Regelmäßige Bluescreens und der Verdacht durch Rougekiller auf einen IRP Hook Rootkit

Gammelfisch · 28.03.2015, 19:53

Guten Tag zusammen,

nun seit einiger Zeit plagen mich unerwüschte Bluescreens woraufhin mein System ohne ersichtlcihen Grund abstürtzt.
Hatte auch einiges auf eigener Faust probiertm leider vergebens. Beispielsweise durch Spyhunter, Rougekiller, antilogger oder meinem AVG Antivirus.
Eine Auswertung mit GMER ist bei mir nicht möglich, da ich auf keine Zugriffsrechte im windows/system32/config/system bekomme.
Und seit kurzem sind auch die Ereignisprotokolle die man unter Sytemsteuerung/Verwaltung/Ereignisprotokoll einsehen kann auch verschwunden.

Bedanke mich schon mal im Vorraus sollte sich meiner Einer annehmen

schrauber · 28.03.2015, 20:01

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Gammelfisch · 29.03.2015, 10:00

Danke für die schnelle Rückmeldung.

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by X(administrator) on VENICE on 29-03-2015 08:34:39
Running from C:\Users\x\Downloads\New Loads
Loaded Profiles: X & Login & Guest (Available profiles:x & Login & Guest)
Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: Englisch (USA)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Rosetta Stone Ltd.) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
(Zemana Ltd.) C:\Program Files (x86)\AntiLogger\AntiLogger.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2011-11-17] (FNet Co., Ltd.)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1493288 2011-09-20] (Nero AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AntiLogger] => C:\Program Files (x86)\AntiLogger\AntiLogger.exe [14268328 2014-11-06] (Zemana Ltd.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-2798733552-1552239651-28545706-1006 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <====== ATTENTION
HKU\S-1-5-21-2798733552-1552239651-28545706-1006 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <====== ATTENTION
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Run: [Xvid] => C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [3108480 2012-10-23] (DT Soft Ltd)
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\MountPoints2: {24edd907-c5e2-11e2-9f54-002522df2e49} - H:\setup.exe
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\MountPoints2: {27c791c0-c7b3-11e2-b5cc-806e6f6e6963} - F:\setup.exe
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2798733552-1552239651-28545706-1000.bak\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2798733552-1552239651-28545706-1000.bak\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-2798733552-1552239651-28545706-1006\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2798733552-1552239651-28545706-1006\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-2798733552-1552239651-28545706-1006\...\MountPoints2: {27c791c0-c7b3-11e2-b5cc-806e6f6e6963} - F:\setup.exe
SSODL-x32: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} -  No File
GroupPolicyUsers\S-1-5-21-2798733552-1552239651-28545706-1006\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/de-de/?pc=U270&ocid=U270DHP
HKU\S-1-5-21-2798733552-1552239651-28545706-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2798733552-1552239651-28545706-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2798733552-1552239651-28545706-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2798733552-1552239651-28545706-1000 -> {5F0F0327-80EE-4263-8733-C92B7DCE6461} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=926458&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2798733552-1552239651-28545706-1000 -> {C0E80575-5F2E-4a99-9BF4-6540E02AEE59} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5480255188&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-10-18] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-10-18] (Oracle Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-09] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-09] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\3.2.0\ViProtocol.dll [2014-08-29] (AVG Secure Search)
Hosts: 127.0.0.1 activate.adobe.com
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Homepage: google.de
FF Keyword.URL: https://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=926458&p=
FF NetworkProxy: "backup.ftp", "62.81.176.0"
FF NetworkProxy: "backup.ftp_port", 1265
FF NetworkProxy: "backup.socks", "62.81.176.0"
FF NetworkProxy: "backup.socks_port", 1265
FF NetworkProxy: "backup.ssl", "62.81.176.0"
FF NetworkProxy: "backup.ssl_port", 1265
FF NetworkProxy: "ftp", "88.23.164.170"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "88.23.164.170"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "88.23.164.170"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-10-18] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2012-09-20] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\3.2.0\\npsitesafety.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-09] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2013-10-17] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2011-09-23] (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-12-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2012-09-20] (Adobe Systems)
FF Plugin HKU\S-1-5-21-2798733552-1552239651-28545706-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Die Siedler 7\Data\Base\_Dbg\Bin\Release\orbit\npuplaypc.dll No File
FF user.js: detected! => C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\user.js [2014-05-21]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2013-10-17] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\Ask.xml [2013-09-08]
FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\avg-secure-search.xml [2014-10-07]
FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\google-images.xml [2014-09-29]
FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\google-maps.xml [2014-09-29]
FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\s-amazon-de.xml [2012-01-20]
FF SearchPlugin: C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\skipity-search.xml [2012-03-08]
FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\yahoo_ff.xml [2015-03-28]
FF SearchPlugin: C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\searchplugins\zonealarm.xml [2014-05-21]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml [2013-09-08]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2014-10-06]
FF Extension: Bitdefender QuickScan - C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2015-03-28]
FF Extension: MEGA - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\firefox@mega.co.nz.xpi [2014-11-28]
FF Extension: Screengrab  (fix version) - C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\{02450914-cdd9-410f-b1da-db004e18c671}.xpi [2014-12-10]
FF Extension: NoScript - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-10-30]
FF Extension: Video DownloadHelper - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-14]
FF HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\X\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\extensions\cliqz@cliqz.com
FF Extension: No Name - C:\Users\Feisal\AppData\Roaming\Mozilla\Firefox\Profiles\baat342e.default\extensions\avg@toolbar [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgfws; C:\Program Files (x86)\AVG\AVG2014\avgfws.exe [1417160 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-11-17] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2011-11-17] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910640 2015-03-04] (Electronic Arts)
