 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (SPIELE) (Fixed) (Total:114.25 GB) (Free:24.27 GB) NTFS
Drive e: (SIV_GER) (CDROM) (Total:0.37 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: BE08D558)
Partition 1: (Not Active) - (Size=4.9 GB) - (Type=12)
Partition 2: (Active) - (Size=113.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=114.2 GB) - (Type=07 NTFS)
==================== End Of Log ============================
GMER: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-08 20:36:23
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\0000005d ST325082 rev.3.AA 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\aglyapod.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\PnkBstrA.exe[1996] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000070d51a22 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1996] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000070d51ad0 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1996] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000070d51b08 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1996] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000070d51bba 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1996] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000070d51bda 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000070d51a22 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000070d51ad0 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000070d51b08 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000070d51bba 2 bytes [D5, 70]
.text C:\Windows\SysWOW64\PnkBstrB.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000070d51bda 2 bytes [D5, 70]
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW 0000000075631e2c 5 bytes JMP 0000000103378cbf
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\kernel32.dll!GetFileAttributesExW 00000000756332f2 5 bytes JMP 0000000103378c5f
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\USER32.dll!TranslateMessage 0000000076667d79 5 bytes JMP 000000010337ca46
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\USER32.dll!GetClipboardData 00000000766a9f3b 5 bytes JMP 000000010337cbac
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore 00000000771612b0 5 bytes JMP 000000010337d116
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!InternetCloseHandle 000000007541c664 5 bytes JMP 00000001033773d3
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA 000000007541e13a 5 bytes JMP 00000001033774cb
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!InternetReadFile 000000007541f8d8 5 bytes JMP 0000000103377416
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable 0000000075423184 5 bytes JMP 000000010337749f
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 000000007544632d 5 bytes JMP 00000001033771f3
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!InternetSetStatusCallback 000000007544c7aa 5 bytes JMP 000000010337759c
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!InternetReadFileExA 000000007544fa49 5 bytes JMP 0000000103377455
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW 000000007545f564 5 bytes JMP 000000010337729b
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 000000007547525a 5 bytes JMP 0000000103377247
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!InternetSetStatusCallbackW 000000007549df17 5 bytes JMP 00000001033775c0
.text C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe[2116] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA 00000000754bece5 5 bytes JMP 0000000103377337
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000757d1465 2 bytes [7D, 75]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757d14bb 2 bytes [7D, 75]
.text ... * 2
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW 0000000075631e2c 5 bytes JMP 0000000100088cbf
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\kernel32.dll!GetFileAttributesExW 00000000756332f2 5 bytes JMP 0000000100088c5f
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\USER32.dll!TranslateMessage 0000000076667d79 5 bytes JMP 000000010008ca46
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\USER32.dll!GetClipboardData 00000000766a9f3b 5 bytes JMP 000000010008cbac
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000757d1465 2 bytes [7D, 75]
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757d14bb 2 bytes [7D, 75]
.text ... * 2
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore 00000000771612b0 5 bytes JMP 000000010008d116
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!InternetCloseHandle 000000007541c664 5 bytes JMP 00000001000873d3
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA 000000007541e13a 5 bytes JMP 00000001000874cb
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!InternetReadFile 000000007541f8d8 5 bytes JMP 0000000100087416
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable 0000000075423184 5 bytes JMP 000000010008749f
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 000000007544632d 5 bytes JMP 00000001000871f3
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!InternetSetStatusCallback 000000007544c7aa 5 bytes JMP 000000010008759c
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!InternetReadFileExA 000000007544fa49 5 bytes JMP 0000000100087455
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW 000000007545f564 5 bytes JMP 000000010008729b
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 000000007547525a 5 bytes JMP 0000000100087247
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!InternetSetStatusCallbackW 000000007549df17 5 bytes JMP 00000001000875c0
.text C:\Windows\SysWOW64\explorer.exe[2460] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA 00000000754bece5 5 bytes JMP 0000000100087337
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW 0000000075631e2c 5 bytes JMP 0000000100268cbf
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\kernel32.dll!GetFileAttributesExW 00000000756332f2 5 bytes JMP 0000000100268c5f
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\USER32.dll!TranslateMessage 0000000076667d79 5 bytes JMP 000000010026ca46
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\USER32.dll!GetClipboardData 00000000766a9f3b 5 bytes JMP 000000010026cbac
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!InternetCloseHandle 000000007541c664 5 bytes JMP 00000001002673d3
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA 000000007541e13a 5 bytes JMP 00000001002674cb
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!InternetReadFile 000000007541f8d8 5 bytes JMP 0000000100267416
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable 0000000075423184 5 bytes JMP 000000010026749f
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 000000007544632d 5 bytes JMP 00000001002671f3
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!InternetSetStatusCallback 000000007544c7aa 5 bytes JMP 000000010026759c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!InternetReadFileExA 000000007544fa49 5 bytes JMP 0000000100267455
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW 000000007545f564 5 bytes JMP 000000010026729b
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 000000007547525a 5 bytes JMP 0000000100267247
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!InternetSetStatusCallbackW 000000007549df17 5 bytes JMP 00000001002675c0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA 00000000754bece5 5 bytes JMP 0000000100267337
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2480] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore 00000000771612b0 5 bytes JMP 000000010026d116
.text C:\Windows\explorer.exe[724] C:\Windows\system32\kernel32.dll!GetThreadPreferredUILanguages 00000000777b6ac0 5 bytes JMP 0000000077ad0298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\kernel32.dll!GetUserDefaultLocaleName + 1 00000000777fbca1 4 bytes {JMP 0x2c45f8}
.text C:\Windows\explorer.exe[724] C:\Windows\system32\kernel32.dll!GetSystemDefaultLocaleName + 1 00000000777fbcf1 4 bytes {JMP 0x2b45a8}
.text C:\Windows\explorer.exe[724] C:\Windows\system32\SHLWAPI.dll!GetAcceptLanguagesW 000007feff72bd80 5 bytes JMP 000007ffff620298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\SHLWAPI.dll!GetAcceptLanguagesA 000007feff746878 5 bytes JMP 000007ffff630298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff1787b0 5 bytes JMP 000007ffff130298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\WININET.dll!InternetSetCookieExW 000000007753e730 5 bytes JMP 00000001771b0298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\urlmon.dll!ObtainUserAgentString 00000000776d9660 5 bytes JMP 0000000077a80298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\winmm.dll!PlaySoundW 000007fefba32144 5 bytes JMP 000007fffba20298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\winmm.dll!waveOutOpen 000007fefba338d0 5 bytes JMP 000007fffba10298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\winmm.dll!PlaySound 000007fefba52f10 5 bytes JMP 000007fefba70298
.text C:\Windows\explorer.exe[724] C:\Windows\system32\mlang.dll!LcidToRfc1766W 000007fef2e81744 5 bytes JMP 000007fff2e70298
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000757d1465 2 bytes [7D, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757d14bb 2 bytes [7D, 75]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\Explorer.EXE [1836:420] 000000000013fb70
Thread C:\Windows\Explorer.EXE [1836:1596] 000000000013fb70
Thread C:\Windows\Explorer.EXE [1836:1592] 000000000013fb70
Thread C:\Windows\Explorer.EXE [1836:1588] 000000000013fb70
Thread C:\Windows\SysWOW64\explorer.exe [2460:2728] 0000000000093a59
Thread C:\Windows\SysWOW64\explorer.exe [2460:2732] 000000000008a84f
Thread C:\Windows\SysWOW64\explorer.exe [2460:2736] 00000000000893a2
Thread C:\Windows\SysWOW64\explorer.exe [2460:2740] 00000000000893a2
Thread C:\Windows\SysWOW64\explorer.exe [2460:2744] 000000000008cc64
Thread C:\Windows\SysWOW64\explorer.exe [2460:2748] 000000000008cd4c
Thread C:\Windows\explorer.exe [724:1248] 0000000000264280
Thread C:\Windows\explorer.exe [724:1660] 0000000000264280
Thread C:\Windows\explorer.exe [724:2852] 0000000000264280
Thread C:\Windows\explorer.exe [724:3204] 000000000011c7f4
Thread C:\Windows\explorer.exe [724:3944] 000000000011fddc
Thread C:\Windows\explorer.exe [724:2248] 000000000011fddc
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x52 0x44 0xC5 0x8D ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x6B 0xDB 0x47 0x2F ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x99 0xFC 0x80 0x1E ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x89 0x60 0xE8 0xF8 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x52 0x44 0xC5 0x8D ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x6B 0xDB 0x47 0x2F ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x99 0xFC 0x80 0x1E ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x89 0x60 0xE8 0xF8 ...
---- EOF - GMER 2.1 ----
Die Funde, die Avira meldet: Code:
ATTFilter Exportierte Ereignisse:
09.12.2014 20:24 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5\0MFG0HTG\e7e8ed993b30ab4d21dd13a6b4dd7367308b8b329fcc9abb47795
925b3b8f9d0[1].swf'
wurde ein Virus oder unerwünschtes Programm 'EXP/FLASH.Apsusihe.Gen' [exploit]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
09.12.2014 19:51 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\*****\AppData\Roaming\Umgiuk\odnuc.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Zbot.A.1461' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '51aed0a1.qua'
verschoben!
Der Registrierungseintrag
<HKEY_USERS\S-1-5-21-2961250916-3466838546-2982623831-1000\SOFTWARE\Microsoft\Wi
ndows\CurrentVersion\Run\{0021A06F-B1E9-A117-3A53-C7CA95E01643}> wurde
erfolgreich repariert.
09.12.2014 19:48 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\AppData\Roaming\Umgiuk\odnuc.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Zbot.A.1461' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
08.12.2014 15:42 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5\28KEXELZ\e7e8ed993b30ab4d21dd13a6b4dd7367308b8b329fcc9abb47795
925b3b8f9d0[1].swf'
wurde ein Virus oder unerwünschtes Programm 'EXP/FLASH.Apsusihe.Gen' [exploit]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.12.2014 15:25 [System-Scanner] Malware gefunden
Die Datei 'C:\ProgramData\Windows Genuine
Advantage\{BE48C20D-9BDE-43B6-A35E-E29A0F327FF9}\msiexec.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Agent.56320.323' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1dd5b7e0.qua'
verschoben!
07.12.2014 15:25 [System-Scanner] Malware gefunden
Die Datei 'C:\ProgramData\Windows Genuine
Advantage\{C66F43C1-F338-4EEF-A18E-8659F8EC38D4}\msiexec.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Agent.56320.323' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4f8aed08.qua'
verschoben!
07.12.2014 15:25 [System-Scanner] Malware gefunden
Die Datei 'C:\ProgramData\YimneLegpo\YimneLegpo.dat'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.105999'
[trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5701c2a1.qua'
verschoben!
07.12.2014 15:25 [System-Scanner] Malware gefunden
Die Datei 'C:\ProgramData\Windows Genuine
Advantage\{37B77F53-AED0-4157-8219-09CAC5E1822D}\msiexec.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.110527'
[trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3e66d51c.qua'
verschoben!
07.12.2014 15:25 [System-Scanner] Malware gefunden
Die Datei 'C:\ProgramData\Windows Genuine
Advantage\{9C0C952F-5DB7-4100-B2C7-4609F70BC1B6}\msiexec.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.110527'
[trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7be2f822.qua'
verschoben!
06.12.2014 21:46 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5\VKVEAHAQ\e7e8ed993b30ab4d21dd13a6b4dd7367308b8b329fcc9abb47795
925b3b8f9d0[1].swf'
wurde ein Virus oder unerwünschtes Programm 'EXP/FLASH.Apsusihe.Gen' [exploit]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
06.12.2014 21:46 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5\VKVEAHAQ\e7e8ed993b30ab4d21dd13a6b4dd7367308b8b329fcc9abb47795
925b3b8f9d0[1].swf'
wurde ein Virus oder unerwünschtes Programm 'EXP/FLASH.Apsusihe.Gen' [exploit]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
06.12.2014 21:45 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5\ZDWK88FQ\e7e8ed993b30ab4d21dd13a6b4dd7367308b8b329fcc9abb47795
925b3b8f9d0[1].swf'
wurde ein Virus oder unerwünschtes Programm 'EXP/FLASH.Apsusihe.Gen' [exploit]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
05.12.2014 23:43 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5\784LZ3G3\e7e8ed993b30ab4d21dd13a6b4dd7367308b8b329fcc9abb47795
925b3b8f9d0[1].swf'
wurde ein Virus oder unerwünschtes Programm 'EXP/FLASH.Apsusihe.Gen' [exploit]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.11.2014 23:01 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
30.11.2014 23:01 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\*****\Downloads\crashday game.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/MultiPlug.Gen7' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
Ich bedanke mich jetzt schon mal für die Hilfe. Und ich hoffe, dass ich mein Thema im richtigen Unterforum gepostet habe, ansonsten Entschuldige ich mich hier schon ein mal. Gruß Italiener Geändert von Italiener (09.12.2014 um 20:56 Uhr) Grund: Rechtschreibfehler |
|
09.12.2014, 20:54
| #2 |
| /// the machine /// TB-Ausbilder    | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager hi,
__________________Scan mit Combofix
__________________ |
|
09.12.2014, 21:45
| #3 |
| | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Hallo,
__________________hier das Ergebnis: Code:
ATTFilter ComboFix 14-12-08.01 - **** 09.12.2014 21:12:39.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.2047.245 [GMT 1:00]
ausgeführt von:: c:\users\****\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\****\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\****\AppData\Local\TempDIR
c:\users\****\AppData\Local\TempDIR\PIP2691_NDV_.exe
c:\windows\IsUn0407.exe
c:\windows\SysWow64\System32\MASetupCleaner.exe
c:\windows\SysWow64\System32\muzapp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-11-09 bis 2014-12-09 ))))))))))))))))))))))))))))))
.
.
