Windows 7, diverse Trojaner? ungewollte "Programme"

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:34 on 18/02/2015 (PePur)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015
Ran by PePur (administrator) on NETBOOK on 18-02-2015 15:40:31
Running from E:\Trojaner
Loaded Profiles: PePur (Available profiles: PePur)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: taplika.exe)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files\WinZipper\winzipersvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corp.) C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc.exe
() C:\Users\PePur\AppData\Roaming\CDE6A2FD-1424191138-DE11-9904-002622DE56CC\JOSrv.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Program Files\Mobile Broadband Drivers\WMCore\mini_WMCore.exe
() C:\Users\PePur\AppData\Roaming\CDE6A2FD-1424191138-DE11-9904-002622DE56CC\nsh910.tmp
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files\Lenovo\Energy Management\Energy Management.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\EPSON Software\Event Manager\EEventManager.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATILGE.EXE
(Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Express Tray\ExpressTray.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
() E:\Trojaner\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7739936 2009-09-21] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1529128 2009-05-29] (Synaptics Incorporated)
HKLM\...\Run: [VeriFaceManager] => C:\Program Files\Lenovo\VeriFace\PManage.exe
HKLM\...\Run: [EnergyUtility] => C:\Program Files\Lenovo\Energy Management\utility.exe [4114288 2009-09-29] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files\Lenovo\Energy Management\Energy Management.exe [5064560 2009-09-29] (Lenovo (Beijing) Limited)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [978520 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [BingDesktop] => C:\Program Files\Microsoft\BingDesktop\BingDesktop.exe [2353880 2013-11-01] (Microsoft Corp.)
HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [1065024 2014-05-02] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-4185872467-282433234-656447781-1000\...\Run: [EPLTarget\P0000000000000000] => C:\windows\system32\spool\DRIVERS\W32X86\3\E_FATILGE.EXE [260160 2013-01-24] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-4185872467-282433234-656447781-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [688984 2014-08-27] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-4185872467-282433234-656447781-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [WLStart] => C:\Program Files\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2014-04-23] (Microsoft Corporation)
AppInit_DLLs: C:/PROGRA~2/{B4E05~1/171~1.0/tare.dll => C:/PROGRA~2/{B4E05~1/171~1.0/tare.dll [649216 2015-02-17] ()
IFEO\bbqleads.exe: [Debugger] TaskList.exe
IFEO\bbqleadsapplication.exe: [Debugger] TaskList.exe
IFEO\bbqleadsservice.exe: [Debugger] TaskList.exe
IFEO\bbqquotes.exe: [Debugger] TaskList.exe
IFEO\ContentExplorer.exe: [Debugger] TaskList.exe
IFEO\donutleads.exe: [Debugger] TaskList.exe
IFEO\donutquotes.exe: [Debugger] TaskList.exe
IFEO\internetenhancer.exe: [Debugger] TaskList.exe
IFEO\internetenhancerservice.exe: [Debugger] TaskList.exe
IFEO\pastaleads.exe: [Debugger] TaskList.exe
IFEO\pastaquotes.exe: [Debugger] TaskList.exe
IFEO\theanswerfinder.exe: [Debugger] TaskList.exe
IFEO\wajaminternetenhancer.exe: [Debugger] TaskList.exe
IFEO\WajamInternetEnhancerApp.exe: [Debugger] TaskList.exe
IFEO\WajamInternetEnhancerAppservice.exe: [Debugger] TaskList.exe
IFEO\wajaminternetenhancerservice.exe: [Debugger] TaskList.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\PePur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1398089536&from=smt&uid=WDCXWD1600BEVT-22ZCT0_WD-WXB0A793321633216&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1398089536&from=smt&uid=WDCXWD1600BEVT-22ZCT0_WD-WXB0A793321633216&q={searchTerms}
HKU\S-1-5-21-4185872467-282433234-656447781-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.delta-homes.com/web/?type=ds&ts=1420113157&from=wpm12311&uid=WDCXWD1600BEVT-22ZCT0_WD-WXB0A793321633216&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4185872467-282433234-656447781-1000 -> DefaultScope {EBFB468A-B909-4032-BF5C-C09A2905ED79} URL = hxxp://taplika.com/results.php?f=4&q={searchTerms}&a=tpl_tuto15_15_08&cd=2XzuyEtN2Y1L1QzutD0CyCtDyByC0B0AtAtB0ByCtDyC0FtAtN0D0Tzu0StCtCyEtAtN1L2XzutAtFyBtFtBtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyCyBtA0C0C0D0E0EtGzytA0ByCtGyD0DtA0EtGtByDyD0AtGtAtC0AtAtD0AtDyDtD0BtD0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBzyyBzzyEyD0A0DtGzz0AyDyCtGyE0FyCyEtGzytAtC0FtG0CyD0CyC0ByEtCyDyCtA0D0D2Q&cr=1465210661&ir=
SearchScopes: HKU\S-1-5-21-4185872467-282433234-656447781-1000 -> {EBFB468A-B909-4032-BF5C-C09A2905ED79} URL = hxxp://taplika.com/results.php?f=4&q={searchTerms}&a=tpl_tuto15_15_08&cd=2XzuyEtN2Y1L1QzutD0CyCtDyByC0B0AtAtB0ByCtDyC0FtAtN0D0Tzu0StCtCyEtAtN1L2XzutAtFyBtFtBtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyCyBtA0C0C0D0E0EtGzytA0ByCtGyD0DtA0EtGtByDyD0AtGtAtC0AtAtD0AtDyDtD0BtD0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBzyyBzzyEyD0A0DtGzz0AyDyCtGyE0FyCyEtGzytAtC0FtG0CyD0CyC0ByEtCyDyCtA0D0D2Q&cr=1465210661&ir=
BHO: Faostsalleri -> {06e9cb53-73dd-4ff2-812f-2aac9329ea08} -> C:\Program Files\Faostsalleri\trcZ1oaOOMATDU.dll ()
BHO: nitrOadeoail -> {88ba1417-45de-4a4e-9ed6-45b77d37ff45} -> C:\Program Files\nitrOadeoail\ajwDSCHIP23pfI.dll ()
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 212.37.37.50
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKU\S-1-5-21-4185872467-282433234-656447781-1000\...\Firefox\Extensions: [{E778513A-4128-E4CB-BEF2-7F4E0841656E}] - C:\Program Files\ver9TheBestDeals\189.xpi