S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2011-11-17] (Creative Labs) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X]
S3 OpenVPNService; "C:\Program Files (x86)\OkayFreedom\bin\openvpnserv.exe" [X]
S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AntiLog32; C:\Windows\system32\drivers\AntiLog64.sys [49752 2014-11-08] (Zemana Ltd.)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-10-20] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-29] (AVG Technologies)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-05-28] (DT Soft Ltd)
S3 flashusb; C:\Windows\System32\DRIVERS\flashusb.sys [19968 2012-02-27] (Danish Wireless Design A/S)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2011-11-17] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2011-11-17] (FNet Co., Ltd.)
S3 MEMSWEEP2; C:\Windows\system32\E95B.tmp [6144 2009-06-18] (Sophos Plc) [File not signed]
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-05-28] (Duplex Secure Ltd.)
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [204568 2013-08-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 tun3326; C:\Windows\System32\DRIVERS\tun3326.sys [32368 2013-03-22] (The OpenVPN Project)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)
U3 aaqrdla0; C:\Windows\System32\Drivers\aaqrdla0.sys [0 ] (Asmedia Technology) <==== ATTENTION (zero size file/folder)
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]
S0 iaStor; system32\DRIVERS\iaStor.sys [X]
S3 keycrypt; system32\DRIVERS\KeyCrypt64.sys [X]
S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]
S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]
S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-28 21:04 - 2015-03-29 08:34 - 00000000 ____D () C:\FRST
2015-03-28 20:43 - 2015-03-28 20:44 - 00007473 _____ () C:\Users\X\Desktop\whocrashed.txt
2015-03-28 20:43 - 2015-03-28 20:43 - 00012310 _____ () C:\Users\X\Desktop\WhoCrashedOutput.htm
2015-03-28 19:56 - 2015-03-28 19:56 - 00002432 _____ () C:\Users\X\Desktop\RKreport_SCN_03282015_183221.log
2015-03-28 17:29 - 2015-03-28 17:29 - 00002807 _____ () C:\Users\X\Unigine_Heaven_Benchmark_4.0_20150328_1629.html
2015-03-28 17:23 - 2015-03-28 17:29 - 00000000 ____D () C:\Users\X\Heaven
2015-03-28 17:22 - 2015-03-28 17:22 - 01065984 _____ () C:\Users\X\AppData\Local\file__0.localstorage
2015-03-28 17:21 - 2015-03-28 17:21 - 00002117 _____ () C:\Users\Public\Desktop\Heaven Benchmark 4.0.lnk
2015-03-28 17:21 - 2015-03-28 17:21 - 00000000 ____D () C:\Program Files (x86)\Unigine
2015-03-28 16:48 - 2015-03-28 16:48 - 00000000 _____ () C:\Users\X\Desktop\Neues Textdokument.txt
2015-03-28 13:43 - 2015-03-29 08:22 - 00000000 ____D () C:\Program Files\WinToUSB
2015-03-28 13:07 - 2015-03-28 13:07 - 00000000 ____D () C:\Users\X\Downloads\Win7U_64
2015-03-28 11:28 - 2015-03-28 14:58 - 00000440 __RSH () C:\ProgramData\ntuser.pol
2015-03-28 10:29 - 2015-03-29 08:24 - 00037624 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2015-03-28 10:29 - 2015-03-28 10:42 - 00000000 ____D () C:\ProgramData\RogueKiller
2015-03-28 10:12 - 2015-03-28 10:12 - 00000000 ____D () C:\Users\X\AppData\Roaming\Chip Digital GmbH
2015-03-28 09:19 - 2015-03-28 11:27 - 00000000 ____D () C:\Users\X\AppData\Roaming\QuickScan
2015-03-28 08:37 - 2015-03-28 15:23 - 00253628 _____ () C:\Windows\PFRO.log
2015-03-27 22:40 - 2015-03-27 22:40 - 00000000 ____D () C:\Users\X\AppData\Roaming\com.ohnoo.Tormentum
2015-03-27 20:50 - 2015-03-27 22:41 - 00000000 ____D () C:\Program Files (x86)\Tormentum
2015-03-27 20:50 - 2015-03-27 20:50 - 00001097 _____ () C:\Users\Public\Desktop\Tormentum.lnk
2015-03-27 10:13 - 2015-03-27 10:13 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-27 09:12 - 2015-03-29 08:18 - 00000784 _____ () C:\Windows\setupact.log
2015-03-27 09:12 - 2015-03-27 09:12 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-26 20:53 - 2015-03-26 20:53 - 00000000 ____D () C:\Program Files\Intel
2015-03-26 20:26 - 2015-03-01 11:41 - 00287344 _____ () C:\Windows\Minidump\030115-45068-01.dmp
2015-03-26 20:26 - 2015-03-01 08:56 - 00287348 _____ () C:\Windows\Minidump\030115-90714-01.dmp
2015-03-26 19:55 - 2015-03-28 20:41 - 00000000 ____D () C:\Program Files\WhoCrashed
2015-03-26 19:55 - 2015-03-26 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed
2015-03-26 17:10 - 2015-03-26 17:10 - 00000000 ____D () C:\Windows\SysWOW64\Atheros_L1e
2015-03-25 00:35 - 2015-03-25 01:03 - 00003169 _____ () C:\Users\X\Desktop\Opfer.txt
2015-03-24 20:15 - 2015-03-24 20:15 - 00000000 ____D () C:\Users\X\AppData\Roaming\Schein
2015-03-24 20:15 - 2015-03-24 20:15 - 00000000 ____D () C:\Users\X\AppData\Local\Schein
2015-03-24 16:41 - 2010-08-24 18:55 - 00076912 _____ (Atheros Communications, Inc.) C:\Windows\system32\Drivers\L1C62x64.sys
2015-03-23 22:42 - 2015-03-23 22:43 - 00000000 ____D () C:\Users\X\Downloads\Johan.und.der.Federkoenig.2014.German.DL.PAL.DVDR-ETM
2015-03-23 15:42 - 2015-03-23 15:42 - 00000000 ____D () C:\Users\X\Downloads\Der.Lorax.2012.German.DTS.DL.1080p.BluRay.x264-LeetHD
2015-03-23 09:37 - 2015-03-23 09:37 - 00000000 _____ () C:\Users\X\Desktop\Neues Textdokument (3).txt
2015-03-22 09:11 - 2015-03-22 09:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-21 11:16 - 2015-03-28 20:39 - 00000000 ____D () C:\Users\X\Desktop\Minidump
2015-03-11 08:32 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 08:32 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 08:32 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 08:32 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 08:32 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 08:32 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 08:32 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 08:32 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 08:32 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 08:32 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 08:32 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 08:32 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 08:32 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 08:32 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 08:32 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 08:32 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 08:32 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 08:32 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 08:32 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 08:32 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 08:32 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 08:32 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 08:32 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 08:32 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 08:32 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 08:32 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 08:32 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 08:32 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 08:32 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 08:32 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 