2014-12-09 20:26 . 2014-12-09 20:34 -------- d-----w- c:\users\****\AppData\Local\temp
2014-12-09 20:26 . 2014-12-09 20:33 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-12-09 20:26 . 2014-12-09 20:26 -------- d-----w- c:\users\test\AppData\Local\temp
2014-12-09 20:26 . 2014-12-09 20:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-12-08 18:18 . 2014-12-08 18:22 -------- d-----w- C:\FRST
2014-12-08 12:05 . 2014-12-09 18:50 -------- d-----w- c:\users\****\AppData\Roaming\Umgiuk
2014-12-08 12:05 . 2014-12-08 23:33 -------- d-----w- c:\users\****\AppData\Roaming\Etenqy
2014-12-07 23:22 . 2014-12-07 23:23 -------- d-----w- c:\users\****\AppData\Roaming\concept design
2014-12-07 23:22 . 2014-12-07 23:22 -------- d-----w- c:\program files (x86)\concept design
2014-12-06 15:50 . 2014-11-24 06:01 28960 ----a-w- c:\windows\system32\RegBootDefrag.exe
2014-12-06 15:20 . 2014-12-06 15:20 -------- d-----w- c:\programdata\GlarySoft
2014-12-06 15:19 . 2014-12-06 15:19 20160 ----a-w- c:\windows\system32\drivers\GUBootStartup.sys
2014-12-06 15:19 . 2014-12-06 15:19 -------- d-----w- c:\users\****\AppData\Roaming\DiskDefrag
2014-12-06 15:19 . 2014-12-06 19:59 -------- d-----w- c:\program files (x86)\Glary Utilities 5
2014-12-05 14:02 . 2014-12-05 14:02 -------- d-----w- c:\programdata\CayeRfuro
2014-12-05 12:54 . 2014-12-09 20:34 -------- d--h--w- c:\programdata\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-12-01 19:39 . 2014-12-01 19:39 -------- d-----w- c:\programdata\FLEXnet
2014-12-01 14:53 . 2014-12-01 14:53 520584 ----a-r- c:\users\****\AppData\Roaming\Microsoft\Installer\{9D589081-AFC2-4932-9071-AC585AC1EA83}\UninstallTool.D01EB5D5_0EC4_4BDF_A131_1989F9F14A91.exe
2014-12-01 14:45 . 2014-12-02 14:11 -------- d-----w- c:\users\****\AppData\Local\Autodesk
2014-12-01 14:44 . 2014-12-01 14:44 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2014-12-01 14:37 . 2014-12-03 22:55 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2014-12-01 14:33 . 2014-12-03 22:12 -------- d-----w- c:\program files (x86)\Common Files\Autodesk Shared
2014-12-01 14:33 . 2010-06-02 03:55 239960 ----a-w- c:\windows\SysWow64\xactengine3_7.dll
2014-12-01 14:33 . 2010-06-02 03:55 176984 ----a-w- c:\windows\system32\xactengine3_7.dll
2014-12-01 14:33 . 2010-05-26 10:41 276832 ----a-w- c:\windows\system32\d3dx11_43.dll
2014-12-01 14:33 . 2010-05-26 10:41 248672 ----a-w- c:\windows\SysWow64\d3dx11_43.dll
2014-12-01 14:33 . 2010-05-26 10:41 1907552 ----a-w- c:\windows\system32\d3dcsx_43.dll
2014-12-01 14:33 . 2010-05-26 10:41 1868128 ----a-w- c:\windows\SysWow64\d3dcsx_43.dll
2014-12-01 14:04 . 2014-12-03 22:55 -------- d-----w- c:\programdata\Autodesk
2014-12-01 14:04 . 2014-12-03 22:12 -------- d-----w- c:\users\****\AppData\Roaming\Autodesk
2014-11-30 22:54 . 2014-11-30 22:54 -------- d--h--r- c:\programdata\SecuROM
2014-11-30 22:53 . 2014-11-30 22:53 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2014-11-30 22:53 . 2014-11-30 22:53 221184 ----a-w- c:\windows\SysWow64\UAService7.exe
2014-11-30 22:49 . 2014-11-30 22:49 -------- d-----w- c:\program files (x86)\Atari
2014-11-30 21:35 . 2014-11-30 21:35 -------- d-----w- c:\users\****\AppData\Local\Akamai
2014-11-30 21:35 . 2014-12-04 01:07 -------- d-----w- C:\Autodesk
2014-11-21 23:03 . 2014-11-21 23:03 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-11-21 22:58 . 2014-11-21 22:57 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2014-11-21 22:57 . 2014-11-21 22:57 -------- d-----w- c:\program files\Java
2014-11-21 22:31 . 2014-11-27 19:00 -------- d-----w- c:\users\****\AppData\Local\Adobe
2014-11-21 19:32 . 2014-12-07 14:25 -------- d-----w- c:\programdata\YimneLegpo
2014-11-21 19:32 . 2014-11-21 19:32 -------- d-----w- c:\programdata\MafoBajf
2014-11-13 14:50 . 2014-11-13 14:59 -------- d-----w- c:\users\****\AppData\Roaming\Modinstaller
2014-11-13 14:30 . 2014-11-23 17:18 -------- d-----w- c:\users\****\AppData\Roaming\Craften Terminal
2014-11-13 14:22 . 2014-11-13 14:22 -------- d-----w- c:\users\****\AppData\Roaming\TunkDesign
2014-11-13 12:19 . 2014-11-13 12:20 -------- d-----w- c:\program files (x86)\7-Zip
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-11-21 22:34 . 2012-11-09 16:08 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-11-21 22:34 . 2011-06-06 16:48 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-10-14 17:16 . 2014-05-13 20:29 43064 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-10-14 17:16 . 2014-05-13 14:26 131608 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-10-14 17:16 . 2014-05-13 14:26 119272 ----a-w- c:\windows\system32\drivers\avgntflt.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GUDelayStartup"="c:\program files (x86)\Glary Utilities 5\StartupManager.exe" [2014-11-24 37152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-12-04 2792448]
"VolPanel"="c:\program files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" [2009-05-04 241789]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-12-09 702768]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-10-22 124208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-10-07 507776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux9"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *
.
R1 ttnfd;ttnfd;c:\windows\system32\drivers\ttnfd.sys;c:\windows\SYSNATIVE\drivers\ttnfd.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys;c:\windows\SYSNATIVE\DRIVERS\acsock64.sys [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys;c:\windows\SYSNATIVE\drivers\dgderdrv.sys [x]
R3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe [x]
R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS;c:\windows\SYSNATIVE\drivers\FNETTBOH_305.SYS [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys;c:\windows\SYSNATIVE\Drivers\TFsExDisk.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 usbrndis6;USB-RNDIS6-Adapter;c:\windows\system32\DRIVERS\usb80236.sys;c:\windows\SYSNATIVE\DRIVERS\usb80236.sys [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AsrAppCharger.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS;c:\windows\SYSNATIVE\drivers\FNETURPX.SYS [x]
S1 GUBootStartup;GUBootStartup;c:\windows\System32\drivers\GUBootStartup.sys;c:\windows\SYSNATIVE\drivers\GUBootStartup.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [x]
S2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe;c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-12-09 c:\windows\Tasks\GlaryInitialize 5.job
- c:\program files (x86)\Glary Utilities 5\Initialize.exe [2014-11-24 05:59]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 21:08 164760 ----a-w- c:\users\****\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: app.update.auto - false
FF - user.js: browser.safebrowsing.enabled - false
FF - user.js: network.http.spdy.enabled - false
FF - user.js: network.http.spdy.enabled.v3 - false
FF - user.js: network.http.spdy.enabled.v3-1 - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Donald Duck - d:\spiele\DONALD~1\DeIsL1.isu
AddRemove-Herrscher des Olymp - Zeus - c:\windows\IsUn0407.exe
AddRemove-S4Uninst - c:\windows\IsUn0407.exe
AddRemove-UnityWebPlayer - c:\users\****\AppData\Local\Unity\WebPlayer\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1b,15,fe,c9,e6,ec,6d,c0,61,ec,d4,76,cd,7d,de,68,b0,e4,1e,ca,1f,05,04,
54,2f,ba,2b,a5,01,5a,a2,d1,98,84,90,65,e7,1d,cb,02,c1,e6,88,17,26,de,27,52,\
"??"=hex:b4,56,9a,c5,12,ac,8c,54,76,8f,f2,2f,f9,08,c7,36
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\windows\SysWOW64\PnkBstrB.exe
c:\windows\SysWOW64\UAService7.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-12-09 21:42:35 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-12-09 20:42
.
Vor Suchlauf: 8.197.230.592 Bytes frei
Nach Suchlauf: 8.289.021.952 Bytes frei
.
- - End Of File - - A0133994D628CF290D8A444BE6EF5C6F
A36C5E4F47E84449FF07ED3517B43A31
|
|
10.12.2014, 19:00
| #4 |
| /// the machine /// TB-Ausbilder | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.12.2014, 21:42
| #5 |
| | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Hallo schrauber, so hier die Ergebnisse: mbam.txt: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 10.12.2014 Suchlauf-Zeit: 20:04:39 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2014.12.10.08 Rootkit Datenbank: v2014.12.08.03 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 CPU: x64 Dateisystem: NTFS Benutzer: ***** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 468766 Verstrichene Zeit: 39 Min, 5 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 4 Trojan.FakeMS, HKLM\SOFTWARE\CLASSES\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}, In Quarantäne, [db558bd6ee8ec86e9e46c11dcc351ae6], PUP.Optional.TornTV.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\bicnnkjibmphdeigoodpjlcklcnaobdj, In Quarantäne, [3df362ff93e96cca2bdf6d1219ea31cf], PUP.Optional.TermTutor.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TTNFD, In Quarantäne, [f53b29385923de58c9629bc0b44f54ac], PUP.Optional.Softonic.A, HKU\S-1-5-21-2961250916-3466838546-2982623831-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Softonic, Löschen bei Neustart, [be72e77a7804043244f05eee0bf8e41c], Registrierungswerte: 1 PUP.Optional.TermTutor.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TTNFD|ImagePath, system32\drivers\ttnfd.sys, In Quarantäne, [f53b29385923de58c9629bc0b44f54ac] Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 2 Spyware.Passwords, C:\ProgramData\CayeRfuro\JiraGeqax.kpm, In Quarantäne, [1a16e08186f685b19c0a27cbb44d3bc5], Trojan.FakeMS, C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\wdigest.dll, Löschen bei Neustart, [db558bd6ee8ec86e9e46c11dcc351ae6], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.105 - Bericht erstellt am 10/12/2014 um 21:23:26
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-08.2 [Local]
# Betriebssystem : Windows 7 Home Premium (64 bits)
# Benutzername : ***** - *****
# Gestartet von : C:\Users\****\Desktop\AdwCleaner_4.105.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\ytd video downloader
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader
Ordner Gelöscht : C:\Program Files (x86)\ytd video downloader
Datei Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16470
-\\ Mozilla Firefox v33.1.1 (x86 de)
*************************
AdwCleaner[R2].txt - [1178 octets] - [10/12/2014 20:59:27]
AdwCleaner[S1].txt - [1053 octets] - [10/12/2014 21:23:26]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1113 octets] ##########
Junkware Remove Tool: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Home Premium x64
Ran by Carlo on 10.12.2014 at 21:30:47,95
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Carlo\appdata\local\{0E46DDBD-3037-421C-9FBC-669150B33DA6}
Successfully deleted: [Empty Folder] C:\Users\Carlo\appdata\local\{25BCE7D2-A473-4BDF-8F95-2870179CBBB0}
Successfully deleted: [Empty Folder] C:\Users\Carlo\appdata\local\{A5C957B4-0561-4DBD-ABC2-7D93FFDB1B76}
Successfully deleted: [Empty Folder] C:\Users\Carlo\appdata\local\{F013C6B3-9C2F-4360-B0CC-10175DD8B22E}
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.12.2014 at 21:35:41,30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-12-2014 01 Ran by ***** (administrator) on ****** on 10-12-2014 21:37:53 Running from C:\Users\*****\Desktop Loaded Profiles: ***** & UpdatusUser (Available profiles: ***** & UpdatusUser & test) Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe () C:\Windows\SysWOW64\PnkBstrA.exe () C:\Windows\SysWOW64\PnkBstrB.exe (Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Opera Software) C:\Program Files (x86)\Opera\opera.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2792448 2009-12-04] (VIA) HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files (x86)\AnVir Task Manager <====== ATTENTION HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-11-24] (Glarysoft Ltd) HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Policies\Explorer: [] BootExecute: autocheck autochk * ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000 -> {9ADEE868-A379-4C6D-968E-A0E0EB49F3DA} URL = https://www.google.com/search?q={searchTerms} BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll () FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~3\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: @videolan.org/vlc,version=2.0.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2961250916-3466838546-2982623831-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-2961250916-3466838546-2982623831-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-24] FF HKLM-x32\...\Thunderbird\Extensions: [avgthb@avg.com] - C:\Program Files (x86)\AVG\AVG2012\Thunderbird FF StartMenuInternet: FIREFOX.EXE - C:\Programme\Mozilla Firefox\firefox.exe Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [cfdfamfnacokbbbnmpdfmhonipnhmbid] - C:\Users\*****\AppData\LocalLow\Flagfox\CHROME\Flagfox.crx [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG) S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2011-09-28] (Creative Labs) [File not signed] R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [204304 2012-04-11] (Nitro PDF Software) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-12-16] () R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2012-12-16] () S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2011-09-28] (Creative Labs) [File not signed] R2 UserAccess7; C:\Windows\SysWOW64\UAService7.exe [221184 2014-11-30] (Sony DADC Austria AG.) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG) S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20552 2010-09-06] (Devguru Co., Ltd) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-12] (DT Soft Ltd) S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-09-29] (FNet Co., Ltd.) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-09-28] (FNet Co., Ltd.) S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] () [File not signed] R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2014-12-06] (Glarysoft Ltd) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-10] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-05-17] (Duplex Secure Ltd.) S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2009-07-14] (Microsoft Corporation) S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] () S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-10 21:35 - 2014-12-10 21:35 - 00001051 _____ () C:\Users\*****\Desktop\JRT.txt 2014-12-10 21:30 - 2014-12-10 21:30 - 01707646 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe 2014-12-10 21:30 - 2014-12-10 21:30 - 00000000 ____D () C:\Windows\ERUNT 2014-12-10 21:27 - 2014-12-10 21:27 - 00001188 _____ () C:\Users\*****\Desktop\AdwCleaner[S1].txt 2014-12-10 20:57 - 2014-12-10 20:57 - 02166272 _____ () C:\Users\*****\Desktop\AdwCleaner_4.105.exe 2014-12-10 20:51 - 2014-12-10 21:23 - 00000000 ____D () C:\Users\TEMP.italiener 2014-12-10 20:45 - 2014-12-10 20:54 - 00002107 _____ () C:\Users\*****\Desktop\mbam.txt 2014-12-10 20:02 - 2014-12-10 21:29 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-10 20:01 - 2014-12-10 20:01 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-10 20:01 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-10 20:01 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-10 20:01 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-10 19:44 - 2014-12-10 19:44 - 02119680 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe 2014-12-10 19:44 - 2014-12-10 19:44 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe 2014-12-09 21:47 - 2014-12-10 14:40 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Ynsiav 2014-12-09 21:47 - 2014-12-10 01:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Urdexu 2014-12-09 21:42 - 2014-12-09 21:42 - 00023480 _____ () C:\Users\*****\Desktop\ComboFix.txt 2014-12-09 21:30 - 2014-12-10 21:25 - 00005284 _____ () C:\Windows\PFRO.log 2014-12-09 21:07 - 2014-12-09 21:42 - 00000000 ____D () C:\Qoobox 2014-12-09 21:07 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-12-09 21:07 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-12-09 21:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-12-09 21:06 - 2014-12-09 21:39 - 00000000 ____D () C:\Windows\erdnt 2014-12-09 20:59 - 2014-12-09 21:00 - 05601243 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe 2014-12-09 20:30 - 2014-12-09 20:52 - 00017506 _____ () C:\Users\*****\Desktop\Avira Funde.txt 2014-12-09 20:16 - 2014-12-09 20:24 - 00000526 _____ () C:\Users\*****\Desktop\defogger_disable.log 2014-12-08 20:36 - 2014-12-08 20:37 - 00021723 _____ () C:\Users\*****\Desktop\Gmer.txt 2014-12-08 19:21 - 2014-12-08 19:29 - 00047137 _____ () C:\Users\*****\Desktop\Addition.txt 2014-12-08 19:19 - 2014-12-10 21:37 - 00014700 _____ () C:\Users\*****\Desktop\FRST.txt 2014-12-08 19:18 - 2014-12-10 21:37 - 00000000 ____D () C:\FRST 2014-12-08 19:13 - 2014-12-08 19:13 - 00000020 _____ () C:\Users\*****\defogger_reenable 2014-12-08 19:12 - 2014-12-08 19:12 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe 2014-12-08 13:05 - 2014-12-09 19:50 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Umgiuk 2014-12-08 13:05 - 2014-12-09 00:33 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Etenqy 2014-12-08 00:22 - 2014-12-08 00:23 - 00000000 ____D () C:\Users\*****\AppData\Roaming\concept design 2014-12-08 00:22 - 2014-12-08 00:22 - 00001233 _____ () C:\Users\*****\Desktop\onlineTV 10.lnk 2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\concept design 2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\concept design 2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\Program Files (x86)\concept design 2014-12-07 16:18 - 2014-12-07 16:18 - 00233737 _____ () C:\Users\*****\AppData\Local\census.cache 2014-12-07 16:17 - 2014-12-07 16:17 - 00125646 _____ () C:\Users\*****\AppData\Local\ars.cache 2014-12-07 15:36 - 2014-12-07 15:36 - 00000036 _____ () C:\Users\*****\AppData\Local\housecall.guid.cache 2014-12-07 15:27 - 2014-12-07 15:27 - 00061970 _____ () C:\Users\*****\Desktop\AVSCAN-20141207-031446-C00237E2.LOG 2014-12-06 21:53 - 2014-12-06 21:53 - 00001281 _____ () C:\Windows\IE11_main.log 2014-12-06 16:52 - 2014-12-10 21:25 - 00014672 _____ () C:\Windows\setupact.log 2014-12-06 16:52 - 2014-12-06 16:52 - 00000000 _____ () C:\Windows\setuperr.log 2014-12-06 16:50 - 2014-11-24 07:01 - 00028960 _____ (Glarysoft Ltd) C:\Windows\system32\RegBootDefrag.exe 2014-12-06 16:20 - 2014-12-06 16:20 - 00002974 _____ () C:\Windows\System32\Tasks\GU5SkipUAC 2014-12-06 16:20 - 2014-12-06 16:20 - 00001100 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk 2014-12-06 16:20 - 2014-12-06 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5 2014-12-06 16:20 - 2014-12-06 16:20 - 00000000 ____D () C:\ProgramData\GlarySoft 2014-12-06 16:19 - 2014-12-10 21:26 - 00000334 _____ () C:\Windows\Tasks\GlaryInitialize 5.job 2014-12-06 16:19 - 2014-12-06 20:59 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5 2014-12-06 16:19 - 2014-12-06 16:20 - 00002632 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5 2014-12-06 16:19 - 2014-12-06 16:19 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys 2014-12-06 16:19 - 2014-12-06 16:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DiskDefrag 2014-12-05 15:02 - 2014-12-10 20:45 - 00000000 ____D () C:\ProgramData\CayeRfuro 2014-12-05 13:54 - 2014-12-10 20:46 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8} 2014-12-03 23:08 - 2014-12-03 23:10 - 11254840 _____ () C:\Users\*****\Downloads\Autodesk_Inventor_2015_R1_German_Win_64bit_wi_de-DE_Setup.exe 2014-12-01 20:39 - 2014-12-01 20:39 - 00000000 ____D () C:\ProgramData\FLEXnet 2014-12-01 16:02 - 2014-12-01 16:02 - 00000000 ____D () C:\Users\*****\Documents\Autodesk Application Manager 2014-12-01 15:46 - 2014-12-01 15:46 - 00000000 ____D () C:\Users\*****\Documents\Inventor Server SDK ACAD 2015 2014-12-01 15:45 - 2014-12-02 15:11 - 00000000 ____D () C:\Users\*****\AppData\Local\Autodesk 2014-12-01 15:44 - 2014-12-01 15:44 - 00000000 ____D () C:\Program Files\Common Files\Macrovision Shared 2014-12-01 15:37 - 2014-12-03 23:55 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared 2014-12-01 15:36 - 2014-12-03 23:12 - 00000000 ____D () C:\Users\Public\Documents\Autodesk 2014-12-01 15:33 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll 2014-12-01 15:33 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll 2014-12-01 15:33 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll 2014-12-01 15:33 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll 2014-12-01 15:33 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2014-12-01 15:33 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll 2014-12-01 15:04 - 2014-12-03 23:55 - 00000000 ____D () C:\ProgramData\Autodesk 2014-12-01 15:04 - 2014-12-03 23:12 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Autodesk 2014-12-01 00:09 - 2014-12-01 00:09 - 00000458 _____ () C:\memory.txt 2014-11-30 23:54 - 2014-11-30 23:54 - 00000000 __RHD () C:\ProgramData\SecuROM 2014-11-30 23:53 - 2014-11-30 23:53 - 00221184 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe 2014-11-30 23:53 - 2014-11-30 23:53 - 00098304 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt.dll 2014-11-30 23:49 - 2014-11-30 23:49 - 00000000 ____D () C:\Program Files (x86)\Atari 2014-11-30 22:35 - 2014-12-04 02:07 - 00000000 ____D () C:\Autodesk 2014-11-30 22:35 - 2014-11-30 22:35 - 00000000 ____D () C:\Users\*****\AppData\Local\Akamai 2014-11-21 23:58 - 2014-11-21 23:57 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-11-21 23:57 - 2014-11-21 23:57 - 00000000 ____D () C:\Program Files\Java 2014-11-21 23:31 - 2014-11-27 20:00 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe 2014-11-21 20:32 - 2014-12-07 15:25 - 00000000 ____D () C:\ProgramData\YimneLegpo 2014-11-21 20:32 - 2014-12-05 14:44 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage 2014-11-21 20:32 - 2014-11-21 20:32 - 00000000 ____D () C:\ProgramData\MafoBajf 2014-11-13 15:54 - 2014-11-13 15:54 - 00000000 ____D () C:\Users\*****\Downloads\Minecraft 2014-11-13 15:30 - 2014-11-23 18:18 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Craften Terminal 2014-11-13 15:30 - 2014-11-13 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Craften Terminal 2014-11-13 15:28 - 2014-12-06 01:19 - 00000000 ____D () C:\Users\*****\Desktop\KL 2014-11-13 15:22 - 2014-11-13 15:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\TunkDesign 2014-11-13 15:18 - 2014-11-13 15:18 - 00098550 _____ () C:\Users\*****\Downloads\xray_1.7.4.zip 2014-11-13 13:19 - 2014-11-13 13:20 - 00000000 ____D () C:\Program Files (x86)\7-Zip 2014-11-13 13:19 - 2014-11-13 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-10 21:34 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-10 21:34 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-10 21:25 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-10 21:24 - 2010-11-29 20:29 - 01754156 _____ () C:\Windows\WindowsUpdate.log 2014-12-10 21:23 - 2014-09-24 20:28 - 00000000 ____D () C:\AdwCleaner 2014-12-10 20:52 - 2014-09-11 13:22 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2BB45ECA-2C65-44E6-AA63-BC2D7A26E258} 2014-12-10 19:46 - 2012-09-20 17:25 - 00000000 ____D () C:\Users\*****\Desktop\Spiele 2014-12-09 21:42 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-12-09 21:34 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-12-09 21:05 - 2010-11-29 23:37 - 00007603 _____ () C:\Users\*****\AppData\Local\Resmon.ResmonCfg 2014-12-09 20:12 - 2010-11-29 20:41 - 00000000 ____D () C:\Users\***** 2014-12-08 21:46 - 2012-09-02 20:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Nitro PDF 2014-12-08 19:13 - 2013-05-15 18:39 - 00000000 ____D () C:\Program Files (x86)\Opera 2014-12-08 14:52 - 2013-03-21 13:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-12-08 14:52 - 2013-03-21 13:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-12-08 13:38 - 2013-03-21 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-12-07 01:19 - 2014-05-13 15:47 - 00085304 _____ () C:\Users\test\AppData\Local\GDIPFONTCACHEV1.DAT 2014-12-07 01:11 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-06 16:52 - 2009-07-14 03:34 - 78381056 _____ () C:\Windows\system32\config\software.gu.bak 2014-12-06 16:52 - 2009-07-14 03:34 - 22020096 _____ () C:\Windows\system32\config\system.gu.bak 2014-12-06 16:52 - 2009-07-14 03:34 - 01835008 _____ () C:\Windows\system32\config\default.gu.bak 2014-12-06 16:52 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.gu.bak 2014-12-06 16:51 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.gu.bak 2014-12-06 16:39 - 2012-08-12 14:25 - 00000000 ____D () C:\Users\*****\AppData\Local\Nero 2014-12-06 16:36 - 2014-05-12 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Counter-Strike 1.6 2014-12-06 16:20 - 2012-12-20 15:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\GlarySoft 2014-12-06 13:31 - 2011-08-19 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty - United Offensive 2014-12-06 01:13 - 2011-10-15 00:08 - 00000000 ____D () C:\Users\*****\AppData\Local\CrashDumps 2014-12-05 17:43 - 2011-12-19 18:15 - 00000000 ___RD () C:\Users\*****\Dropbox 2014-12-05 15:13 - 2011-12-19 18:11 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox 2014-12-05 11:39 - 2009-07-14 18:58 - 09519834 _____ () C:\Windows\system32\perfh007.dat 2014-12-05 11:39 - 2009-07-14 18:58 - 02902158 _____ () C:\Windows\system32\perfc007.dat 2014-12-05 11:39 - 2009-07-14 06:13 - 00006276 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-05 11:27 - 2010-11-30 18:37 - 00085304 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT 2014-12-05 11:16 - 2009-07-14 05:45 - 00344656 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-03 22:17 - 2012-06-27 00:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Spotify 2014-12-03 13:36 - 2012-10-18 11:30 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-12-03 13:22 - 2012-06-27 00:23 - 00000000 ____D () C:\Users\*****\AppData\Local\Spotify 2014-12-01 16:01 - 2014-05-13 15:14 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-01 15:12 - 2010-11-29 22:11 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-11-28 17:02 - 2012-12-15 16:27 - 00000000 ____D () C:\Users\*****\Desktop\Musik 2014-11-28 16:11 - 2006-08-11 20:42 - 00000000 ___RD () C:\Programme 2014-11-23 18:24 - 2014-11-02 23:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\.minecraft 2014-11-21 23:57 - 2014-02-01 13:13 - 00000000 ____D () C:\ProgramData\Oracle 2014-11-21 23:57 - 2014-02-01 13:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-11-21 23:34 - 2012-11-09 17:08 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-21 23:34 - 2011-06-06 17:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-21 23:33 - 2014-02-03 21:45 - 00000000 ____D () C:\Users\*****\Desktop\FF 2014-11-19 21:08 - 2013-05-15 18:39 - 00001849 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2014-11-19 21:08 - 2013-04-06 18:13 - 00000872 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-11-11 15:12 - 2014-05-13 15:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-11-11 15:12 - 2014-05-13 15:14 - 00000000 ____D () C:\Program Files (x86)\Avira Files to move or delete: ==================== C:\ProgramData\j62j6xbe.fee Some content of TEMP: ==================== C:\Users\*****\AppData\Local\temp\avgnt.exe C:\Users\*****\AppData\Local\temp\Quarantine.exe C:\Users\*****\AppData\Local\temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-05 11:56 ==================== End Of Log ============================ Gruß, Italiener |
|
11.12.2014, 20:08
| #6 |
| /// the machine /// TB-Ausbilder | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-ManagerESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager |
|
12.12.2014, 01:23
| #7 |
| | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Hallo schrauber, mit einwenig Verzögerung kommen die Ergebnisse. Eset hat ganz schön lang gebraucht. Naja, was solls. Eset log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=810ad76b8fe8ec4da2ffa0de9effc46c
# engine=21512
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-12 12:01:51
# local_time=2014-12-12 01:01:51 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 34680 25024847 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 104589713 170748182 0 0
# scanned=323578
# found=9
# cleaned=0
# scan_time=15447
sh=DBBA01BF7D046004AFC9C9164146E865CE70E394 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\user.js.vir"
sh=790E27F25572D48DD39F85D8DBC2FFC32C2F4B03 ft=1 fh=47ecfaa9e493f208 vn="Variante von Win32/Kryptik.CRGS Trojaner" ac=I fn="C:\ProgramData\MafoBajf\MafoBajf.dat"
sh=790E27F25572D48DD39F85D8DBC2FFC32C2F4B03 ft=1 fh=47ecfaa9e493f208 vn="Variante von Win32/Kryptik.CRGS Trojaner" ac=I fn="C:\Users\All Users\MafoBajf\MafoBajf.dat"
sh=4201EC3B2FB8A16842032CDCA68941C929FDAC96 ft=0 fh=0000000000000000 vn="JS/Exploit.Agent.NIB Trojaner" ac=I fn="C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0MFG0HTG\0a7hvoy7zg[1].htm"
sh=902623D8DD00AEB9FAF43AC9C972DEFAB3031C5C ft=0 fh=0000000000000000 vn="HTML/Refresh.BC Trojaner" ac=I fn="C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\33FO55SV\footballnext[1].htm"
sh=8A265E91938CFEC3DBBD6521C77F9F53F5DC1E6A ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen Virus" ac=I fn="C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQOIO2UU\counter[1].htm"
sh=B1F44107E86A7C094DCC6DFBEBDB510EA4960414 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\prefs.js"
sh=B7AA72BAF263028294BD070B7CC6E649B9C2598E ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\prefs.js.BAK"
sh=6E0CCC941A866F83528626A277EBFB9568884AAC ft=1 fh=fac715e54b22fe4e vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\*****\Downloads\Adventskalender\Adventskalender Chip 2012\ashampoo_burning_studio_2013_11.0.5_12335.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.91
Windows 7 x64 (UAC is enabled)
Out of date service pack!!
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 51
Java version 32-bit out of Date!
Adobe Flash Player 15.0.0.223
Adobe Reader 10.1.1 Adobe Reader out of Date!
Mozilla Firefox (33.1.1)
Mozilla Thunderbird 15.0.1 Thunderbird out of Date!