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 38a94c45; c:\Program Files\RelayEdit\RelayEdit.dll [1648640 2015-02-17] () [File not signed]
S2 bb1a24ab; c:\Program Files\RelayStasis\RelayStasis.dll [1625600 2015-02-17] () [File not signed]
R2 BingDesktopUpdate; C:\Program Files\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [582944 2009-08-11] (Broadcom Corporation.)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 EpsonScanSvc; C:\windows\system32\EscSvc.exe [126128 2012-05-16] (Seiko Epson Corporation)
R2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [441176 2014-08-27] (Garmin Ltd or its subsidiaries)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22184 2015-01-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [284472 2015-01-30] (Microsoft Corporation)
R2 serverjo; C:\Users\PePur\AppData\Roaming\CDE6A2FD-1424191138-DE11-9904-002622DE56CC\JOSrv.exe [128000 2015-02-17] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 winzipersvc; C:\Program Files\WinZipper\winzipersvc.exe [425136 2014-12-31] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION
R2 WMCoreService; C:\Program Files\Mobile Broadband Drivers\WMCore\mini_WMCore.exe [430080 2009-09-24] () [File not signed]
R2 wynyliho; C:\Users\PePur\AppData\Roaming\CDE6A2FD-1424191138-DE11-9904-002622DE56CC\nsh910.tmp [192000 2015-02-17] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ACPIVPC; C:\windows\System32\DRIVERS\AcpiVpc.sys [23136 2010-01-20] (Lenovo Corporation)
R3 e36gbus; C:\windows\System32\DRIVERS\e36gbus.sys [285056 2009-06-30] (MCCI Corporation)
R3 e36gmdfl; C:\windows\System32\DRIVERS\e36gmdfl.sys [14848 2009-06-30] (MCCI Corporation)
R3 e36gmdm; C:\windows\System32\DRIVERS\e36gmdm.sys [374272 2009-06-30] (MCCI Corporation)
R3 e36gmgmt; C:\windows\System32\DRIVERS\e36gmgmt.sys [357376 2009-06-30] (MCCI Corporation)
R3 e36wgps; C:\windows\System32\DRIVERS\e36wgps.sys [82984 2009-07-10] (Ericsson AB)
R3 ecnssndis; C:\windows\System32\Drivers\wwanuss.sys [10240 2009-09-22] (Ericsson AB)
R3 ecnssndisfltr; C:\windows\System32\Drivers\wwanussf.sys [14848 2009-09-22] (Ericsson AB)
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [239224 2014-11-15] (Microsoft Corporation)
R1 MpKsl0b3c83ef; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F223AF6F-5B48-424C-89F1-52C09F236F2C}\MpKsl0b3c83ef.sys [39464 2015-02-18] (Microsoft Corporation)
R1 MpKslc1659fc8; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F223AF6F-5B48-424C-89F1-52C09F236F2C}\MpKslc1659fc8.sys [39464 2015-02-17] (Microsoft Corporation)
R2 webTinstMK; C:\windows\system32\Drivers\webTinstMK.sys [43560 2015-02-17] ()
S3 wsvd; C:\windows\System32\DRIVERS\wsvd.sys [81704 2009-07-21] (CyberLink)
R3 WwanUsbServ; C:\windows\System32\DRIVERS\WwanUsbMp.sys [216616 2009-09-22] (Ericsson AB)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-18 15:40 - 2015-02-18 15:40 - 00000000 ____D () C:\FRST
2015-02-18 15:34 - 2015-02-18 15:34 - 00000000 _____ () C:\Users\PePur\defogger_reenable
2015-02-18 14:55 - 2015-02-18 14:56 - 00000000 ____D () C:\Program Files\Custom RSS News
2015-02-18 14:54 - 2015-02-18 14:56 - 00000000 ____D () C:\Program Files\nitrOadeoail
2015-02-18 14:54 - 2015-02-18 14:56 - 00000000 ____D () C:\Program Files\laowrratte
2015-02-18 14:51 - 2015-02-18 14:55 - 00000000 ____D () C:\Program Files\Faostsalleri
2015-02-18 14:50 - 2015-02-18 14:55 - 00000000 ____D () C:\Program Files\buyandbirowsoe
2015-02-18 14:49 - 2015-02-18 14:55 - 00000000 ____D () C:\ProgramData\12866579417585573116
2015-02-18 14:48 - 2015-02-18 14:53 - 00000000 ____D () C:\Program Files\ccheaPP4aalLL
2015-02-17 21:51 - 2015-02-18 14:18 - 00114904 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-17 21:49 - 2015-02-17 21:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-17 21:48 - 2015-02-17 21:49 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-02-17 21:48 - 2015-02-17 21:48 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-17 21:48 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-02-17 21:48 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-02-17 21:48 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-02-17 20:29 - 2012-08-23 15:48 - 00221184 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2015-02-17 20:29 - 2012-08-23 15:44 - 00014848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpvideominiport.sys
2015-02-17 20:29 - 2012-08-23 14:52 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\RdpGroupPolicyExtension.dll
2015-02-17 20:29 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\rdpendp_winip.dll
2015-02-17 20:29 - 2012-08-23 11:08 - 02739712 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2015-02-17 20:12 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2015-02-17 20:03 - 2013-10-02 01:42 - 00049152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\TsUsbFlt.sys
2015-02-17 20:03 - 2013-10-02 01:32 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-02-17 20:03 - 2013-10-02 01:30 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-02-17 20:03 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\MsRdpWebAccess.dll
2015-02-17 20:03 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\wksprtPS.dll
2015-02-17 20:03 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll
2015-02-17 20:03 - 2013-10-02 00:45 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\TsUsbGDCoInstaller.dll
2015-02-17 20:03 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\rdvidcrl.dll