08:32 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 08:32 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 08:32 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 08:32 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 08:31 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 08:31 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 08:31 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 08:31 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 08:31 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 08:31 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 08:31 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 08:31 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 08:31 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 08:31 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 08:31 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 08:31 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 08:31 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 08:30 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 08:30 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 08:30 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 08:30 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 08:30 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 08:30 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 08:30 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 08:30 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 08:30 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 08:30 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 08:30 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 08:30 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 08:30 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 08:30 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 08:30 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 08:30 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 08:30 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 08:30 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 08:30 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 08:30 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 08:30 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 08:30 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 08:30 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 08:30 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 08:30 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 08:30 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 08:30 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 08:29 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 08:29 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-11 08:28 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 08:28 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-11 08:28 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-11 08:28 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 08:28 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-11 08:28 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-11 08:28 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-11 08:28 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-11 08:28 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-11 08:28 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-11 08:28 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 08:28 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-11 08:28 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-11 08:28 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 08:28 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-11 08:28 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 08:28 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-11 08:28 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 08:28 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-11 08:28 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 08:28 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 08:28 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-11 08:28 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-11 08:28 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-11 08:28 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-11 08:28 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-11 08:28 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 08:28 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-11 08:28 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-11 08:28 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-11 08:28 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-11 08:28 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-11 08:28 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-11 08:28 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 08:28 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-11 08:28 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-11 08:28 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-11 08:28 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-11 08:28 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-11 08:28 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-11 08:28 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 08:28 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-11 08:28 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-11 08:28 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 08:28 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 08:28 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-11 08:28 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-11 08:28 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-11 08:28 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 08:28 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-11 08:28 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-11 08:28 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-11 08:28 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 08:28 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-11 08:28 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-11 08:28 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-11 08:28 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-11 08:28 - 2015-01-31 05:48 - 01113088 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-11 08:28 - 2015-01-31 05:05 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-11 08:28 - 2015-01-31 05:04 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-03-11 08:17 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 08:17 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-07 23:05 - 2015-03-07 23:05 - 00000000 ____D () C:\Users\X\Documents\DyingLight
2015-03-05 21:05 - 2015-03-05 21:05 - 00000000 ____D () C:\Users\X\AppData\Local\Neckbolt
2015-03-05 21:04 - 2015-03-05 21:05 - 00000000 ____D () C:\Program Files (x86)\Belladonna
2015-03-05 08:47 - 2015-03-05 08:47 - 00001083 _____ () C:\Users\Public\Desktop\Apotheon.lnk
2015-03-05 08:46 - 2015-03-05 22:24 - 00000000 ____D () C:\Program Files (x86)\Apotheon
2015-03-04 17:19 - 2015-03-04 17:22 - 00000000 ____D () C:\Users\X
\Documents\FIFA 15
2015-02-28 09:04 - 2015-02-28 09:18 - 00000000 ____D () C:\Users\X\Downloads\Dragonball.Xenoverse