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-12-2014 01
Ran by ***** (administrator) on ****** on 12-12-2014 01:16:03
Running from C:\Users\*****\Desktop
Loaded Profiles: ***** & UpdatusUser (Available profiles: ***** & UpdatusUser & test)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2792448 2009-12-04] (VIA)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\AnVir Task Manager <====== ATTENTION
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-11-24] (Glarysoft Ltd)
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Policies\Explorer: []
BootExecute: autocheck autochk *
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000 -> {9ADEE868-A379-4C6D-968E-A0E0EB49F3DA} URL = https://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~3\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2961250916-3466838546-2982623831-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-2961250916-3466838546-2982623831-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-24]
FF HKLM-x32\...\Thunderbird\Extensions: [avgthb@avg.com] - C:\Program Files (x86)\AVG\AVG2012\Thunderbird
FF StartMenuInternet: FIREFOX.EXE - C:\Programme\Mozilla Firefox\firefox.exe
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [cfdfamfnacokbbbnmpdfmhonipnhmbid] - C:\Users\*****\AppData\LocalLow\Flagfox\CHROME\Flagfox.crx [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2011-09-28] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [204304 2012-04-11] (Nitro PDF Software)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-12-16] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2012-12-16] ()
S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2011-09-28] (Creative Labs) [File not signed]
R2 UserAccess7; C:\Windows\SysWOW64\UAService7.exe [221184 2014-11-30] (Sony DADC Austria AG.) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20552 2010-09-06] (Devguru Co., Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-12] (DT Soft Ltd)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-09-29] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-09-28] (FNet Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] () [File not signed]
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2014-12-06] (Glarysoft Ltd)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-05-17] (Duplex Secure Ltd.)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2009-07-14] (Microsoft Corporation)
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-12 01:15 - 2014-12-12 01:15 - 00001090 _____ () C:\Users\*****\Desktop\checkup.txt
2014-12-12 01:08 - 2014-12-12 01:08 - 00852490 _____ () C:\Users\*****\Desktop\SecurityCheck.exe
2014-12-10 21:35 - 2014-12-10 21:35 - 00001051 _____ () C:\Users\*****\Desktop\JRT.txt
2014-12-10 21:30 - 2014-12-10 21:30 - 01707646 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2014-12-10 21:30 - 2014-12-10 21:30 - 00000000 ____D () C:\Windows\ERUNT
2014-12-10 21:27 - 2014-12-10 21:27 - 00001188 _____ () C:\Users\*****\Desktop\AdwCleaner[S1].txt
2014-12-10 20:57 - 2014-12-10 20:57 - 02166272 _____ () C:\Users\*****\Desktop\AdwCleaner_4.105.exe
2014-12-10 20:51 - 2014-12-10 21:23 - 00000000 ____D () C:\Users\TEMP.italiener
2014-12-10 20:45 - 2014-12-10 20:54 - 00002107 _____ () C:\Users\*****\Desktop\mbam.txt
2014-12-10 20:02 - 2014-12-11 21:11 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-10 20:01 - 2014-12-10 20:01 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-12-10 20:01 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-10 20:01 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-10 20:01 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-10 19:44 - 2014-12-10 19:44 - 02119680 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2014-12-10 19:44 - 2014-12-10 19:44 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe
2014-12-09 21:47 - 2014-12-10 14:40 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Ynsiav
2014-12-09 21:47 - 2014-12-10 01:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Urdexu
2014-12-09 21:42 - 2014-12-09 21:42 - 00023480 _____ () C:\Users\*****\Desktop\ComboFix.txt
2014-12-09 21:30 - 2014-12-10 21:25 - 00005284 _____ () C:\Windows\PFRO.log
2014-12-09 21:07 - 2014-12-09 21:42 - 00000000 ____D () C:\Qoobox
2014-12-09 21:07 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-09 21:07 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-09 21:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-09 21:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-09 21:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-09 21:07 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-09 21:07 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-09 21:07 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-09 21:06 - 2014-12-09 21:39 - 00000000 ____D () C:\Windows\erdnt
2014-12-09 20:59 - 2014-12-09 21:00 - 05601243 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2014-12-09 20:30 - 2014-12-09 20:52 - 00017506 _____ () C:\Users\*****\Desktop\Avira Funde.txt
2014-12-09 20:16 - 2014-12-09 20:24 - 00000526 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-12-08 20:36 - 2014-12-08 20:37 - 00021723 _____ () C:\Users\*****\Desktop\Gmer.txt
2014-12-08 19:21 - 2014-12-08 19:29 - 00047137 _____ () C:\Users\*****\Desktop\Addition.txt
2014-12-08 19:19 - 2014-12-12 01:16 - 00014428 _____ () C:\Users\*****\Desktop\FRST.txt
2014-12-08 19:18 - 2014-12-12 01:16 - 00000000 ____D () C:\FRST
2014-12-08 19:13 - 2014-12-08 19:13 - 00000020 _____ () C:\Users\*****\defogger_reenable
2014-12-08 19:12 - 2014-12-08 19:12 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2014-12-08 13:05 - 2014-12-09 19:50 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Umgiuk
2014-12-08 13:05 - 2014-12-09 00:33 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Etenqy
2014-12-08 00:22 - 2014-12-08 00:23 - 00000000 ____D () C:\Users\*****\AppData\Roaming\concept design
2014-12-08 00:22 - 2014-12-08 00:22 - 00001233 _____ () C:\Users\*****\Desktop\onlineTV 10.lnk
2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\concept design
2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\concept design
2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\Program Files (x86)\concept design
2014-12-07 16:18 - 2014-12-07 16:18 - 00233737 _____ () C:\Users\*****\AppData\Local\census.cache
2014-12-07 16:17 - 2014-12-07 16:17 - 00125646 _____ () C:\Users\*****\AppData\Local\ars.cache
2014-12-07 15:36 - 2014-12-07 15:36 - 00000036 _____ () C:\Users\*****\AppData\Local\housecall.guid.cache
2014-12-07 15:27 - 2014-12-07 15:27 - 00061970 _____ () C:\Users\*****\Desktop\AVSCAN-20141207-031446-C00237E2.LOG
2014-12-06 21:53 - 2014-12-06 21:53 - 00001281 _____ () C:\Windows\IE11_main.log
2014-12-06 16:52 - 2014-12-12 01:15 - 00017864 _____ () C:\Windows\setupact.log
2014-12-06 16:52 - 2014-12-06 16:52 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-06 16:50 - 2014-11-24 07:01 - 00028960 _____ (Glarysoft Ltd) C:\Windows\system32\RegBootDefrag.exe
2014-12-06 16:20 - 2014-12-06 16:20 - 00002974 _____ () C:\Windows\System32\Tasks\GU5SkipUAC
2014-12-06 16:20 - 2014-12-06 16:20 - 00001100 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2014-12-06 16:20 - 2014-12-06 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2014-12-06 16:20 - 2014-12-06 16:20 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-12-06 16:19 - 2014-12-11 16:20 - 00000334 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2014-12-06 16:19 - 2014-12-06 20:59 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2014-12-06 16:19 - 2014-12-06 16:20 - 00002632 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5
2014-12-06 16:19 - 2014-12-06 16:19 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2014-12-06 16:19 - 2014-12-06 16:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DiskDefrag
2014-12-05 15:02 - 2014-12-10 20:45 - 00000000 ____D () C:\ProgramData\CayeRfuro
2014-12-05 13:54 - 2014-12-10 20:46 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-12-03 23:08 - 2014-12-03 23:10 - 11254840 _____ () C:\Users\*****\Downloads\Autodesk_Inventor_2015_R1_German_Win_64bit_wi_de-DE_Setup.exe
2014-12-01 20:39 - 2014-12-01 20:39 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-12-01 16:02 - 2014-12-01 16:02 - 00000000 ____D () C:\Users\*****\Documents\Autodesk Application Manager
2014-12-01 15:46 - 2014-12-01 15:46 - 00000000 ____D () C:\Users\*****\Documents\Inventor Server SDK ACAD 2015
2014-12-01 15:45 - 2014-12-02 15:11 - 00000000 ____D () C:\Users\*****\AppData\Local\Autodesk
2014-12-01 15:44 - 2014-12-01 15:44 - 00000000 ____D () C:\Program Files\Common Files\Macrovision Shared
2014-12-01 15:37 - 2014-12-03 23:55 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2014-12-01 15:36 - 2014-12-03 23:12 - 00000000 ____D () C:\Users\Public\Documents\Autodesk
2014-12-01 15:33 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-12-01 15:33 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-12-01 15:04 - 2014-12-03 23:55 - 00000000 ____D () C:\ProgramData\Autodesk
2014-12-01 15:04 - 2014-12-03 23:12 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Autodesk
2014-12-01 00:09 - 2014-12-01 00:09 - 00000458 _____ () C:\memory.txt
2014-11-30 23:54 - 2014-11-30 23:54 - 00000000 __RHD () C:\ProgramData\SecuROM
2014-11-30 23:53 - 2014-11-30 23:53 - 00221184 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe
2014-11-30 23:53 - 2014-11-30 23:53 - 00098304 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt.dll
2014-11-30 23:49 - 2014-11-30 23:49 - 00000000 ____D () C:\Program Files (x86)\Atari
2014-11-30 22:35 - 2014-12-04 02:07 - 00000000 ____D () C:\Autodesk
2014-11-30 22:35 - 2014-11-30 22:35 - 00000000 ____D () C:\Users\*****\AppData\Local\Akamai
2014-11-21 23:58 - 2014-11-21 23:57 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-11-21 23:57 - 2014-11-21 23:57 - 00000000 ____D () C:\Program Files\Java
2014-11-21 23:31 - 2014-11-27 20:00 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe
2014-11-21 20:32 - 2014-12-07 15:25 - 00000000 ____D () C:\ProgramData\YimneLegpo
2014-11-21 20:32 - 2014-12-05 14:44 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
2014-11-21 20:32 - 2014-11-21 20:32 - 00000000 ____D () C:\ProgramData\MafoBajf
2014-11-13 15:54 - 2014-11-13 15:54 - 00000000 ____D () C:\Users\*****\Downloads\Minecraft
2014-11-13 15:30 - 2014-11-23 18:18 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Craften Terminal
2014-11-13 15:30 - 2014-11-13 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Craften Terminal
2014-11-13 15:28 - 2014-12-06 01:19 - 00000000 ____D () C:\Users\*****\Desktop\KL
2014-11-13 15:22 - 2014-11-13 15:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\TunkDesign
2014-11-13 15:18 - 2014-11-13 15:18 - 00098550 _____ () C:\Users\*****\Downloads\xray_1.7.4.zip
2014-11-13 13:19 - 2014-11-13 13:20 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-11-13 13:19 - 2014-11-13 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-11 23:32 - 2014-09-11 13:22 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2BB45ECA-2C65-44E6-AA63-BC2D7A26E258}
2014-12-11 20:34 - 2014-05-13 15:14 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-11 20:34 - 2010-11-30 18:37 - 00085704 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-11 20:29 - 2009-07-14 18:58 - 09563964 _____ () C:\Windows\system32\perfh007.dat
2014-12-11 20:29 - 2009-07-14 18:58 - 02916216 _____ () C:\Windows\system32\perfc007.dat
2014-12-11 20:29 - 2009-07-14 06:13 - 00006276 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-11 16:27 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-11 16:27 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-11 16:23 - 2010-11-29 20:29 - 01768416 _____ () C:\Windows\WindowsUpdate.log
2014-12-11 16:17 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-10 21:23 - 2014-09-24 20:28 - 00000000 ____D () C:\AdwCleaner
2014-12-10 19:46 - 2012-09-20 17:25 - 00000000 ____D () C:\Users\*****\Desktop\Spiele
2014-12-09 21:42 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-12-09 21:34 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-09 21:05 - 2010-11-29 23:37 - 00007603 _____ () C:\Users\*****\AppData\Local\Resmon.ResmonCfg
2014-12-09 20:12 - 2010-11-29 20:41 - 00000000 ____D () C:\Users\*****
2014-12-08 21:46 - 2012-09-02 20:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Nitro PDF
2014-12-08 19:13 - 2013-05-15 18:39 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-08 14:52 - 2013-03-21 13:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-08 14:52 - 2013-03-21 13:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-08 13:38 - 2013-03-21 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-07 01:19 - 2014-05-13 15:47 - 00085304 _____ () C:\Users\test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-07 01:11 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-06 16:52 - 2009-07-14 03:34 - 78381056 _____ () C:\Windows\system32\config\software.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 22020096 _____ () C:\Windows\system32\config\system.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 01835008 _____ () C:\Windows\system32\config\default.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.gu.bak
2014-12-06 16:51 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.gu.bak
2014-12-06 16:39 - 2012-08-12 14:25 - 00000000 ____D () C:\Users\*****\AppData\Local\Nero
2014-12-06 16:36 - 2014-05-12 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Counter-Strike 1.6
2014-12-06 16:20 - 2012-12-20 15:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\GlarySoft
2014-12-06 13:31 - 2011-08-19 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty - United Offensive
2014-12-06 01:13 - 2011-10-15 00:08 - 00000000 ____D () C:\Users\*****\AppData\Local\CrashDumps
2014-12-05 17:43 - 2011-12-19 18:15 - 00000000 ___RD () C:\Users\*****\Dropbox
2014-12-05 15:13 - 2011-12-19 18:11 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-12-05 11:16 - 2009-07-14 05:45 - 00344656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-03 22:17 - 2012-06-27 00:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Spotify
2014-12-03 13:36 - 2012-10-18 11:30 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-03 13:22 - 2012-06-27 00:23 - 00000000 ____D () C:\Users\*****\AppData\Local\Spotify
2014-12-01 16:01 - 2014-05-13 15:14 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-01 15:12 - 2010-11-29 22:11 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-11-28 17:02 - 2012-12-15 16:27 - 00000000 ____D () C:\Users\*****\Desktop\Musik
2014-11-28 16:11 - 2006-08-11 20:42 - 00000000 ___RD () C:\Programme
2014-11-23 18:24 - 2014-11-02 23:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\.minecraft
2014-11-21 23:57 - 2014-02-01 13:13 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-21 23:57 - 2014-02-01 13:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-11-21 23:34 - 2012-11-09 17:08 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-21 23:34 - 2011-06-06 17:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-21 23:33 - 2014-02-03 21:45 - 00000000 ____D () C:\Users\*****\Desktop\FF
2014-11-19 21:08 - 2013-05-15 18:39 - 00001849 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-11-19 21:08 - 2013-04-06 18:13 - 00000872 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Files to move or delete:
====================
C:\ProgramData\j62j6xbe.fee
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\temp\avgnt.exe
C:\Users\*****\AppData\Local\temp\Quarantine.exe
C:\Users\*****\AppData\Local\temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-05 11:56
==================== End Of Log ============================
Problme habe ich keine mehr. Danke schon mal dafür.  Das Einzige was mich ein wenig noch irritiert, sind die Funde von Eset. Müssen wir da nochmal was machen? Gruß, Italiener |
|
12.12.2014, 20:10
| #8 |
| /// the machine /// TB-Ausbilder | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Java, Adobe und Thunderbird updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\ProgramData\MafoBajf
HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\AnVir Task Manager <====== ATTENTION
HKU\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\prefs.js.BAK
C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\prefs.js
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Unbedingt Windows updaten, da fehlt ein ganzes Servicepack. Dann bitte ein frisches FRST log.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.12.2014, 11:33
| #9 |
| | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Hallo schrauber, Java, Adobe und Thunderbird sind wieder up to date. Windows ist auch auf dem neusten Stand. Ebenfalls wurde Firefox mit Revo deinstalliert und wieder installiert, mit anschließender Zurücksetzung. Hier das Fixlog.txt: Wunder dich nicht, das ein Teil nicht mehr gefunden wurde. Ich habe es zwei mal ausgeführt. Beim ersten Mal habe ich die Code-Box kopiert und so ausgeführt wie du es mir gesagt hast, nur habe ich vergessen meinen "benutzernamen" wieder einzufügen.  Dementsprechend bekam ich für die entsprechenden Zeilen eine "Fehlermeldung". Tja, und dann habe ich die .Txt-Datei gelöscht und das ganze nochmal gemacht, diesesmal mit meinem Namen. Die Zeilen 1- 7 (von C:\ProgramData\MafoBajf bis HKU\S-1-5-21-2961250916-...) wurden aber erfolgreich gelöscht. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-12-2014 01
Ran by ***** at 2014-12-12 21:35:39 Run:2
Running from C:\Users\*****\Desktop
Loaded Profiles: ***** & UpdatusUser (Available profiles: Carlo & UpdatusUser & test)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\ProgramData\MafoBajf
HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\AVG <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\AnVir Task Manager <====== ATTENTION
HKU\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\prefs.js.BAK
C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\prefs.js
Emptytemp:
*****************
"C:\ProgramData\MafoBajf" => File/Directory not found.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
"HKU\S-1-5-20\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key not found.
"HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key not found.
C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\prefs.js.BAK => Moved successfully.
C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yhlt45qe.default-1416818552571\prefs.js => Moved successfully.
EmptyTemp: => Removed 37 KB temporary data.
The system needed a reboot.