2015-02-17 20:03 - 2013-10-02 00:00 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-02-17 20:03 - 2013-10-01 23:53 - 00350208 _____ (Microsoft Corporation) C:\windows\system32\wksprt.exe
2015-02-17 20:03 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2015-02-17 20:03 - 2013-10-01 21:55 - 05698048 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2015-02-17 19:48 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2vdec.dll
2015-02-17 19:36 - 2012-07-26 04:21 - 00196608 _____ (Microsoft Corporation) C:\windows\system32\WUDFHost.exe
2015-02-17 19:36 - 2012-07-26 04:20 - 00613888 _____ (Microsoft Corporation) C:\windows\system32\WUDFx.dll
2015-02-17 19:36 - 2012-07-26 04:20 - 00172032 _____ (Microsoft Corporation) C:\windows\system32\WUDFPlatform.dll
2015-02-17 19:36 - 2012-07-26 04:20 - 00073216 _____ (Microsoft Corporation) C:\windows\system32\WUDFSvc.dll
2015-02-17 19:36 - 2012-07-26 04:20 - 00038912 _____ (Microsoft Corporation) C:\windows\system32\WUDFCoinstaller.dll
2015-02-17 19:36 - 2012-07-26 03:33 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WUDFPf.sys
2015-02-17 19:36 - 2012-07-26 03:32 - 00155136 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WUDFRd.sys
2015-02-17 19:36 - 2012-06-02 15:57 - 00000003 _____ () C:\windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2015-02-17 19:29 - 2015-02-18 13:52 - 00000065 _____ () C:\Users\PePur\AppData\Roaming\WB.CFG
2015-02-17 18:26 - 2015-02-17 18:26 - 00000000 ____D () C:\ProgramData\{B4E05C23-E462-8DA5-55E4-FD2785662EA9}
2015-02-17 18:23 - 2015-02-17 21:22 - 00000364 _____ () C:\windows\Tasks\APSnotifierPP3.job
2015-02-17 18:23 - 2015-02-17 21:22 - 00000364 _____ () C:\windows\Tasks\APSnotifierPP2.job
2015-02-17 18:23 - 2015-02-17 18:43 - 00000366 _____ () C:\windows\Tasks\APSnotifierPP1.job
2015-02-17 18:19 - 2015-02-17 18:18 - 00628496 _____ (CMI Limited) C:\Users\PePur\AppData\Local\nsjD34.tmp
2015-02-17 18:18 - 2015-02-17 18:18 - 00000000 __SHD () C:\Users\PePur\AppData\Roaming\AnyProtectEx
2015-02-17 17:58 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\windows\system32\secproc.dll
2015-02-17 17:58 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\windows\system32\secproc_isv.dll
2015-02-17 17:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\secproc_ssp_isv.dll
2015-02-17 17:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\secproc_ssp.dll
2015-02-17 17:58 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\windows\system32\msdrm.dll
2015-02-17 17:58 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\windows\system32\RMActivate_isv.exe
2015-02-17 17:58 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\windows\system32\RMActivate.exe
2015-02-17 17:58 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\windows\system32\RMActivate_ssp.exe
2015-02-17 17:58 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\windows\system32\RMActivate_ssp_isv.exe
2015-02-17 17:57 - 2013-05-10 04:20 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\cryptdlg.dll
2015-02-17 17:56 - 2014-01-28 03:07 - 00185344 _____ (Microsoft Corporation) C:\windows\system32\wwansvc.dll
2015-02-17 17:56 - 2013-03-19 04:33 - 00040960 _____ (Microsoft Corporation) C:\windows\system32\wwanprotdim.dll
2015-02-17 17:56 - 2012-10-09 18:40 - 00193536 _____ (Microsoft Corporation) C:\windows\system32\dhcpcore6.dll
2015-02-17 17:56 - 2012-10-09 18:40 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\dhcpcsvc6.dll
2015-02-17 17:56 - 2012-07-06 20:23 - 00393728 _____ (Microsoft Corporation) C:\windows\system32\Drivers\bthport.sys
2015-02-17 17:55 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\windows\system32\TSWorkspace.dll
2015-02-17 17:55 - 2014-07-09 02:29 - 00006144 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
2015-02-17 17:55 - 2014-07-09 02:29 - 00006144 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
2015-02-17 17:55 - 2014-07-09 02:29 - 00006144 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
2015-02-17 17:55 - 2014-07-09 02:29 - 00006144 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
2015-02-17 17:55 - 2014-07-09 02:29 - 00005632 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
2015-02-17 17:55 - 2014-07-08 23:30 - 00419992 _____ () C:\windows\system32\locale.nls
2015-02-17 17:55 - 2012-10-03 17:42 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\netcorehc.dll
2015-02-17 17:55 - 2012-10-03 17:42 - 00018944 _____ (Microsoft Corporation) C:\windows\system32\netevent.dll
2015-02-17 17:55 - 2012-10-03 17:40 - 00499712 _____ (Microsoft Corporation) C:\windows\system32\iphlpsvc.dll
2015-02-17 17:55 - 2012-10-03 16:21 - 00035328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpipreg.sys
2015-02-17 17:54 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-02-17 17:54 - 2014-02-04 03:07 - 00234432 _____ (Microsoft Corporation) C:\windows\system32\Drivers\msiscsi.sys
2015-02-17 17:54 - 2014-02-04 03:07 - 00149440 _____ (Microsoft Corporation) C:\windows\system32\Drivers\storport.sys
2015-02-17 17:54 - 2014-02-04 03:07 - 00027072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Diskdump.sys
2015-02-17 17:54 - 2014-02-04 03:00 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\iologmsg.dll
2015-02-17 17:54 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2015-02-17 17:53 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2015-02-17 17:53 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2015-02-17 17:53 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
