GVU Trojaner mit Win 8

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-01-2015
Ran by SYSTEM on MININT-MTUUTA3 on 02-01-2015 17:54:51
Running from E:\
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2014-01-08] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1368792 2014-01-08] (Realtek Semiconductor)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2013-08-03] (Realtek semiconductor)
HKLM\...\Run: [UMonit64] => C:\WINDOWS\SysWOW64\UMonit64.exe [40960 2013-02-28] ()
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15792112 2013-09-27] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [101360 2013-09-27] (Lenovo(beijing) Limited)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2986224 2013-07-17] (Synaptics Incorporated)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [168464 2012-10-30] (CyberLink Corp.)
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-21] (APN)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-11-19] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3084288 2012-07-31] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [133248 2013-05-31] ( (Atheros Communications))
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\Wolfgang\...\Run: [GoogleChromeAutoLaunch_CB5799DE6B504E140845F08AE36D5E5C] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [856904 2014-12-06] (Google Inc.)
HKU\Wolfgang\...\Winlogon: [Userinit] C:\Users\Wolfgang\AppData\Roaming\loadit.exe [605044 2015-01-02] ()
HKU\Wolfgang\...\Winlogon: [Shell] C:\Users\Wolfgang\AppData\Roaming\loadit.exe [605044 2015-01-02] () <==== ATTENTION 
Startup: C:\Users\Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoStarter.lnk
ShortcutTarget: AutoStarter.lnk -> C:\windows\system32\config\systemprofile\AppData\Roaming\autostarter.exe (No File)
Startup: C:\Users\Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ja.lnk
ShortcutTarget: ja.lnk -> C:\windows\system32\config\systemprofile\AppData\Roaming\loadit.exe (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-21] (APN LLC.)
S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [310912 2013-05-31] (Windows (R) Win 7 DDK provider)
S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
S2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-03-22] (Intel Corporation)
S2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-05-09] (Intel Corporation)
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] ()
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-05-09] (Intel Corporation)
S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [200728 2012-05-11] (McAfee, Inc.)
S2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [603424 2014-09-04] (McAfee, Inc.)
S2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-08-20] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
S2 mfevtp; C:\WINDOWS\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
S2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2012-12-13] (Nitro PDF Software)
S2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2013-09-27] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-05-30] (Atheros)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-05-30] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [79592 2013-02-22] (GenesysLogic)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
S3 huawei_wwanecm; C:\Windows\system32\DRIVERS\ew_juwwanecm.sys [238080 2012-04-23] (Huawei Technologies Co., Ltd.)
S3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70600 2014-06-20] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
S3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [445512 2014-08-20] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96592 2014-08-20] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
S3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8873688 2013-08-03] (Realtek Semiconductor Corp.)
S3 SensorsAlsDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)
S3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-07-17] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-19] (StdLib)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-02 17:54 - 2015-01-02 17:54 - 00000000 ____D () C:\FRST
2015-01-02 15:49 - 2015-01-02 16:23 - 00605044 _____ () C:\Users\Wolfgang\AppData\Roaming\loadit.exe
2015-01-02 15:49 - 2015-01-02 15:49 - 00154283 ____H () C:\Users\Wolfgang\AppData\Roaming\Wolfgang-wchelper.dll
2015-01-02 15:49 - 2015-01-02 15:49 - 00000000 ____D () C:\directory
2015-01-02 15:45 - 2015-01-02 15:45 - 00000000 ____D () C:\Users\Wolfgang\AppData\Roaming\WinRAR
2015-01-02 15:34 - 2015-01-02 16:23 - 00000032 _____ () C:\Users\Wolfgang\AppData\Roaming\url.txt
2015-01-02 15:29 - 2015-01-02 08:48 - 94133673 _____ () C:\Users\Wolfgang\AppData\Roaming\autostarter.exe
2015-01-02 15:28 - 2015-01-02 15:28 - 00000000 ____D () C:\Program Files\WinRAR
2015-01-02 14:40 - 2015-01-02 16:21 - 00000000 ____D () C:\Users\Wolfgang\AppData\Roaming\UseNeXT
2015-01-02 14:40 - 2015-01-02 16:20 - 00000000 ____D () C:\Users\Wolfgang\Documents\UseNeXT
2015-01-02 14:38 - 2015-01-02 14:38 - 00001673 _____ () C:\Users\Wolfgang\Desktop\UseNeXT by Tangysoft.lnk
2015-01-02 14:38 - 2015-01-02 14:38 - 00000000 ____D () C:\Program Files\UseNeXT
2015-01-02 14:34 - 2015-01-02 14:34 - 00438272 _____ () C:\Users\Wolfgang\AppData\Roaming\Tophet.gb
2014-12-28 11:45 - 2014-12-28 11:48 - 00000022 _____ () C:\Users\Wolfgang\Downloads\Photos (1).zip
2014-12-25 18:02 - 2014-12-25 18:02 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-22 19:44 - 2014-12-23 20:15 - 00000000 ____D () C:\Users\Wolfgang\Documents\Bau
2014-12-22 19:44 - 2014-12-22 19:44 - 00017215 _____ () C:\Users\Wolfgang\Documents\Bau.xlsx
2014-12-15 13:11 - 2014-12-15 13:11 - 00000000 ____D () C:\Windows\System32\appraiser
2014-12-15 12:39 - 2014-12-15 13:10 - 00000000 ____D () C:\Users\Wolfgang\Documents\geo-konzept
2014-12-15 09:05 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2014-12-15 09:05 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\System32\poqexec.exe
2014-12-11 21:30 - 2014-11-10 03:29 - 00034304 _____ (Microsoft Corporation) C:\Windows\System32\DeviceSetupStatusProvider.dll