==== End of Fixlog ====
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-12-2014 01 Ran by ***** (administrator) on ITALIENER on 13-12-2014 11:14:27 Running from C:\Users\*****\Desktop Loaded Profiles: ***** & UpdatusUser (Available profiles: ***** & UpdatusUser & test) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\audiodg.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe () C:\Windows\SysWOW64\PnkBstrA.exe () C:\Windows\SysWOW64\PnkBstrB.exe (Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Opera Software) C:\Program Files (x86)\Opera\opera.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2792448 2009-12-04] (VIA) HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-09] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated) HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Run: [GUDelayStartup] => C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe [37152 2014-11-24] (Glarysoft Ltd) HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\RunOnce: [Adobe Speed Launcher] => 1418465552 HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\...\Policies\Explorer: [] HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-12-12] (Microsoft Corporation) BootExecute: autocheck autochk * ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = Google HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = Google HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2961250916-3466838546-2982623831-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2961250916-3466838546-2982623831-1000 -> {9ADEE868-A379-4C6D-968E-A0E0EB49F3DA} URL = https://www.google.com/search?q={searchTerms} BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\xztmboy9.default-1418418361993 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll () FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~3\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: @videolan.org/vlc,version=2.0.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2961250916-3466838546-2982623831-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-2961250916-3466838546-2982623831-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File FF HKLM-x32\...\Thunderbird\Extensions: [avgthb@avg.com] - C:\Program Files (x86)\AVG\AVG2012\Thunderbird Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [cfdfamfnacokbbbnmpdfmhonipnhmbid] - C:\Users\*****\AppData\LocalLow\Flagfox\CHROME\Flagfox.crx [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-09] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG) S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2011-09-28] (Creative Labs) [File not signed] R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [204304 2012-04-11] (Nitro PDF Software) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-12-16] () R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [189248 2012-12-16] () S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2011-09-28] (Creative Labs) [File not signed] R2 UserAccess7; C:\Windows\SysWOW64\UAService7.exe [221184 2014-11-30] (Sony DADC Austria AG.) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG) S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20552 2010-09-06] (Devguru Co., Ltd) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-12] (DT Soft Ltd) S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-09-29] (FNet Co., Ltd.) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-09-28] (FNet Co., Ltd.) S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-02-05] () [File not signed] R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2014-12-06] (Glarysoft Ltd) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-13] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-05-17] (Duplex Secure Ltd.) S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2009-07-14] (Microsoft Corporation) S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] () S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-13 11:14 - 2014-12-13 11:14 - 00013990 _____ () C:\Users\*****\Desktop\FRST.txt 2014-12-12 23:01 - 2014-12-12 23:06 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-12 22:59 - 2014-12-13 00:45 - 00291494 _____ () C:\Windows\msxml4-KB973688-enu.LOG 2014-12-12 22:51 - 2014-12-13 00:44 - 00291792 _____ () C:\Windows\msxml4-KB954430-enu.LOG 2014-12-12 22:26 - 2014-12-12 22:26 - 00000000 ____D () C:\Windows\system32\SPReview 2014-12-12 22:03 - 2014-12-12 22:03 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-12-12 22:03 - 2014-12-12 22:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-12-12 21:41 - 2014-12-12 21:41 - 00001272 _____ () C:\Users\*****\Desktop\Revo Uninstaller.lnk 2014-12-12 21:41 - 2014-12-12 21:41 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-12-12 21:16 - 2014-12-12 21:19 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-12-12 20:54 - 2014-12-12 20:53 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-12-12 01:15 - 2014-12-12 01:15 - 00001090 _____ () C:\Users\*****\Desktop\checkup.txt 2014-12-12 01:08 - 2014-12-12 01:08 - 00852490 _____ () C:\Users\*****\Desktop\SecurityCheck.exe 2014-12-10 21:35 - 2014-12-10 21:35 - 00001051 _____ () C:\Users\*****\Desktop\JRT.txt 2014-12-10 21:30 - 2014-12-10 21:30 - 01707646 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe 2014-12-10 21:30 - 2014-12-10 21:30 - 00000000 ____D () C:\Windows\ERUNT 2014-12-10 21:27 - 2014-12-10 21:27 - 00001188 _____ () C:\Users\*****\Desktop\AdwCleaner[S1].txt 2014-12-10 20:57 - 2014-12-10 20:57 - 02166272 _____ () C:\Users\*****\Desktop\AdwCleaner_4.105.exe 2014-12-10 20:51 - 2014-12-10 21:23 - 00000000 ____D () C:\Users\TEMP.italiener 2014-12-10 20:45 - 2014-12-10 20:54 - 00002107 _____ () C:\Users\*****\Desktop\mbam.txt 2014-12-10 20:02 - 2014-12-13 11:12 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-10 20:01 - 2014-12-10 20:01 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-10 20:01 - 2014-12-10 20:01 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-10 20:01 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-10 20:01 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-10 20:01 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-10 19:44 - 2014-12-10 19:44 - 02119680 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe 2014-12-10 19:44 - 2014-12-10 19:44 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe 2014-12-09 21:47 - 2014-12-10 14:40 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Ynsiav 2014-12-09 21:47 - 2014-12-10 01:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Urdexu 2014-12-09 21:42 - 2014-12-09 21:42 - 00023480 _____ () C:\Users\*****\Desktop\ComboFix.txt 2014-12-09 21:30 - 2014-12-13 00:29 - 00012602 _____ () C:\Windows\PFRO.log 2014-12-09 21:07 - 2014-12-09 21:42 - 00000000 ____D () C:\Qoobox 2014-12-09 21:07 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-12-09 21:07 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-12-09 21:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-12-09 21:07 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-12-09 21:06 - 2014-12-09 21:39 - 00000000 ____D () C:\Windows\erdnt 2014-12-09 20:59 - 2014-12-09 21:00 - 05601243 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe 2014-12-09 20:16 - 2014-12-09 20:24 - 00000526 _____ () C:\Users\*****\Desktop\defogger_disable.log 2014-12-08 20:36 - 2014-12-08 20:37 - 00021723 _____ () C:\Users\*****\Desktop\Gmer.txt 2014-12-08 19:21 - 2014-12-08 19:29 - 00047137 _____ () C:\Users\*****\Desktop\Addition.txt 2014-12-08 19:18 - 2014-12-13 11:14 - 00000000 ____D () C:\FRST 2014-12-08 19:13 - 2014-12-08 19:13 - 00000020 _____ () C:\Users\*****\defogger_reenable 2014-12-08 19:12 - 2014-12-08 19:12 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe 2014-12-08 13:05 - 2014-12-09 19:50 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Umgiuk 2014-12-08 13:05 - 2014-12-09 00:33 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Etenqy 2014-12-08 00:22 - 2014-12-08 00:23 - 00000000 ____D () C:\Users\*****\AppData\Roaming\concept design 2014-12-08 00:22 - 2014-12-08 00:22 - 00001233 _____ () C:\Users\*****\Desktop\onlineTV 10.lnk 2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\concept design 2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\concept design 2014-12-08 00:22 - 2014-12-08 00:22 - 00000000 ____D () C:\Program Files (x86)\concept design 2014-12-07 16:18 - 2014-12-07 16:18 - 00233737 _____ () C:\Users\*****\AppData\Local\census.cache 2014-12-07 16:17 - 2014-12-07 16:17 - 00125646 _____ () C:\Users\*****\AppData\Local\ars.cache 2014-12-07 15:36 - 2014-12-07 15:36 - 00000036 _____ () C:\Users\*****\AppData\Local\housecall.guid.cache 2014-12-06 21:53 - 2014-12-06 21:53 - 00001281 _____ () C:\Windows\IE11_main.log 2014-12-06 16:52 - 2014-12-13 11:10 - 00019432 _____ () C:\Windows\setupact.log 2014-12-06 16:52 - 2014-12-06 16:52 - 00000000 _____ () C:\Windows\setuperr.log 2014-12-06 16:50 - 2014-11-24 07:01 - 00028960 _____ (Glarysoft Ltd) C:\Windows\system32\RegBootDefrag.exe 2014-12-06 16:20 - 2014-12-06 16:20 - 00002974 _____ () C:\Windows\System32\Tasks\GU5SkipUAC 2014-12-06 16:20 - 2014-12-06 16:20 - 00001100 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk 2014-12-06 16:20 - 2014-12-06 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5 2014-12-06 16:20 - 2014-12-06 16:20 - 00000000 ____D () C:\ProgramData\GlarySoft 2014-12-06 16:19 - 2014-12-13 11:12 - 00000334 _____ () C:\Windows\Tasks\GlaryInitialize 5.job 2014-12-06 16:19 - 2014-12-06 20:59 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5 2014-12-06 16:19 - 2014-12-06 16:20 - 00002632 _____ () C:\Windows\System32\Tasks\GlaryInitialize 5 2014-12-06 16:19 - 2014-12-06 16:19 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys 2014-12-06 16:19 - 2014-12-06 16:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DiskDefrag 2014-12-06 15:07 - 2010-11-20 14:33 - 00299392 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll 2014-12-06 15:07 - 2010-11-20 14:27 - 03860992 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbon.dll 2014-12-06 15:06 - 2010-11-20 14:39 - 05066752 _____ (Microsoft Corporation) C:\Windows\system32\AuthFWSnapin.dll 2014-12-06 15:06 - 2010-11-20 14:34 - 00295808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys 2014-12-06 15:06 - 2010-11-20 14:34 - 00215936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys 2014-12-06 15:06 - 2010-11-20 14:33 - 00982912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-12-06 15:06 - 2010-11-20 14:33 - 00951680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys 2014-12-06 15:06 - 2010-11-20 14:33 - 00366976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys 2014-12-06 15:06 - 2010-11-20 14:29 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 14633472 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 03715584 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 03650560 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 03027968 _____ (Microsoft Corporation) C:\Windows\system32\WMVCORE.DLL 2014-12-06 15:06 - 2010-11-20 14:27 - 03008000 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 02652160 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 02543616 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 02086912 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 02055680 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 02018304 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01900544 _____ (Microsoft Corporation) C:\Windows\system32\setupapi.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2014-12-06 15:06 - 2010-11-20 14:27 - 01808384 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01753088 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01646080 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01556992 _____ (Microsoft Corporation) C:\Windows\system32\RacEngn.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01509888 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01441280 _____ (Microsoft Corporation) C:\Windows\system32\wlanpref.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01281024 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01243136 _____ (Microsoft Corporation) C:\Windows\system32\WMNetMgr.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01219584 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01212416 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01197056 _____ (Microsoft Corporation) C:\Windows\system32\taskschd.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01158656 _____ (Microsoft Corporation) C:\Windows\system32\webservices.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01098240 _____ (Microsoft Corporation) C:\Windows\system32\Vault.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01082880 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01024512 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 01008128 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00933888 _____ (Microsoft Corporation) C:\Windows\system32\sqlsrv32.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00867840 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00849920 _____ (Microsoft Corporation) C:\Windows\system32\qmgr.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceApi.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00750080 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\odbc32.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00582656 _____ (Microsoft Corporation) C:\Windows\system32\sxs.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00577536 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\netcfgx.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00481280 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\QAGENTRT.DLL 2014-12-06 15:06 - 2010-11-20 14:27 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00326144 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00299520 _____ (Microsoft Corporation) C:\Windows\system32\tsmf.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\QAGENT.DLL 2014-12-06 15:06 - 2010-11-20 14:27 - 00263168 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00263168 _____ (Microsoft Corporation) C:\Windows\system32\spwizui.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\prncache.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\SessEnv.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll 2014-12-06 15:06 - 2010-11-20 14:27 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 04120064 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 03391488 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 03205120 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 02067456 _____ (Microsoft Corporation) C:\Windows\system32\d3d9.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 01866240 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 01340416 _____ (Microsoft Corporation) C:\Windows\system32\diagperf.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 01244160 _____ (Microsoft Corporation) C:\Windows\system32\imapi2fs.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00853504 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2014-12-06 15:06 - 2010-11-20 14:26 - 00828416 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00787968 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00777728 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00658944 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\ipsmsnap.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL 2014-12-06 15:06 - 2010-11-20 14:26 - 00403968 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00317952 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\framedynos.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00281600 _____ (Microsoft) C:\Windows\system32\DShowRdpFilter.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\framedyn.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\hgprint.dll 2014-12-06 15:06 - 2010-11-20 14:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\dot3api.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 03957760 _____ (Microsoft Corporation) C:\Windows\system32\WinSAT.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 01975296 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 01927680 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\certmgr.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 01600512 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 01504256 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 00958464 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 00897536 _____ (Microsoft Corporation) C:\Windows\system32\azroles.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 00705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL 2014-12-06 15:06 - 2010-11-20 14:25 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\spinstall.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 00464384 _____ (Microsoft Corporation) C:\Windows\system32\taskeng.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 00390656 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\spreview.exe 2014-12-06 15:06 - 2010-11-20 14:25 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2014-12-06 15:06 - 2010-11-20 14:25 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\schtasks.exe 2014-12-06 15:06 - 2010-11-20 14:24 - 00653312 _____ (Microsoft Corporation) C:\Windows\system32\lpksetup.exe 2014-12-06 15:06 - 2010-11-20 14:24 - 00345088 _____ (Microsoft Corporation) C:\Windows\system32\cmd.exe 2014-12-06 15:06 - 2010-11-20 14:24 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\lsm.exe 2014-12-06 15:06 - 2010-11-20 14:24 - 00272896 _____ (Microsoft Corporation) C:\Windows\system32\mcbuilder.exe 2014-12-06 15:06 - 2010-11-20 13:32 - 05066752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuthFWSnapin.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 01712640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsservices.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 01667584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupapi.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 01619456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2014-12-06 15:06 - 2010-11-20 13:21 - 01363456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 01175040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 01128448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vssapi.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 01115136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RacEngn.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 01010688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00505856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskschd.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00351232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00350208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shlwapi.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00270848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsmf.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\upnp.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00113664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SessEnv.dll 2014-12-06 15:06 - 2010-11-20 13:21 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll 2014-12-06 15:06 - 2010-11-20 13:20 - 01414144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll 2014-12-06 15:06 - 2010-11-20 13:20 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbc32.dll 2014-12-06 15:06 - 2010-11-20 13:20 - 00563712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll 2014-12-06 15:06 - 2010-11-20 13:20 - 00547840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceApi.dll 2014-12-06 15:06 - 2010-11-20 13:20 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-12-06 15:06 - 2010-11-20 13:20 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 03215872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 03207680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 02291712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 02151936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 01493504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 00954752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc40.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 00954288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc40u.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 00732160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imapi2fs.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-12-06 15:06 - 2010-11-20 13:19 - 00257024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 02522624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 01828352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d9.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 01792000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 01555456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certmgr.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 01371136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 01171456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 00522752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 00485888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 00252928 _____ (Microsoft) C:\Windows\SysWOW64\DShowRdpFilter.dll 2014-12-06 15:06 - 2010-11-20 13:18 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3api.dll 2014-12-06 15:06 - 2010-11-20 13:17 - 01049600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2014-12-06 15:06 - 2010-11-20 13:17 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-12-06 15:06 - 2010-11-20 13:17 - 00322048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-12-06 15:06 - 2010-11-20 13:17 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mcbuilder.exe 2014-12-06 15:06 - 2010-11-20 12:07 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2014-12-06 15:06 - 2010-11-20 12:05 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\rdpdd.dll 2014-12-06 15:06 - 2010-11-20 11:44 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\1394ohci.sys 2014-12-06 15:06 - 2010-11-20 10:27 - 00309248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys 2014-12-06 15:06 - 2010-11-20 10:25 - 00753664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys 2014-12-06 15:06 - 2010-11-20 10:23 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys 2014-12-06 15:06 - 2010-11-20 10:21 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-06 15:06 - 2010-11-05 03:20 - 00347904 _____ () C:\Windows\system32\systemsf.ebd 2014-12-06 15:06 - 2010-11-05 02:58 - 01130824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll 2014-12-06 15:06 - 2010-11-05 02:58 - 00297808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscoree.dll 2014-12-06 15:06 - 2010-11-05 02:58 - 00049488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netfxperf.dll 2014-12-06 15:06 - 2010-11-05 02:57 - 01942856 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-12-06 15:06 - 2010-11-05 02:57 - 00444752 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll 2014-12-06 15:06 - 2010-11-05 02:57 - 00048976 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll 2014-12-06 15:06 - 2010-11-05 02:53 - 00320352 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe 2014-12-06 15:06 - 2010-11-05 02:53 - 00295264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHost.exe 2014-12-06 15:06 - 2010-11-05 02:53 - 00109928 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll 2014-12-06 15:06 - 2010-11-05 02:53 - 00099176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHostProxy.dll 2014-12-06 15:06 - 2009-07-14 02:16 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tcpmonui.dll 2014-12-06 15:05 - 2010-11-20 14:34 - 00071552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys 2014-12-06 15:05 - 2010-11-20 14:33 - 00289664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys 2014-12-06 15:05 - 2010-11-20 14:33 - 00273792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2014-12-06 15:05 - 2010-11-20 14:33 - 00263040 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll 2014-12-06 15:05 - 2010-11-20 14:33 - 00184704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys 2014-12-06 15:05 - 2010-11-20 14:33 - 00140672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msdsm.sys 2014-12-06 15:05 - 2010-11-20 14:33 - 00103808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sbp2port.sys 2014-12-06 15:05 - 2010-11-20 14:33 - 00078720 _____ (Hewlett-Packard Company) C:\Windows\system32\Drivers\HpSAMD.sys 2014-12-06 15:05 - 2010-11-20 14:33 - 00063360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys 2014-12-06 15:05 - 2010-11-20 14:33 - 00031104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msahci.sys 2014-12-06 15:05 - 2010-11-20 14:32 - 00334208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys 2014-12-06 15:05 - 2010-11-20 14:32 - 00179072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys 2014-12-06 15:05 - 2010-11-20 14:32 - 00112000 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-12-06 15:05 - 2010-11-20 14:28 - 00780008 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll 2014-12-06 15:05 - 2010-11-20 14:28 - 00298104 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll 2014-12-06 15:05 - 2010-11-20 14:28 - 00223248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys 2014-12-06 15:05 - 2010-11-20 14:28 - 00166784 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 02262528 _____ (Microsoft Corporation) C:\Windows\system32\SyncCenter.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 02250752 _____ (Microsoft Corporation) C:\Windows\system32\SensorsCpl.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 02193920 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 02072576 _____ (Microsoft Corporation) C:\Windows\system32\WMPEncEn.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\netcenter.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 01363968 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 01326080 _____ (Microsoft Corporation) C:\Windows\system32\NaturalLanguage6.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL 2014-12-06 15:05 - 2010-11-20 14:27 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\sdengin2.