2015-02-17 17:52 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\windows\system32\scavengeui.dll
2015-02-17 17:52 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2015-02-17 17:52 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll
2015-02-17 17:51 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\windows\system32\charmap.exe
2015-02-17 17:51 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2015-02-17 17:51 - 2014-06-25 02:41 - 12874240 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-02-17 17:51 - 2014-01-24 03:18 - 01212352 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
2015-02-17 17:51 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\windows\system32\msieftp.dll
2015-02-17 17:51 - 2012-08-22 18:16 - 00712048 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys
2015-02-17 17:51 - 2012-07-04 20:45 - 00033280 _____ (Microsoft Corporation) C:\windows\system32\Drivers\RNDISMP.sys
2015-02-17 17:38 - 2012-08-21 21:12 - 00245760 _____ (Microsoft Corporation) C:\windows\system32\OxpsConverter.exe
2015-02-17 17:38 - 2011-03-11 06:33 - 01699328 _____ (Microsoft Corporation) C:\windows\system32\esent.dll
2015-02-17 17:37 - 2011-03-11 06:39 - 00143744 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvstor.sys
2015-02-17 17:37 - 2011-03-11 06:39 - 00117120 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvraid.sys
2015-02-17 17:37 - 2011-03-11 06:38 - 00332160 _____ (Intel Corporation) C:\windows\system32\Drivers\iaStorV.sys
2015-02-17 17:37 - 2011-03-11 06:38 - 00080256 _____ (Advanced Micro Devices) C:\windows\system32\Drivers\amdsata.sys
2015-02-17 17:37 - 2011-03-11 06:38 - 00022400 _____ (Advanced Micro Devices) C:\windows\system32\Drivers\amdxata.sys
2015-02-17 17:37 - 2011-03-11 06:31 - 00074240 _____ (Microsoft Corporation) C:\windows\system32\fsutil.exe
2015-02-17 17:37 - 2011-03-11 05:01 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBSTOR.SYS
2015-02-17 17:32 - 2014-11-11 02:32 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2015-02-17 17:29 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll
2015-02-17 17:29 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\credui.dll
2015-02-17 17:27 - 2015-01-09 03:48 - 00635904 _____ (Microsoft Corporation) C:\windows\system32\perftrack.dll
2015-02-17 17:27 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\wdi.dll
2015-02-17 17:27 - 2015-01-09 03:48 - 00027136 _____ (Microsoft Corporation) C:\windows\system32\powertracker.dll
2015-02-17 17:27 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-02-17 17:27 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\windows\system32\WsmSvc.dll
2015-02-17 17:27 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\WSManMigrationPlugin.dll
2015-02-17 17:27 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\windows\system32\WsmWmiPl.dll
2015-02-17 17:27 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\windows\system32\WsmAuto.dll
2015-02-17 17:27 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\windows\system32\WSManHTTPConfig.exe
2015-02-17 17:27 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2015-02-17 16:59 - 2015-02-18 14:54 - 00001049 _____ () C:\Users\PePur\Desktop\Continue Live Installation.lnk
2015-02-17 16:38 - 2015-02-18 13:51 - 00000000 ____D () C:\Users\PePur\AppData\Roaming\CDE6A2FD-1424191138-DE11-9904-002622DE56CC
2015-02-17 16:34 - 2015-02-17 16:34 - 00043560 _____ () C:\windows\system32\Drivers\webTinstMK.sys
2015-02-17 16:34 - 2015-02-17 16:34 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_webTinstMK_01009.Wdf
2015-02-17 16:23 - 2015-02-17 16:23 - 00000000 ____D () C:\Program Files\RelayStasis
2015-02-17 16:15 - 2015-01-15 08:46 - 00136640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-17 16:15 - 2015-01-15 08:46 - 00067520 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-02-17 16:15 - 2015-01-15 08:43 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-02-17 16:15 - 2015-01-15 08:43 - 00015872 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-02-17 16:15 - 2015-01-15 08:42 - 01061376 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-17 16:15 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-02-17 16:15 - 2015-01-15 08:42 - 00022528 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-02-17 16:15 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-02-17 16:15 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-17 16:15 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-02-17 16:15 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-17 16:15 - 2015-01-15 05:21 - 00369968 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-17 16:14 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\windows\system32\ntkrnlpa.exe