2014-12-11 21:30 - 2014-11-10 02:51 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-11 21:30 - 2014-11-01 00:57 - 01091072 _____ (Microsoft Corporation) C:\Windows\System32\MrmCoreR.dll
2014-12-11 21:30 - 2014-11-01 00:47 - 00790528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2014-12-11 21:30 - 2014-10-31 00:39 - 01970432 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2014-12-11 21:30 - 2014-10-31 00:38 - 01612992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-12-11 21:17 - 2014-12-04 00:37 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-12-11 21:17 - 2014-12-04 00:09 - 00830464 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2014-12-11 21:17 - 2014-12-03 00:09 - 01083392 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-12-11 21:17 - 2014-12-03 00:09 - 00740864 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2014-12-11 21:17 - 2014-12-03 00:09 - 00412672 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-12-11 21:17 - 2014-12-03 00:09 - 00396288 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2014-12-11 21:17 - 2014-12-03 00:09 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll
2014-12-11 21:17 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2014-12-11 21:17 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-11 21:17 - 2014-10-13 03:43 - 00238912 ____C (Microsoft Corporation) C:\Windows\System32\Drivers\sdbus.sys
2014-12-11 21:17 - 2014-10-13 03:43 - 00153920 ____C (Microsoft Corporation) C:\Windows\System32\Drivers\dumpsd.sys
2014-12-11 21:17 - 2014-10-13 03:43 - 00086336 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\pdc.sys
2014-12-11 21:17 - 2014-10-13 03:43 - 00039744 ____C (Microsoft Corporation) C:\Windows\System32\Drivers\intelpep.sys
2014-12-11 21:13 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-12-11 21:13 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-12-11 21:13 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-12-11 21:13 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2014-12-11 21:13 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-12-11 21:13 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2014-12-11 21:13 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-12-11 21:13 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-11 21:13 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-12-11 21:13 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-11 21:13 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-12-11 21:13 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2014-12-11 21:13 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-12-11 21:13 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-11 21:13 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-11 21:13 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\System32\inetcomm.dll
2014-12-11 21:13 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-12-11 21:13 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2014-12-11 21:13 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-12-11 21:13 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-12-11 21:13 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-12-11 21:13 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-12-11 21:13 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-12-11 21:13 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-11 21:13 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-12-11 21:13 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-11 21:13 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-11 21:13 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2014-12-11 21:13 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-12-11 21:13 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-12-11 21:13 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-11 21:13 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-11 21:13 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-11 21:13 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-12-11 21:13 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-11 21:13 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-12-11 21:13 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-11 21:13 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-11 21:13 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-07 18:18 - 2014-12-31 17:12 - 00000360 _____ () C:\Windows\BRRBCOM.INI
2014-12-07 18:17 - 2013-12-26 07:35 - 00180224 _____ (Brother Industries, Ltd.) C:\Windows\SysWOW64\BROSNMP.DLL
2014-12-07 18:17 - 2013-12-25 17:13 - 00224256 _____ (Brother Industries, Ltd.) C:\Windows\System32\BRCOC12A.DLL
2014-12-07 18:17 - 2012-07-14 09:53 - 00087040 _____ (Brother Industries, Ltd.) C:\Windows\System32\BrNetSti.dll
2014-12-07 18:17 - 2012-06-15 01:11 - 01441792 _____ (Brother Industries, Ltd.) C:\Windows\System32\BrWi212b.dll
2014-12-07 18:17 - 2011-09-08 10:36 - 00279040 _____ (Brother Industries, Ltd.) C:\Windows\System32\BrJDec.dll
2014-12-07 18:14 - 2014-12-07 18:15 - 00000000 ____D () C:\Users\Wolfgang\Downloads\install
2014-12-07 18:08 - 2014-12-07 18:14 - 130475696 _____ (A.I.SOFT,INC.) C:\Users\Wolfgang\Downloads\DCP-9020CDW-inst-B1-EU.EXE
2014-12-03 18:47 - 2014-12-03 18:47 - 00002149 _____ () C:\Users\Wolfgang\AppData\Local\recently-used.xbel
2014-12-03 16:39 - 2014-12-03 18:47 - 00000000 ____D () C:\Users\Wolfgang\Documents\baywa
2014-12-03 16:20 - 2014-12-03 16:20 - 00000000 ____D () C:\Users\Wolfgang\AppData\Roaming\IsolatedStorage
2014-12-03 16:20 - 2014-12-03 16:20 - 00000000 ____D () C:\Users\Wolfgang\AppData\Local\FileViewPro
2014-12-03 16:20 - 2014-12-03 16:20 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2014-12-03 16:18 - 2015-01-02 12:09 - 00000000 ____D () C:\Users\Wolfgang\AppData\Roaming\Solvusoft
2014-12-03 16:18 - 2012-10-15 17:02 - 00019888 _____ (solvusoft) C:\Windows\System32\roboot64.exe
2014-12-03 16:17 - 2014-12-03 16:17 - 03071160 _____ () C:\Users\Wolfgang\Downloads\Setup_FileViewPro_2015.exe
2014-12-03 16:17 - 2014-12-03 16:17 - 00000000 ____D () C:\Spacekace