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 01050624 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00799744 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00691200 _____ (Microsoft Corporation) C:\Windows\system32\VAN.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\PerfCenterCPL.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00633344 _____ (Microsoft Corporation) C:\Windows\system32\riched20.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00605696 _____ (Microsoft Corporation) C:\Windows\system32\wmpeffects.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\wiaservc.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\mspbda.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\msdri.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\WinSATAPI.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\powercpl.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\wiadefui.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00418816 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\mtxclu.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\shsvcs.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\sharemediacpl.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\srchadmin.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\netdiagfx.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\scansetting.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00264192 _____ (Microsoft Corporation) C:\Windows\system32\upnp.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\tcpipcfg.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\onex.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00232960 _____ (Microsoft Corporation) C:\Windows\system32\scecli.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\XpsRasterService.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\QSHVHOST.DLL 2014-12-06 15:05 - 2010-11-20 14:27 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\netiohlp.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\netjoin.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\netid.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\ocsetapi.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00148992 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\thumbcache.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\QUTIL.DLL 2014-12-06 15:05 - 2010-11-20 14:27 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\regapi.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\TabSvc.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\nci.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\samcli.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\RpcRtRemote.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\msasn1.dll 2014-12-06 15:05 - 2010-11-20 14:27 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 01457664 _____ (Microsoft Corporation) C:\Windows\system32\DxpTaskSync.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00934912 _____ (Microsoft Corporation) C:\Windows\system32\FirewallControlPanel.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00675328 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00551936 _____ (Microsoft Corporation) C:\Windows\system32\localsec.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\imapi2.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\DXP.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00355328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\hgcpl.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dskquoui.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\ListSvc.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\mprapi.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\iasrad.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\logoncli.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\fde.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\IPHLPAPI.DLL 2014-12-06 15:05 - 2010-11-20 14:26 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\dwmredir.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\dnscmmc.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\iasacct.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\fdeploy.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\lsmproxy.dll 2014-12-06 15:05 - 2010-11-20 14:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\mimefilt.dll 2014-12-06 15:05 - 2010-11-20 14:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\AuxiliaryDisplayCpl.dll 2014-12-06 15:05 - 2010-11-20 14:25 - 00533504 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe 2014-12-06 15:05 - 2010-11-20 14:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\biocpl.dll 2014-12-06 15:05 - 2010-11-20 14:25 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe 2014-12-06 15:05 - 2010-11-20 14:25 - 00314368 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll 2014-12-06 15:05 - 2010-11-20 14:25 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe 2014-12-06 15:05 - 2010-11-20 14:25 - 00273920 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe 2014-12-06 15:05 - 2010-11-20 14:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2014-12-06 15:05 - 2010-11-20 14:25 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\ocsetup.exe 2014-12-06 15:05 - 2010-11-20 14:25 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll 2014-12-06 15:05 - 2010-11-20 14:25 - 00128000 _____ (Microsoft) C:\Windows\system32\Robocopy.exe 2014-12-06 15:05 - 2010-11-20 14:25 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\setupcl.exe 2014-12-06 15:05 - 2010-11-20 14:25 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe 2014-12-06 15:05 - 2010-11-20 14:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\system32\mmsys.cpl 2014-12-06 15:05 - 2010-11-20 14:24 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\appwiz.cpl 2014-12-06 15:05 - 2010-11-20 14:24 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\TabletPC.cpl 2014-12-06 15:05 - 2010-11-20 14:24 - 00477696 _____ (Microsoft Corporation) C:\Windows\system32\PhotoScreensaver.scr 2014-12-06 15:05 - 2010-11-20 14:24 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv 2014-12-06 15:05 - 2010-11-20 14:24 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe 2014-12-06 15:05 - 2010-11-20 14:24 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\eudcedit.exe 2014-12-06 15:05 - 2010-11-20 14:24 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\msconfig.exe 2014-12-06 15:05 - 2010-11-20 14:24 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\wdmaud.drv 2014-12-06 15:05 - 2010-11-20 14:24 - 00122880 _____ (Microsoft Corporation) C:\Windows\system32\aitagent.exe 2014-12-06 15:05 - 2010-11-20 13:55 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-12-06 15:05 - 2010-11-20 13:51 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-06 15:05 - 2010-11-20 13:23 - 00144768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 02983424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbon.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 02755072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themeui.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 02146304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncCenter.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 01624064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPEncEn.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00782336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webservices.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00778240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqlsrv32.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00560128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00458752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00411648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlangpui.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00380416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sxs.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00352256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpeffects.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00335872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSATAPI.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00328192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsvcs.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00269824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00246272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scansetting.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00228352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spp.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll 2014-12-06 15:05 - 2010-11-20 13:21 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 02504192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVCORE.DLL 2014-12-06 15:05 - 2010-11-20 13:20 - 02494464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netshell.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 01750528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pnidui.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 01508864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pla.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 00932352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\printui.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 00801280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NaturalLanguage6.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 00225792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netdiagfx.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\onex.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 00167936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSHVHOST.DLL 2014-12-06 15:05 - 2010-11-20 13:20 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2014-12-06 15:05 - 2010-11-20 13:20 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prncache.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00830464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL 2014-12-06 15:05 - 2010-11-20 13:19 - 00488448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00392192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imapi2.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00296448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00232448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00213504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MMDevAPI.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\framedynos.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00124416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fde.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hbaapi.dll 2014-12-06 15:05 - 2010-11-20 13:19 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msasn1.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 01334272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertEnroll.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00854016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00762880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\azroles.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00630784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00508416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2014-12-06 15:05 - 2010-11-20 13:18 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll 2014-12-06 15:05 - 2010-11-20 13:17 - 00302592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe 2014-12-06 15:05 - 2010-11-20 13:17 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskeng.exe 2014-12-06 15:05 - 2010-11-20 13:17 - 00142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\net1.exe 2014-12-06 15:05 - 2010-11-20 13:16 - 00776192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\calc.exe 2014-12-06 15:05 - 2010-11-20 13:16 - 00658944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autofmt.exe 2014-12-06 15:05 - 2010-11-20 13:16 - 00320000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv 2014-12-06 15:05 - 2010-11-20 13:08 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll 2014-12-06 15:05 - 2010-11-20 13:08 - 00311296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-12-06 15:05 - 2010-11-20 12:04 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2014-12-06 15:05 - 2010-11-20 11:52 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndiswan.sys 2014-12-06 15:05 - 2010-11-20 11:52 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys 2014-12-06 15:05 - 2010-11-20 11:52 - 00111104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\raspptp.sys 2014-12-06 15:05 - 2010-11-20 11:52 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ipfltdrv.sys 2014-12-06 15:05 - 2010-11-20 11:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys 2014-12-06 15:05 - 2010-11-20 10:26 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys 2014-12-06 15:05 - 2010-11-20 10:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2014-12-06 15:04 - 2010-11-20 14:44 - 01077248 _____ (Microsoft Corporation) C:\Windows\system32\Narrator.exe 2014-12-06 15:04 - 2010-11-20 14:44 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\NAPHLPR.DLL 2014-12-06 15:04 - 2010-11-20 14:34 - 00363392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgrx.sys 2014-12-06 15:04 - 2010-11-20 14:33 - 00213888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys 2014-12-06 15:04 - 2010-11-20 14:33 - 00171392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scsiport.sys 2014-12-06 15:04 - 2010-11-20 14:33 - 00155008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpio.sys 2014-12-06 15:04 - 2010-11-20 14:33 - 00094592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2014-12-06 15:04 - 2010-11-20 14:33 - 00014720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hwpolicy.sys 2014-12-06 15:04 - 2010-11-20 14:32 - 02217856 _____ (Microsoft Corporation) C:\Windows\system32\bootres.dll 2014-12-06 15:04 - 2010-11-20 14:32 - 00155520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys 2014-12-06 15:04 - 2010-11-20 14:27 - 02146816 _____ (Microsoft Corporation) C:\Windows\system32\networkmap.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00898560 _____ (Microsoft Corporation) C:\Windows\system32\OobeFldr.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00812032 _____ (Microsoft Corporation) C:\Windows\system32\wpccpl.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00781312 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\sud.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\sdcpl.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00611840 _____ (Microsoft Corporation) C:\Windows\system32\wpd_ci.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\nshipsec.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00451072 _____ (Microsoft Corporation) C:\Windows\system32\shwebsvc.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\sqlcese30.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\spwizeng.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\termmgr.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\prnfldr.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wlanui.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00403968 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00366080 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\ReAgent.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00268288 _____ (Microsoft Corporation) C:\Windows\system32\MSAC3ENC.DLL 2014-12-06 15:04 - 2010-11-20 14:27 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\wavemsp.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\taskbarcpl.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\sppcomapi.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\SndVolSSO.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\wmpsrcwp.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00221696 _____ (Microsoft Corporation) C:\Windows\system32\OnLineIDCpl.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\rasppp.dll 2014-12-06 15:04 - 2010-11-20 14:27 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\sysclass.dll |
|
13.12.2014, 11:35
| #10 |
| | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Und hier der zweite Teil: Code:
ATTFilter 2014-12-06 15:04 - 2010-11-20 14:27 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\syncui.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\netplwiz.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\provsvc.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\twext.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\sdrsvc.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\prntvpt.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00154624 _____ (Microsoft Corporation) C:\Windows\system32\uxlib.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\recovery.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\ntlanman.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\srvcli.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\wkssvc.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\WPDShServiceObj.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\UserAccountControlSettings.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\rdpd3d.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\ncryptui.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\rtutils.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\vpnikeapi.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\msvidc32.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\sisbkup.dll
2014-12-06 15:04 - 2010-11-20 14:27 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\DiagCpl.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 01066496 _____ (Microsoft Corporation) C:\Windows\system32\Display.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00861184 _____ (Microsoft Corporation) C:\Windows\system32\fontext.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\dsuiext.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCenter.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00495104 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\MediaMetadataHandler.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\efscore.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\iTVData.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00281088 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00279552 _____ (Microsoft Corporation) C:\Windows\system32\dxdiagn.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dot3svc.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00240640 _____ (Microsoft Corporation) C:\Windows\system32\MFPlay.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00233984 _____ (Microsoft Corporation) C:\Windows\system32\defaultlocationcpl.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingFolder.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\mprddm.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\dps.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00116224 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\fms.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\hbaapi.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\dot3cfg.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\iyuv_32.dll
2014-12-06 15:04 - 2010-11-20 14:26 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\httpapi.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 03745792 _____ (Microsoft Corporation) C:\Windows\system32\accessibilitycpl.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 03524608 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 01264640 _____ (Microsoft Corporation) C:\Windows\system32\sdclt.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 01065984 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00780800 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00749568 _____ (Microsoft Corporation) C:\Windows\system32\batmeter.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00549888 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenterCPL.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00472064 _____ (Microsoft Corporation) C:\Windows\system32\azroleui.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00349696 _____ (Microsoft Corporation) C:\Windows\system32\slui.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\sethc.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\taskmgr.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\recdisc.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\bcdsrv.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\autoplay.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\cabview.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\AuxiliaryDisplayServices.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\AxInstSv.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\nslookup.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\cca.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\tzutil.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\acppage.dll
2014-12-06 15:04 - 2010-11-20 14:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\proquota.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\userinit.exe
2014-12-06 15:04 - 2010-11-20 14:25 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-12-06 15:04 - 2010-11-20 14:24 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\mblctr.exe
2014-12-06 15:04 - 2010-11-20 14:24 - 00793088 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2014-12-06 15:04 - 2010-11-20 14:24 - 00777728 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2014-12-06 15:04 - 2010-11-20 14:24 - 00763904 _____ (Microsoft Corporation) C:\Windows\system32\autofmt.exe
2014-12-06 15:04 - 2010-11-20 14:24 - 00721408 _____ (Microsoft Corporation) C:\Windows\system32\bthprops.cpl
2014-12-06 15:04 - 2010-11-20 14:24 - 00474112 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2014-12-06 15:04 - 2010-11-20 14:24 - 00373248 _____ (Microsoft Corporation) C:\Windows\system32\intl.cpl
2014-12-06 15:04 - 2010-11-20 14:24 - 00352768 _____ (Microsoft Corporation) C:\Windows\system32\sysdm.cpl
2014-12-06 15:04 - 2010-11-20 14:24 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2014-12-06 15:04 - 2010-11-20 14:24 - 00333824 _____ (Microsoft Corporation) C:\Windows\system32\ssText3d.scr
2014-12-06 15:04 - 2010-11-20 14:24 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\unimdm.tsp
2014-12-06 15:04 - 2010-11-20 14:24 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2014-12-06 15:04 - 2010-11-20 14:24 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\VBICodec.ax
2014-12-06 15:04 - 2010-11-20 14:24 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2014-12-06 15:04 - 2010-11-20 14:24 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-12-06 15:04 - 2010-11-20 14:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\WSTPager.ax
2014-12-06 15:04 - 2010-11-20 14:24 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\isoburn.exe
2014-12-06 15:04 - 2010-11-20 14:24 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\ksxbar.ax
2014-12-06 15:04 - 2010-11-20 13:21 - 02202624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsCpl.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 02157568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themecpl.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 01326592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanpref.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 01227776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 01003008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMNetMgr.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00933376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Vault.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00755200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sud.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00738816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpmde.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00638976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VAN.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00600064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00428544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shwebsvc.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00416768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wiadefui.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00410624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\systemcpl.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00410112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanui.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00372224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\termmgr.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwizeng.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00346624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00327680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00307712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srchadmin.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00242176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tapisrv.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVolSSO.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppcomapi.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00181760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tcpipcfg.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasppp.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scecli.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\syncui.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00135168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsRasterService.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\thumbcache.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\regapi.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samcli.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RpcRtRemote.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtutils.dll