2015-02-17 16:14 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-17 16:09 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-02-17 16:09 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-02-17 16:09 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-17 16:09 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-02-17 16:09 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-02-17 16:09 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-02-17 16:09 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-02-17 16:07 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-17 16:07 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-02-17 16:07 - 2015-01-12 03:21 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-02-17 16:07 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-02-17 16:07 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-02-17 16:07 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-02-17 16:07 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-02-17 16:07 - 2015-01-12 02:55 - 00620032 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-02-17 16:07 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-02-17 16:07 - 2015-01-12 02:55 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-02-17 16:07 - 2015-01-12 02:48 - 00667648 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-02-17 16:07 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-17 16:07 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-02-17 16:07 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-02-17 16:07 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-17 16:07 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-17 16:07 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-17 16:07 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-17 16:07 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-17 16:07 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-17 16:06 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-17 16:06 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-17 16:06 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-17 16:06 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-17 16:06 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-02-17 16:06 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-17 16:06 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-17 16:06 - 2015-01-12 02:29 - 04300800 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-17 16:06 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-02-17 16:06 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-17 15:54 - 2015-02-17 15:54 - 00000000 ____D () C:\ProgramData\shoppilation
2015-02-17 15:51 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-17 15:51 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-17 15:31 - 2015-02-17 15:31 - 00000000 ____D () C:\Program Files\RelayEdit
2015-02-17 14:40 - 2015-02-17 14:40 - 00000000 ____D () C:\Program Files\predm
2015-01-19 21:53 - 2015-01-19 21:53 - 00000000 ____D () C:\Users\PePur\AppData\Local\b69ba874-d850-4c43-a0aa-753d45c167b4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-18 15:35 - 2009-11-02 09:59 - 01618320 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-18 15:34 - 2014-04-21 12:23 - 00000000 ____D () C:\Users\PePur
2015-02-18 15:33 - 2009-07-14 05:39 - 00100084 _____ () C:\windows\setupact.log
2015-02-18 15:27 - 2014-09-18 15:16 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-18 15:05 - 2009-12-08 07:51 - 01411900 _____ () C:\windows\WindowsUpdate.log
2015-02-18 14:46 - 2009-07-14 05:52 - 00000000 ____D () C:\windows\system32\FxsTmp
2015-02-18 14:44 - 2014-06-15 14:44 - 00000917 _____ () C:\windows\Tasks\EPSON XP-215 217 Series Update {4BB6AA71-CA22-45E3-B1C7-06D450552EB8}.job
2015-02-18 14:44 - 2014-06-15 14:44 - 00000731 _____ () C:\windows\Tasks\EPSON XP-215 217 Series Invitation {4BB6AA71-CA22-45E3-B1C7-06D450552EB8}.job
2015-02-18 14:17 - 2009-07-14 05:34 - 00009696 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-18 14:17 - 2009-07-14 05:34 - 00009696 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-18 14:13 - 2014-04-21 13:57 - 00000000 ____D () C:\Users\PePur\AppData\Roaming\Skype
2015-02-18 14:06 - 2009-11-02 10:18 - 01023188 _____ () C:\windows\PFRO.log
2015-02-18 14:06 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-18 14:06 - 2009-07-14 05:33 - 00340968 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-18 14:06 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\SchCache
2015-02-18 13:54 - 2015-01-01 12:53 - 00000000 ____D () C:\Program Files\WinZipper
2015-02-17 22:44 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
2015-02-17 21:46 - 2014-04-21 13:11 - 00000000 ____D () C:\Users\PePur\AppData\Local\Adobe
2015-02-17 21:26 - 2009-07-14 03:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-02-17 21:17 - 2009-11-02 17:34 - 00000000 ____D () C:\windows\system32\Drivers\de-DE
2015-02-17 21:17 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\tracing
2015-02-17 21:17 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\system32\de-DE
2015-02-17 20:56 - 2014-04-23 02:02 - 00000000 ____D () C:\windows\system32\MRT
2015-02-17 20:33 - 2014-04-23 02:02 - 113756392 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-02-17 19:55 - 2009-12-08 08:20 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-17 19:21 - 2014-04-21 13:19 - 00002155 _____ () C:\windows\epplauncher.mif
2015-02-17 19:20 - 2014-04-21 13:17 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-02-17 19:19 - 2014-04-21 13:17 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-02-17 16:33 - 2014-12-30 14:41 - 00000045 _____ () C:\user.js
2015-02-17 15:36 - 2014-04-21 12:55 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-02-17 15:36 - 2014-04-21 12:55 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2015-02-17 19:29 - 2015-02-18 13:52 - 0000065 _____ () C:\Users\PePur\AppData\Roaming\WB.CFG
2015-02-17 18:19 - 2015-02-17 18:18 - 0628496 _____ (CMI Limited) C:\Users\PePur\AppData\Local\nsjD34.tmp