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-02 17:49 - 2014-03-31 21:34 - 00000306 _____ () C:\Windows\Tasks\FF Watcher {C2390913-F996-4D4F-979B-5A7913B04A06}.job
2015-01-02 17:49 - 2013-12-24 19:38 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-02 17:48 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-02 17:48 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\System32\config\ELAM
2015-01-02 17:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\System32\sru
2015-01-02 17:40 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-01-02 17:38 - 2014-04-29 11:13 - 00001871 _____ () C:\Users\Public\Desktop\McAfee AntiVirus Plus.lnk
2015-01-02 17:38 - 2013-11-14 08:27 - 01780340 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-01-02 17:38 - 2013-11-14 08:11 - 00766620 _____ () C:\Windows\System32\perfh007.dat
2015-01-02 17:38 - 2013-11-14 08:11 - 00159902 _____ () C:\Windows\System32\perfc007.dat
2015-01-02 17:37 - 2014-09-30 08:07 - 00003718 _____ () C:\Windows\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2015-01-02 17:32 - 2013-12-25 00:49 - 00000000 ____D () C:\users\Wolfgang
2015-01-02 17:31 - 2013-08-22 15:46 - 00338545 _____ () C:\Windows\setupact.log
2015-01-02 16:44 - 2013-09-27 00:38 - 00010752 _____ () C:\Windows\System32\VfService.trf
2015-01-02 16:26 - 2013-12-25 00:55 - 02037383 _____ () C:\Windows\WindowsUpdate.log
2015-01-02 16:24 - 2013-11-13 23:18 - 00060674 _____ () C:\Windows\PFRO.log
2015-01-02 16:24 - 2013-08-22 14:25 - 00524288 ___SH () C:\Windows\System32\config\BBI
2015-01-02 16:22 - 2014-06-20 08:06 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8c563854068e.job
2015-01-02 16:22 - 2013-12-19 20:08 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3705881293-312456249-3159463879-1001
2015-01-02 16:17 - 2014-03-29 23:48 - 00005148 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for WOLFGANG-Wolfgang Wolfgang
2015-01-02 16:17 - 2013-12-25 00:59 - 00000000 __RDO () C:\Users\Wolfgang\SkyDrive
2015-01-02 16:14 - 2013-12-19 20:00 - 00000000 ____D () C:\Users\Wolfgang\AppData\Local\Packages
2015-01-02 15:32 - 2014-02-11 21:21 - 00003942 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{8EC1A240-E330-46F1-9F6C-31107140B3EF}
2014-12-25 17:28 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-12-23 16:51 - 2014-03-29 23:11 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-12-22 18:34 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2014-12-15 13:11 - 2014-07-14 14:55 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-12-15 13:11 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-15 09:09 - 2013-12-22 14:23 - 00000000 ____D () C:\Windows\System32\MRT
2014-12-15 09:07 - 2013-12-22 14:23 - 112710672 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-12-15 09:06 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\System32\sr-Latn-RS
2014-12-15 09:06 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\System32\sr-Latn-CS
2014-12-15 09:05 - 2014-04-18 13:45 - 00000000 ____D () C:\Program Files (x86)\Java
2014-12-13 19:23 - 2014-11-16 13:28 - 00000000 ____D () C:\Users\Wolfgang\Documents\Paul
2014-12-13 18:25 - 2013-12-24 19:41 - 00002166 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-07 18:26 - 2014-06-06 08:02 - 00000000 ____D () C:\Users\Wolfgang\AppData\Roaming\Nitro PDF
2014-12-07 18:26 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\System32\FxsTmp
2014-12-07 18:23 - 2014-07-09 21:05 - 00000000 ____D () C:\Users\Wolfgang\AppData\Roaming\ControlCenter4
2014-12-07 18:21 - 2014-04-29 11:12 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-12-07 18:18 - 2014-07-09 21:00 - 00000000 ____D () C:\Program Files (x86)\Browny02
2014-12-07 18:18 - 2014-07-09 20:59 - 00000000 ____D () C:\Program Files (x86)\Brother
2014-12-07 18:17 - 2014-07-09 21:00 - 00000000 ____D () C:\ProgramData\ControlCenter4
2014-12-07 18:17 - 2014-07-09 21:00 - 00000000 ____D () C:\Program Files (x86)\ControlCenter4
2014-12-07 18:16 - 2013-09-27 00:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-03 19:32 - 2013-12-19 20:08 - 00000000 ____D () C:\ProgramData\tmp
2014-12-03 19:15 - 2014-10-01 20:42 - 00000000 ____D () C:\Users\Wolfgang\.gimp-2.8
2014-12-03 18:47 - 2014-10-01 20:46 - 00000000 ____D () C:\Users\Wolfgang\AppData\Local\gtk-2.0