2014-12-06 15:04 - 2010-11-20 13:21 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sisbkup.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 02130944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\networkmap.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 01644032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcenter.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00859648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OobeFldr.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00600576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PerfCenterCPL.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercpl.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00395264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prnfldr.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00324608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\photowiz.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00218112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OnLineIDCpl.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QAGENT.DLL
2014-12-06 15:04 - 2010-11-20 13:20 - 00166400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netiohlp.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netjoin.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prntvpt.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netid.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nci.dll
2014-12-06 15:04 - 2010-11-20 13:20 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntlanman.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00856576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallControlPanel.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontext.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00429056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\localsec.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ipsmsnap.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxclu.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hgcpl.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtrmgr.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprddm.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MediaMetadataHandler.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00226304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSAC3ENC.DLL
2014-12-06 15:04 - 2010-11-20 13:19 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2014-12-06 15:04 - 2010-11-20 13:19 - 00202752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\framedyn.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasrad.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00167936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msutb.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00148992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ifsutil.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logoncli.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IPHLPAPI.DLL
2014-12-06 15:04 - 2010-11-20 13:19 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasacct.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdeploy.dll
2014-12-06 15:04 - 2010-11-20 13:19 - 00042496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mimefilt.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 03727872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\accessibilitycpl.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 01400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DxpTaskSync.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 01040384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Display.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 01003520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00744448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenter.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00740864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\batmeter.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuxiliaryDisplayCpl.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00537600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenterCPL.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00484864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceCenter.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00314368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\azroleui.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00222208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapphost.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\defaultlocationcpl.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00205312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\efscore.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dskquoui.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adsldp.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoplay.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00132608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabview.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnscmmc.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3cfg.dll
2014-12-06 15:04 - 2010-11-20 13:18 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-12-06 15:04 - 2010-11-20 13:17 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00314368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVol.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00288256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eudcedit.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskmgr.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00098816 _____ (Microsoft) C:\Windows\SysWOW64\Robocopy.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\w32tm.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00042496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ftp.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\proquota.exe
2014-12-06 15:04 - 2010-11-20 13:17 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userinit.exe
2014-12-06 15:04 - 2010-11-20 13:16 - 00905216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmsys.cpl
2014-12-06 15:04 - 2010-11-20 13:16 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bthprops.cpl
2014-12-06 15:04 - 2010-11-20 13:16 - 00679424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoconv.exe
2014-12-06 15:04 - 2010-11-20 13:16 - 00668160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2014-12-06 15:04 - 2010-11-20 13:16 - 00649216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appwiz.cpl
2014-12-06 15:04 - 2010-11-20 13:16 - 00516096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\main.cpl
2014-12-06 15:04 - 2010-11-20 13:16 - 00413696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoScreensaver.scr
2014-12-06 15:04 - 2010-11-20 13:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2014-12-06 15:04 - 2010-11-20 13:16 - 00345088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\intl.cpl
2014-12-06 15:04 - 2010-11-20 13:16 - 00326656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysdm.cpl
2014-12-06 15:04 - 2010-11-20 13:16 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSTPager.ax
2014-12-06 15:04 - 2010-11-20 12:04 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-12-06 15:04 - 2010-11-20 11:52 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2014-12-06 15:04 - 2010-11-20 11:52 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2014-12-06 15:04 - 2010-11-20 11:43 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-12-06 15:04 - 2010-11-20 11:43 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\winusb.sys
2014-12-06 15:04 - 2010-11-05 03:11 - 00433512 _____ (Microsoft Corporation) C:\Windows\system32\MCEWMDRMNDBootstrap.dll
2014-12-06 15:04 - 2010-11-05 03:11 - 00312168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCEWMDRMNDBootstrap.dll
2014-12-06 15:04 - 2010-11-05 02:58 - 00155472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-12-06 15:04 - 2010-11-05 02:58 - 00080720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-12-06 15:04 - 2010-11-05 02:57 - 00154960 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-12-06 15:03 - 2010-11-20 14:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\NAPCRYPT.DLL
2014-12-06 15:03 - 2010-11-20 14:27 - 01911808 _____ (Microsoft Corporation) C:\Windows\system32\OpcServices.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 01672704 _____ (Microsoft Corporation) C:\Windows\system32\networkexplorer.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 01232896 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2014-12-06 15:03 - 2010-11-20 14:27 - 01080320 _____ (Microsoft Corporation) C:\Windows\system32\onexui.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2014-12-06 15:03 - 2010-11-20 14:27 - 00666112 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2014-12-06 15:03 - 2010-11-20 14:27 - 00636416 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmdev.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00527872 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmnet.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00435712 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceStatus.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00431104 _____ (Microsoft Corporation) C:\Windows\system32\WPDSp.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00392192 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00358400 _____ (Microsoft Corporation) C:\Windows\system32\wmpdxm.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\raschap.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\srrstr.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\qdv.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\mstask.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceSyncProvider.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\wpdwcn.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsbas.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\qcap.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\remotepg.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\mydocs.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\shacct.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\wmpshell.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\wiavideo.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\QSVRMGMT.DLL
2014-12-06 15:03 - 2010-11-20 14:27 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\sppnp.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\QCLIPROV.DLL
2014-12-06 15:03 - 2010-11-20 14:27 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\spbcd.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\tlscsp.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\unimdmat.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\napdsnap.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\wkscli.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\vfwwdm32.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\WavDest.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\vss_ps.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\umb.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\PrintIsolationProxy.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\shimgvw.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\wdiasqmmodule.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\msdmo.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\netutils.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\shgina.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\msyuv.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\schedcli.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\rdprefdrvapi.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\TRAPI.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\spopk.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\syssetup.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\muifontsetup.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\msrle32.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\nrpsrv.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\tsbyuv.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\wshirda.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\shunimpl.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\riched32.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\rdpcfgex.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-12-06 15:03 - 2010-11-20 14:27 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-12-06 15:03 - 2010-11-20 14:27 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00313344 _____ (Microsoft Corporation) C:\Windows\system32\dot3ui.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\iasrecst.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ifsutil.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\EhStorAPI.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\fphc.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\dot3msm.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\KMSVC.DLL
2014-12-06 15:03 - 2010-11-20 14:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\Mcx2Svc.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fdProxy.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\inetmib1.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\luainstall.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\mciqtz32.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\iscsium.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dsauth.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\HotStartUserAgent.dll
2014-12-06 15:03 - 2010-11-20 14:26 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\elsTrans.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\nltest.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00293888 _____ (Microsoft Corporation) C:\Windows\system32\wsqmcons.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00213504 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\perfmon.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\net1.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\cabinet.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\amstream.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\tabcal.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\CertPolEng.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\takeown.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\PnPUnattend.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\runonce.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\repair-bde.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\MultiDigiMon.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\cscapi.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\AzSqlExt.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\cscdll.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2014-12-06 15:03 - 2010-11-20 14:25 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\bitsperf.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\BWUnpairElevated.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\browseui.dll
2014-12-06 15:03 - 2010-11-20 14:25 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\C_ISCII.DLL
2014-12-06 15:03 - 2010-11-20 14:25 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00899584 _____ (Microsoft Corporation) C:\Windows\system32\Bubbles.scr
2014-12-06 15:03 - 2010-11-20 14:24 - 00606208 _____ (Microsoft Corporation) C:\Windows\system32\dfrgui.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\main.cpl
2014-12-06 15:03 - 2010-11-20 14:24 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\diskraid.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\Mystify.scr
2014-12-06 15:03 - 2010-11-20 14:24 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\Ribbons.scr
2014-12-06 15:03 - 2010-11-20 14:24 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\bitsadmin.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\bcdboot.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\powercfg.cpl
2014-12-06 15:03 - 2010-11-20 14:24 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\diskpart.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\iscsicli.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\MdSched.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\Kswdmcap.ax
2014-12-06 15:03 - 2010-11-20 14:24 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\desk.cpl
2014-12-06 15:03 - 2010-11-20 14:24 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\kstvtune.ax
2014-12-06 15:03 - 2010-11-20 14:24 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\mobsync.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\cmstp.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\manage-bde.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\findstr.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00071168 _____ (Microsoft Corporation) C:\Windows\bfsvc.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\djoin.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\g711codc.ax
2014-12-06 15:03 - 2010-11-20 14:24 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\ftp.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\vbisurf.ax
2014-12-06 15:03 - 2010-11-20 14:24 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\choice.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\LogonUI.exe
2014-12-06 15:03 - 2010-11-20 14:24 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2014-12-06 15:03 - 2010-11-20 14:15 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll
2014-12-06 15:03 - 2010-11-20 14:13 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\RDPENCDD.dll
2014-12-06 15:03 - 2010-11-20 14:02 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2014-12-06 15:03 - 2010-11-20 14:02 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2014-12-06 15:03 - 2010-11-20 13:51 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-ums-l1-1-0.dll
2014-12-06 15:03 - 2010-11-20 13:36 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NAPHLPR.DLL
2014-12-06 15:03 - 2010-11-20 13:36 - 00046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NAPCRYPT.DLL
2014-12-06 15:03 - 2010-11-20 13:21 - 00902656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOD.DLL
2014-12-06 15:03 - 2010-11-20 13:21 - 00739328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOD.DLL
2014-12-06 15:03 - 2010-11-20 13:21 - 00616960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00541184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSDECD.DLL
2014-12-06 15:03 - 2010-11-20 13:21 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmdev.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00473600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\riched20.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00444928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00436736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmnet.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00350720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDSp.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\raschap.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00318464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqlcese30.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00299520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpdxm.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00222208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wavemsp.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00198144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdwcn.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpsrcwp.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vdsbas.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remotepg.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twext.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpps.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxlib.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00109568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wiavideo.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shacct.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDShServiceObj.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00105472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpshell.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00100864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppinst.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srvcli.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00087552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00085504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00085504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QUTIL.DLL
2014-12-06 15:03 - 2010-11-20 13:21 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserAccountControlSettings.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tlscsp.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastapi.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spbcd.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unimdmat.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vfwwdm32.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpd3d.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00051200 _____ (Twain Working Group) C:\Windows\twain_32.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wkscli.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wtsapi32.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshbth.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimgvw.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\utildll.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vpnikeapi.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsdchngr.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TRAPI.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdprefdrvapi.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shgina.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spopk.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schedcli.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00014848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\syssetup.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00012288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsbyuv.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshirda.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\riched32.dll
2014-12-06 15:03 - 2010-11-20 13:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2014-12-06 15:03 - 2010-11-20 13:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 01661440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\networkexplorer.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OpcServices.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 01111552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\onexui.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00656384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceStatus.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00346112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshipsec.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00283136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdv.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00236544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qasf.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00190976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qcap.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00183296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceSyncProvider.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netplwiz.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ocsetapi.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00165376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\provsvc.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00136192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mydocs.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00121344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSVRMGMT.DLL
2014-12-06 15:03 - 2010-11-20 13:20 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00077824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olethk32.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QCLIPROV.DLL
2014-12-06 15:03 - 2010-11-20 13:20 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\napdsnap.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptui.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdhui.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcconf.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netutils.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfts.dll
2014-12-06 15:03 - 2010-11-20 13:20 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00592384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iTVData.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstask.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00202240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\input.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFPlay.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprapi.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasrecst.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvfw32.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\migisol.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fphc.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00093696 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\SysWOW64\fms.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciavi32.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00082944 _____ (Radius Inc.) C:\Windows\SysWOW64\iccvid.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapistub.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapi32.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetmib1.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iyuv_32.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\luainstall.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciqtz32.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\httpapi.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvidc32.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdmo.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsium.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msyuv.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lsmproxy.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\muifontsetup.dll