Some content of TEMP:
====================
C:\Users\PePur\AppData\Local\Temp\09F72235-2CA4-05DA-96EA-DF35A1B37A10.exe
C:\Users\PePur\AppData\Local\Temp\2C4DAF96-674C-1A12-76A8-2C690C23CD8A.dll
C:\Users\PePur\AppData\Local\Temp\2C4DAF96-674C-1A12-76A8-2C690C23CD8A.exe
C:\Users\PePur\AppData\Local\Temp\nsnCEDB.exe
C:\Users\PePur\AppData\Local\Temp\sysad.exe
C:\Users\PePur\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\PePur\AppData\Local\Temp\System.Data.SQLiteb69ba874-d850-4c43-a0aa-753d45c167b4.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-07 13:53

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-18 16:31:05
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 WDC_WD1600BEVT-22ZCT0 rev.11.01A11 149,05GB
Running: Gmer-19357.exe; Driver: C:\Users\PePur\AppData\Local\Temp\uxddqpog.sys


---- Kernel code sections - GMER 2.1 ----

.text           ntoskrnl.exe!ZwRequestWaitReplyPort + 1499                                                       8208B995 1 Byte  [06]
.text           ntoskrnl.exe!KiDispatchInterrupt + 5A2                                                           820AB612 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
?               System32\drivers\oeytbvgt.sys                                                                    Das System kann den angegebenen Pfad nicht finden. !

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys

Device          \Driver\BTHUSB \Device\0000006d                                                                  bthport.sys
Device          \Driver\BTHUSB \Device\0000006f                                                                  bthport.sys

AttachedDevice  \FileSystem\fastfat \Fat                                                                         fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88                      
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076ba32b6                      
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076ba32b6 (not active ControlSet)  
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Superfetch@VirtualStoreSize                    1357

---- EOF - GMER 2.1 ----
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015
Ran by PePur at 2015-02-18 15:43:22
Running from E:\Trojaner
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
ANT Drivers Installer x86 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Bing-Desktop (HKLM\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.347.0 - Microsoft Corporation)
Broadcom 802.11 Wireless Driver (HKLM\...\{8991E763-21F5-4DEA-A938-5D9D77DCB488}) (Version: 5.30.18.0 - )
Elevated Installer (Version: 3.2.18.0 - Garmin Ltd or its subsidiaries) Hidden
Energy Management (HKLM\...\{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}) (Version: 4.3.1.5 - Lenovo)
Epson Event Manager (HKLM\...\{0F13C24A-FFE2-4CD0-8E0B-DC804E0A0E0B}) (Version: 3.10.0035 - Seiko Epson Corporation)
EPSON Scan (HKLM\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON XP-215 217 Series Printer Uninstall (HKLM\...\EPSON XP-215 217 Series) (Version:  - SEIKO EPSON Corporation)
Garmin Express (HKLM\...\{22939821-cd61-449c-8a03-cff0af03c156}) (Version: 3.2.18.0 - Garmin Ltd or its subsidiaries)
Garmin Express (Version: 3.2.18.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (Version: 3.2.18.0 - Garmin Ltd or its subsidiaries) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.100 - Broadcom Corporation)
Lenovo OneKey Recovery (HKLM\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.0723 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.0723 - CyberLink Corp.) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mobile Broadband drivers (HKLM\...\{AF1260EC-04B7-4679-9394-0C28223C152B}) (Version: 6.1.9.5 - Ericsson AB)
Mobile Broadband Manager (HKLM\...\{67673F8F-3896-4A3E-BC17-ED0CD3F83730}) (Version: 6.1.6.2 - Ericsson AB)
Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5942 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Software Updater (HKLM\...\{FA7EE274-7370-43B7-9A45-A39B17CCCDC5}) (Version: 4.3.3 - SEIKO EPSON CORPORATION)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.1.2.0 - Synaptics Incorporated)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
Tetris (HKLM\...\{95E0E6DC-C308-4C96-BEDB-68C75A32FAF8}_is1) (Version: 1.68 - Crystal Office Systems)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Windows Driver Package - Broadcom Bluetooth  (06/15/2009 6.2.0.9000) (HKLM\...\B7541EC5F72AA713F557569278EB6273725F5607) (Version: 06/15/2009 6.2.0.9000 - Broadcom)
Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405) (HKLM\...\A6A8668C0A13640CA28FE2A7D9654BE4AE478B13) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinZipper (HKLM\...\WinZipper) (Version: 1.5.77 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4185872467-282433234-656447781-1000_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}\localserver32 -> "C:\Users\PePur\AppData\Local\Taplika\Application\31.0.1650.23\delegate_execute.exe" No File