Some content of TEMP:
====================
C:\Users\Wolfgang\AppData\Local\Temp\DriverUpdaterSetup-2.1.0.5019.exe
C:\Users\Wolfgang\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Wolfgang\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Wolfgang\AppData\Local\Temp\ochelper.exe
C:\Users\Wolfgang\AppData\Local\Temp\Offercast2910_NDV_.exe
C:\Users\Wolfgang\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Wolfgang\AppData\Local\Temp\Quarantine.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe
[2014-09-14 19:02] - [2014-08-23 08:48] - 2374784 ____A (Microsoft Corporation) ACDBE1ED38167C8B01B8F63161BB2CEA

C:\Windows\SysWOW64\explorer.exe
[2014-09-14 19:02] - [2014-08-23 08:13] - 2084520 ____A (Microsoft Corporation) 195822ACCDAA2B4815DD01BAFC335595

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll
[2014-11-13 18:52] - [2014-09-22 05:38] - 1519488 ____A (Microsoft Corporation) F0A117D19873FCDF801F082F33BFBB6C

C:\Windows\SysWOW64\User32.dll
[2014-11-13 18:52] - [2014-09-19 01:16] - 1346048 ____A (Microsoft Corporation) 5F333FDBF392850373C89BDA31EBEC1B

C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2014-09-14 19:01] - [2014-06-19 03:13] - 0310080 ___AC (Microsoft Corporation) 64CA2B4A49A8EAF495E435623ECCE7DB


==================== Restore Points  =========================

Restore point made on: 2014-12-22 16:31:02
Restore point made on: 2014-12-25 17:28:46
Restore point made on: 2015-01-02 12:41:43

==================== Memory info =========================== 

Percentage of memory in use: 20%
Total physical RAM: 3816.27 MB
Available physical RAM: 3045.63 MB
Total Pagefile: 3816.27 MB
Available Pagefile: 3072.17 MB
Total Virtual: 131072 MB
Available Virtual: 131071.87 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:78.57 GB) (Free:16.94 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:21.74 GB) NTFS
Drive e: (CORSAIR) (Removable) (Total:7.52 GB) (Free:7.25 GB) FAT32
Drive f: () (Fixed) (Total:0.34 GB) (Free:0.03 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.5 GB) (Free:0.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: A7D3B02A)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 7.5 GB) (Disk ID: 04DD5721)
Partition 1: (Active) - (Size=7.5 GB) - (Type=0B)


LastRegBack: 2014-12-22 12:01

==================== End Of Log ============================