2014-12-06 15:03 - 2010-11-20 13:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrle32.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00743424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00685056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsuiext.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00402944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00333824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3ui.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00243712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\audiodev.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00242176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapp3hst.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00230912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00211456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairingFolder.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxdiagn.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00202752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\activeds.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EhStorAPI.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00115200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3msm.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappgnui.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\avifil32.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabinet.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\amstream.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cca.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertPolEng.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\acppage.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscapi.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsauth.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00028160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzSqlExt.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscdll.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elsTrans.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bitsperf.dll
2014-12-06 15:03 - 2010-11-20 13:18 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\C_ISCII.DLL
2014-12-06 15:03 - 2010-11-20 13:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browseui.dll
2014-12-06 15:03 - 2010-11-20 13:17 - 00586752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfrgui.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00327680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimserv.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00280064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00278016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00276480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskraid.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sethc.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00197632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ocsetup.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfmon.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00144896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsicli.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskpart.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00113152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupugc.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00101376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mobsync.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nslookup.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logagent.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\isoburn.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmstp.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MuiUnattend.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00062976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\findstr.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\takeown.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\runonce.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzutil.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unlodctr.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netiougc.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2014-12-06 15:03 - 2010-11-20 13:17 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgentc.exe
2014-12-06 15:03 - 2010-11-20 13:16 - 00878592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Bubbles.scr
2014-12-06 15:03 - 2010-11-20 13:16 - 00293888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ssText3d.scr
2014-12-06 15:03 - 2010-11-20 13:16 - 00281088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unimdm.tsp
2014-12-06 15:03 - 2010-11-20 13:16 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Mystify.scr
2014-12-06 15:03 - 2010-11-20 13:16 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Ribbons.scr
2014-12-06 15:03 - 2010-11-20 13:16 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2014-12-06 15:03 - 2010-11-20 13:16 - 00186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bitsadmin.exe
2014-12-06 15:03 - 2010-11-20 13:16 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdmaud.drv
2014-12-06 15:03 - 2010-11-20 13:16 - 00153600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VBICodec.ax
2014-12-06 15:03 - 2010-11-20 13:16 - 00142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercfg.cpl
2014-12-06 15:03 - 2010-11-20 13:16 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\desk.cpl
2014-12-06 15:03 - 2010-11-20 13:16 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Kswdmcap.ax
2014-12-06 15:03 - 2010-11-20 13:16 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kstvtune.ax
2014-12-06 15:03 - 2010-11-20 13:16 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksxbar.ax
2014-12-06 15:03 - 2010-11-20 13:16 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\g711codc.ax
2014-12-06 15:03 - 2010-11-20 13:16 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbisurf.ax
2014-12-06 15:03 - 2010-11-20 13:08 - 00663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-12-06 15:03 - 2010-11-20 13:08 - 00119808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imm32.dll
2014-12-06 15:03 - 2010-11-20 13:07 - 01164800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll
2014-12-06 15:03 - 2010-11-20 13:00 - 01027584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10.IME
2014-12-06 15:03 - 2010-11-20 13:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imkr80.ime
2014-12-06 15:03 - 2010-11-20 12:37 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbrpm.sys
2014-12-06 15:03 - 2010-11-20 11:52 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2014-12-06 15:03 - 2010-11-20 11:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tunnel.sys
2014-12-06 15:03 - 2010-11-20 11:51 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-12-06 15:03 - 2010-11-20 11:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndisuio.sys
2014-12-06 15:03 - 2010-11-20 11:49 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2014-12-06 15:03 - 2010-11-20 11:44 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys
2014-12-06 15:03 - 2010-11-20 11:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\umbus.sys
2014-12-06 15:03 - 2010-11-20 11:44 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD2.sys
2014-12-06 15:03 - 2010-11-20 11:43 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-12-06 15:03 - 2010-11-20 11:43 - 00109696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2014-12-06 15:03 - 2010-11-20 11:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2014-12-06 15:03 - 2010-11-20 11:34 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffp_sd.sys
2014-12-06 15:03 - 2010-11-20 11:33 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\CompositeBus.sys
2014-12-06 15:03 - 2010-11-20 11:33 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdhid.sys
2014-12-06 15:03 - 2010-11-20 11:14 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-12-06 15:03 - 2010-11-20 11:09 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scfilter.sys
2014-12-06 15:03 - 2010-11-20 11:04 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-12-06 15:03 - 2010-11-20 10:49 - 00258048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-12-06 15:03 - 2010-11-20 10:30 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpipmi.sys
2014-12-06 15:03 - 2010-11-20 10:26 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2014-12-06 15:03 - 2010-11-20 10:22 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdi.sys
2014-12-06 15:03 - 2010-11-20 10:19 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdrom.sys
2014-12-06 15:03 - 2010-11-10 02:48 - 00010429 _____ () C:\Windows\system32\ScavengeSpace.xml
2014-12-06 15:02 - 2010-11-20 14:16 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-12-06 15:02 - 2010-11-20 14:14 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwizres.dll
2014-12-06 15:02 - 2010-11-20 14:13 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2014-12-06 15:02 - 2010-11-20 14:12 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\pifmgr.dll
2014-12-06 15:02 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDTUQ.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDTUF.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDSG.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\kbdlk41a.dll
2014-12-06 15:02 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDGKL.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDCZ1.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDSF.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDPO.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDNEPR.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDINTAM.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDINBEN.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDGR1.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDUS.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDUGHR1.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTURME.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAJIK.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDMON.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDMAORI.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDLT1.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINTEL.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINORI.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINMAR.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINKAN.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINHIN.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBULG.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBLR.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-12-06 15:02 - 2010-11-20 14:02 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDGEO.DLL
2014-12-06 15:02 - 2010-11-20 13:54 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\BlbEvents.dll
2014-12-06 15:02 - 2010-11-20 13:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdscore.dll
2014-12-06 15:02 - 2010-11-20 13:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqmapi.dll
2014-12-06 15:02 - 2010-11-20 13:21 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shunimpl.dll
2014-12-06 15:02 - 2010-11-20 13:17 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PkgMgr.exe
2014-12-06 15:02 - 2010-11-20 13:08 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTUQ.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTUF.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDSG.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdlk41a.dll
2014-12-06 15:02 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGR1.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGKL.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDCZ1.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDSF.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDPO.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDNEPR.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINTAM.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINORI.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINMAR.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINKAN.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINHIN.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINBEN.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDUS.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDUGHR1.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTURME.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAJIK.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDMON.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDMAORI.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDLT1.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINTEL.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGEO.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBULG.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBLR.DLL
2014-12-06 15:02 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-12-06 15:02 - 2010-11-20 13:07 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwizres.dll
2014-12-06 15:02 - 2010-11-20 13:06 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2014-12-06 15:02 - 2010-11-20 13:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pifmgr.dll
2014-12-06 15:02 - 2010-11-05 03:20 - 00105559 _____ () C:\Windows\SysWOW64\RacRules.xml
2014-12-06 15:02 - 2010-11-05 03:20 - 00105559 _____ () C:\Windows\system32\RacRules.xml
2014-12-06 15:02 - 2009-06-10 22:39 - 00001041 _____ () C:\Windows\SysWOW64\tcpbidi.xml
2014-12-06 15:01 - 2010-11-20 13:21 - 00363008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wbemcomn.dll
2014-12-06 15:01 - 2010-11-20 13:18 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvstore.dll
2014-12-06 15:01 - 2010-11-20 13:18 - 00257024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpx.dll
2014-12-06 14:58 - 2010-11-20 14:27 - 00933376 _____ (Microsoft Corporation) C:\Windows\system32\SmiEngine.dll
2014-12-06 14:58 - 2010-11-20 14:27 - 00529408 _____ (Microsoft Corporation) C:\Windows\system32\wbemcomn.dll
2014-12-06 14:58 - 2010-11-20 14:27 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\wmicmiplugin.dll
2014-12-06 14:58 - 2010-11-20 14:27 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\sqmapi.dll
2014-12-06 14:58 - 2010-11-20 14:25 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\PkgMgr.exe
2014-12-06 14:57 - 2010-11-20 14:26 - 00422912 _____ (Microsoft Corporation) C:\Windows\system32\drvstore.dll
2014-12-06 14:57 - 2010-11-20 14:26 - 00399872 _____ (Microsoft Corporation) C:\Windows\system32\dpx.dll
2014-12-05 15:02 - 2014-12-10 20:45 - 00000000 ____D () C:\ProgramData\CayeRfuro
2014-12-05 13:54 - 2014-12-10 20:46 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-12-03 23:08 - 2014-12-03 23:10 - 11254840 _____ () C:\Users\*****\Downloads\Autodesk_Inventor_2015_R1_German_Win_64bit_wi_de-DE_Setup.exe
2014-12-01 20:39 - 2014-12-01 20:39 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-12-01 16:02 - 2014-12-01 16:02 - 00000000 ____D () C:\Users\*****\Documents\Autodesk Application Manager
2014-12-01 15:46 - 2014-12-01 15:46 - 00000000 ____D () C:\Users\*****\Documents\Inventor Server SDK ACAD 2015
2014-12-01 15:45 - 2014-12-02 15:11 - 00000000 ____D () C:\Users\*****\AppData\Local\Autodesk
2014-12-01 15:44 - 2014-12-01 15:44 - 00000000 ____D () C:\Program Files\Common Files\Macrovision Shared
2014-12-01 15:37 - 2014-12-03 23:55 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2014-12-01 15:36 - 2014-12-03 23:12 - 00000000 ____D () C:\Users\Public\Documents\Autodesk
2014-12-01 15:33 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-12-01 15:33 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-12-01 15:33 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-12-01 15:04 - 2014-12-03 23:55 - 00000000 ____D () C:\ProgramData\Autodesk
2014-12-01 15:04 - 2014-12-03 23:12 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Autodesk
2014-12-01 00:09 - 2014-12-01 00:09 - 00000458 _____ () C:\memory.txt
2014-11-30 23:54 - 2014-11-30 23:54 - 00000000 __RHD () C:\ProgramData\SecuROM
2014-11-30 23:53 - 2014-11-30 23:53 - 00221184 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe
2014-11-30 23:53 - 2014-11-30 23:53 - 00098304 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt.dll
2014-11-30 23:49 - 2014-11-30 23:49 - 00000000 ____D () C:\Program Files (x86)\Atari
2014-11-30 22:35 - 2014-12-04 02:07 - 00000000 ____D () C:\Autodesk
2014-11-30 22:35 - 2014-11-30 22:35 - 00000000 ____D () C:\Users\*****\AppData\Local\Akamai
2014-11-21 23:57 - 2014-11-21 23:57 - 00000000 ____D () C:\Program Files\Java
2014-11-21 23:31 - 2014-11-27 20:00 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe
2014-11-21 20:32 - 2014-12-07 15:25 - 00000000 ____D () C:\ProgramData\YimneLegpo
2014-11-21 20:32 - 2014-12-05 14:44 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
2014-11-13 15:54 - 2014-11-13 15:54 - 00000000 ____D () C:\Users\*****\Downloads\Minecraft
2014-11-13 15:30 - 2014-11-23 18:18 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Craften Terminal
2014-11-13 15:30 - 2014-11-13 15:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Craften Terminal
2014-11-13 15:28 - 2014-12-06 01:19 - 00000000 ____D () C:\Users\*****\Desktop\KL
2014-11-13 15:22 - 2014-11-13 15:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\TunkDesign
2014-11-13 15:18 - 2014-11-13 15:18 - 00098550 _____ () C:\Users\*****\Downloads\xray_1.7.4.zip
2014-11-13 13:19 - 2014-11-13 13:20 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-11-13 13:19 - 2014-11-13 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-13 11:18 - 2014-09-11 13:22 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{2BB45ECA-2C65-44E6-AA63-BC2D7A26E258}
2014-12-13 11:14 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-13 11:14 - 2009-07-14 05:45 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-13 11:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-13 01:21 - 2010-11-29 20:29 - 01921818 _____ () C:\Windows\WindowsUpdate.log
2014-12-13 01:03 - 2010-11-30 15:52 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc
2014-12-13 00:42 - 2009-07-14 18:58 - 09578674 _____ () C:\Windows\system32\perfh007.dat
2014-12-13 00:42 - 2009-07-14 18:58 - 02920902 _____ () C:\Windows\system32\perfc007.dat
2014-12-13 00:42 - 2009-07-14 06:13 - 00006276 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-13 00:35 - 2009-07-14 05:45 - 00345408 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-13 00:22 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Portable Devices
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Defender
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Microsoft Games
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\DVD Maker
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices
2014-12-13 00:22 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2014-12-13 00:22 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\servicing
2014-12-13 00:22 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-12-13 00:21 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\sppui
2014-12-13 00:21 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Setup
2014-12-13 00:21 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2014-12-13 00:21 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\migwiz
2014-12-13 00:21 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\manifeststore
2014-12-13 00:21 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-12-13 00:21 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\AdvancedInstallers
2014-12-13 00:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sppui
2014-12-13 00:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Setup
2014-12-13 00:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\oobe
2014-12-13 00:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\migwiz
2014-12-13 00:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\manifeststore
2014-12-13 00:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-12-13 00:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2014-12-12 22:44 - 2009-07-14 03:36 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2014-12-12 22:44 - 2009-07-14 03:36 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll
2014-12-12 21:58 - 2006-08-11 20:42 - 00000000 ___RD () C:\Programme
2014-12-12 21:16 - 2010-12-01 16:52 - 00000000 ____D () C:\ProgramData\Adobe
2014-12-12 21:15 - 2011-06-17 23:36 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-12-12 20:39 - 2014-02-01 13:12 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-12-12 20:38 - 2012-08-31 22:30 - 00000000 ____D () C:\Program Files (x86)\Java
2014-12-12 20:23 - 2010-11-29 21:53 - 00000000 ____D () C:\Users\*****\AppData\Local\Thunderbird
2014-12-12 20:22 - 2010-11-30 15:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-12-12 19:53 - 2014-05-13 15:14 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-12 19:53 - 2014-05-13 15:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-12 19:53 - 2014-05-13 15:14 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-11 20:34 - 2010-11-30 18:37 - 00085704 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-10 21:23 - 2014-09-24 20:28 - 00000000 ____D () C:\AdwCleaner
2014-12-10 19:46 - 2012-09-20 17:25 - 00000000 ____D () C:\Users\*****\Desktop\Spiele
2014-12-09 21:42 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-12-09 21:34 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-09 21:05 - 2010-11-29 23:37 - 00007603 _____ () C:\Users\*****\AppData\Local\Resmon.ResmonCfg
2014-12-09 20:12 - 2010-11-29 20:41 - 00000000 ____D () C:\Users\*****
2014-12-08 21:46 - 2012-09-02 20:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Nitro PDF
2014-12-08 19:13 - 2013-05-15 18:39 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-08 14:52 - 2013-03-21 13:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-08 14:52 - 2013-03-21 13:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-08 13:38 - 2013-03-21 13:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-07 01:19 - 2014-05-13 15:47 - 00085304 _____ () C:\Users\test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-07 01:11 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-06 16:52 - 2009-07-14 03:34 - 78381056 _____ () C:\Windows\system32\config\software.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 22020096 _____ () C:\Windows\system32\config\system.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 01835008 _____ () C:\Windows\system32\config\default.gu.bak
2014-12-06 16:52 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\security.gu.bak
2014-12-06 16:51 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\sam.gu.bak
2014-12-06 16:39 - 2012-08-12 14:25 - 00000000 ____D () C:\Users\*****\AppData\Local\Nero
2014-12-06 16:36 - 2014-05-12 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Counter-Strike 1.6
2014-12-06 16:20 - 2012-12-20 15:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\GlarySoft
2014-12-06 13:31 - 2011-08-19 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty - United Offensive
2014-12-06 01:13 - 2011-10-15 00:08 - 00000000 ____D () C:\Users\*****\AppData\Local\CrashDumps
2014-12-05 17:43 - 2011-12-19 18:15 - 00000000 ___RD () C:\Users\*****\Dropbox
2014-12-05 15:13 - 2011-12-19 18:11 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-12-03 22:17 - 2012-06-27 00:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Spotify
2014-12-03 13:36 - 2012-10-18 11:30 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-03 13:22 - 2012-06-27 00:23 - 00000000 ____D () C:\Users\*****\AppData\Local\Spotify
2014-12-01 15:12 - 2010-11-29 22:11 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-11-28 17:02 - 2012-12-15 16:27 - 00000000 ____D () C:\Users\*****\Desktop\Musik
2014-11-27 16:40 - 2010-11-30 22:23 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-23 18:24 - 2014-11-02 23:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\.minecraft
2014-11-21 23:57 - 2014-02-01 13:13 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-21 23:57 - 2014-02-01 13:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-11-21 23:34 - 2012-11-09 17:08 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-21 23:34 - 2011-06-06 17:48 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-21 23:33 - 2014-02-03 21:45 - 00000000 ____D () C:\Users\*****\Desktop\FF
2014-11-19 21:08 - 2013-05-15 18:39 - 00001849 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
Files to move or delete:
====================
C:\ProgramData\j62j6xbe.fee
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-05 11:56
==================== End Of Log ============================
Italiener |
|
14.12.2014, 11:17
| #11 |
| /// the machine /// TB-Ausbilder | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.12.2014, 12:24
| #12 |
| | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Hallo Schrauber, sorry das ich mich erst jetzt melde, ich war das Wochenende unterwegs. Vielen, vielen Dank für die schnelle, unkomplizierte und erfolgreiche Hilfe! Es läuft wieder ohne Probleme. Werde natürlich noch einen Beitrag bezgl. des Lobes im entsprechendem Forum verfassen Eine Frage habe ich aber noch. Ich habe jetzt mehrfach gelesen (unter anderem auch hier im Forum), dass Avira als Viren Software nicht unbedingt, die beste Wahl ist. Kannst du eine Anti-Viren Software empfehlen. Gruß, Italiener |
|
15.12.2014, 20:58
| #13 |
| /// the machine /// TB-Ausbilder | Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager Ich empfehle immer Emsisoft
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win7: Avira meldet mehrere Funde und ich habe zwei mal explorer.exe im Task-Manager |
| antivir, antivirus, avira, bonjour, browser, converter, desktop, downloader, dvdvideosoft ltd., error, flash player, helper, home, hängen, iexplore.exe, installation, malware, mozilla, mp3, msiexec.exe, programm, registry, ressourcenmonitor, scan, software, svchost.exe, system, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