==================== Restore Points  =========================

27-12-2014 17:15:43 Windows Update
30-12-2014 22:32:34 Windows Update
14-01-2015 12:17:37 Windows Update
14-01-2015 12:42:24 Windows Update
14-01-2015 20:48:57 Windows Update
21-01-2015 18:42:40 Windows Update
17-02-2015 15:17:14 Windows Update
17-02-2015 18:01:41 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01F64A32-9CDA-4E67-B960-FD977E8C75C0} - System32\Tasks\RunTool => C:\Users\PePur\AppData\Local\b69ba874-d850-4c43-a0aa-753d45c167b4\sysad.exe [2015-02-17] ()
Task: {09377C56-D869-4BAB-AC55-53E621C1F35D} - System32\Tasks\APSnotifierPP2 => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {58100C0D-5889-41D9-9645-AE506053010D} - System32\Tasks\APSnotifierPP1 => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {5BE6C65C-54F6-4B4E-B016-9F86371ADD16} - \RocketTab No Task File <==== ATTENTION
Task: {6EA0559F-9CC2-4EE2-BAA3-D7B61BDC4DBA} - System32\Tasks\GarminUpdaterTask => C:\Program Files\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-08-27] ()
Task: {75D189F5-6977-4740-A3F2-003E016D24DF} - System32\Tasks\gtaUpt => C:\Program Files\shopperz\zaeed.bat
Task: {9BE5CC6B-F002-466A-90FE-727C4C72020A} - System32\Tasks\EPSON XP-215 217 Series Invitation {4BB6AA71-CA22-45E3-B1C7-06D450552EB8} => C:\windows\system32\spool\DRIVERS\W32X86\3\E_FTSLGE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {A538195E-946D-4EEB-AB83-D62C8C328059} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {B44D6460-3933-491E-9EF7-0C8B0CC05160} - \RocketTab Update Task No Task File <==== ATTENTION
Task: {B53849E5-7A61-4367-9A39-86E9820AAD0F} - System32\Tasks\EPSON XP-215 217 Series Update {4BB6AA71-CA22-45E3-B1C7-06D450552EB8} => C:\windows\system32\spool\DRIVERS\W32X86\3\E_FTSLGE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {CEC50DAA-2A99-45AE-A89C-6815FA76C39C} - System32\Tasks\APSnotifierPP3 => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {E802EDF6-AEC3-4B07-B291-4C70EED7E5ED} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-17] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\APSnotifierPP1.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP2.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP3.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\EPSON XP-215 217 Series Invitation {4BB6AA71-CA22-45E3-B1C7-06D450552EB8}.job => C:\windows\system32\spool\DRIVERS\W32X86\3\E_FTSLGE.EXE
Task: C:\windows\Tasks\EPSON XP-215 217 Series Update {4BB6AA71-CA22-45E3-B1C7-06D450552EB8}.job => C:\windows\system32\spool\DRIVERS\W32X86\3\E_FTSLGE.EXE

==================== Loaded Modules (whitelisted) ==============

2015-01-01 12:53 - 2014-12-31 05:34 - 00612528 _____ () C:\Program Files\WinZipper\sqlite3.dll
2009-08-11 17:10 - 2009-08-11 17:10 - 00132384 _____ () C:\Program Files\Lenovo\Bluetooth Software\btkeyind.dll
2015-02-17 15:31 - 2015-02-17 15:32 - 01648640 _____ () c:\Program Files\RelayEdit\RelayEdit.dll
2015-02-17 16:40 - 2015-02-17 16:40 - 00128000 _____ () C:\Users\PePur\AppData\Roaming\CDE6A2FD-1424191138-DE11-9904-002622DE56CC\JOSrv.exe
2009-09-24 11:54 - 2009-09-24 11:54 - 00430080 ____R () C:\Program Files\Mobile Broadband Drivers\WMCore\mini_WMCore.exe
2009-03-25 22:08 - 2009-03-25 22:08 - 00058880 ____R () C:\Program Files\Mobile Broadband Drivers\WMCore\MBMDebug.dll
2015-02-17 23:27 - 2015-02-17 23:27 - 00192000 _____ () C:\Users\PePur\AppData\Roaming\CDE6A2FD-1424191138-DE11-9904-002622DE56CC\nsh910.tmp
2009-12-08 08:15 - 2008-12-20 04:20 - 00063304 _____ () C:\Program Files\Lenovo\Energy Management\kbdhook.dll
2009-12-08 08:15 - 2008-12-20 04:20 - 00051016 _____ () C:\Program Files\Lenovo\Energy Management\HookLib.dll
2015-02-18 15:32 - 2015-02-18 15:02 - 00050477 _____ () E:\Trojaner\Defogger.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4185872467-282433234-656447781-1000\Control Panel\Desktop\\Wallpaper -> %windir%\web\wallpaper\windows\img0.jpg
DNS Servers: 8.8.8.8 - 212.37.37.50

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-4185872467-282433234-656447781-500 - Administrator - Disabled)
Gast (S-1-5-21-4185872467-282433234-656447781-501 - Limited - Disabled)
PePur (S-1-5-21-4185872467-282433234-656447781-1000 - Administrator - Enabled) => C:\Users\PePur

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/18/2015 01:54:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm nse75D6.tmp, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 116c

Startzeit: 01d04af512b3af4f

Endzeit: 327

Anwendungspfad: C:\Users\PePur\AppData\Local\Temp\nse75D6.tmp

Berichts-ID:

Error: (02/17/2015 09:55:05 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbam.exe, Version 1.0.1.711 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1458

Startzeit: 01d04af352c27b26

Endzeit: 10608

Anwendungspfad: C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe

Berichts-ID: 1f3ac59c-b6e7-11e4-9065-0c6076ba32b6

Error: (02/17/2015 06:02:09 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary MpKsled20df0a.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (01/22/2015 09:02:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17496, Zeitstempel: 0x546fddcc
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000c3873
ID des fehlerhaften Prozesses: 0x1388
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (01/22/2015 09:00:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17496, Zeitstempel: 0x546fddcc
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x00052c26
ID des fehlerhaften Prozesses: 0x1638
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (01/22/2015 08:59:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 11.0.9600.17496, Zeitstempel: 0x546fddcc
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc00000fd
Fehleroffset: 0x00052c26
ID des fehlerhaften Prozesses: 0x1638
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (01/19/2015 00:46:55 PM) (Source: Microsoft Office 12) (EventID: 2000) (User: )
Description: Accepted Safe Mode action : Microsoft Office Outlook.

Error: (01/15/2015 00:27:34 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm OUTLOOK.EXE, Version 12.0.6691.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 13d4

Startzeit: 01d030b51826255b

Endzeit: 1390

Anwendungspfad: C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE

Berichts-ID: 59321dab-9ca9-11e4-af18-0c6076ba32b6

Error: (01/15/2015 00:19:41 PM) (Source: Microsoft Office 12) (EventID: 2000) (User: )
Description: Accepted Safe Mode action : Microsoft Office Outlook.

Error: (01/14/2015 00:23:39 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17514 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 658

Startzeit: 01d02fe984a13a3d

Endzeit: 1184

Anwendungspfad: C:\windows\Explorer.EXE

Berichts-ID: b4970a7a-9bdf-11e4-9014-0c6076ba32b6


System errors:
=============
Error: (02/18/2015 02:26:50 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureCommand" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/18/2015 02:17:23 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (02/18/2015 02:11:54 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Audiosrv erreicht.

Error: (02/18/2015 02:10:08 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (02/18/2015 02:08:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (02/18/2015 02:08:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Garmin Core Update Service erreicht.

Error: (02/18/2015 02:07:54 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst RelayStasis erreicht.

Error: (02/18/2015 02:02:55 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (02/18/2015 05:41:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Garmin Core Update Service erreicht.

Error: (02/17/2015 09:48:16 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureCommand" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5


Microsoft Office Sessions:
=========================
Error: (12/30/2014 10:37:50 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6712.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2063 seconds with 240 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Atom(TM) CPU N270 @ 1.60GHz
Percentage of memory in use: 69%
Total physical RAM: 1013.95 MB
Available physical RAM: 308.3 MB
Total Pagefile: 2242.95 MB
Available Pagefile: 1071.81 MB
Total Virtual: 2047.88 MB
Available Virtual: 1906.62 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:103.85 GB) (Free:66.42 GB) NTFS
Drive d: (Lenovo) (Fixed) (Total:30.25 GB) (Free:30.12 GB) NTFS
Drive e: (1GB) (Removable) (Total:0.97 GB) (Free:0.39 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 6F90267D)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=103.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=30.2 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 996 MB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=995 MB) - (Type=06)

==================== End Of Log ============================