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-29 08:34 - 2015-01-28 08:45 - 00000000 ____D () C:\Users\X\Downloads\New Loads
2015-03-29 08:34 - 2011-11-17 21:07 - 01718833 _____ () C:\Windows\WindowsUpdate.log
2015-03-29 08:28 - 2014-08-20 09:48 - 00000000 ____D () C:\Users\X\AppData\Local\Adobe
2015-03-29 08:28 - 2011-11-17 23:26 - 00000000 ____D () C:\ProgramData\MFAData
2015-03-29 08:23 - 2011-11-18 00:39 - 00700978 _____ () C:\Windows\system32\perfh007.dat
2015-03-29 08:23 - 2011-11-18 00:39 - 00150390 _____ () C:\Windows\system32\perfc007.dat
2015-03-29 08:23 - 2009-07-14 07:13 - 01629772 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-29 08:18 - 2012-01-04 14:35 - 00000266 _____ () C:\Windows\Tasks\AutoKMS.job
2015-03-29 08:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-28 23:17 - 2011-11-23 19:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-28 20:42 - 2013-02-14 20:51 - 00000000 ____D () C:\Windows\Minidump
2015-03-28 17:36 - 2012-08-16 23:13 - 00000000 ____D () C:\Program Files (x86)\HIS iTurbo
2015-03-28 17:29 - 2011-11-17 21:06 - 00000000 ____D () C:\Users\X
2015-03-28 15:12 - 2014-03-23 01:45 - 00000000 ____D () C:\Users\X\AppData\Local\JDownloader 2.0
2015-03-28 11:28 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2015-03-28 10:53 - 2012-01-11 20:43 - 00000000 __SHD () C:\Users\X\AppData\Local\{75518ca9-6410-5815-b974-a366e7a074cb}
2015-03-28 09:09 - 2013-07-04 18:58 - 01600624 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-03-28 08:52 - 2011-11-18 04:00 - 00287348 ____N () C:\Windows\Minidump\032815-49109-01.dmp
2015-03-27 23:45 - 2009-07-14 06:45 - 00031296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-27 23:45 - 2009-07-14 06:45 - 00031296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-27 20:49 - 2013-05-28 18:15 - 00000000 ____D () C:\Users\X\AppData\Roaming\DAEMON Tools Pro
2015-03-27 20:17 - 2013-01-26 01:56 - 00000000 ____D () C:\Users\X\AppData\Roaming\vlc
2015-03-27 18:11 - 2013-01-31 18:26 - 00000000 ____D () C:\Users\X\AppData\Roaming\dvdcss
2015-03-27 13:48 - 2011-11-17 23:21 - 00000000 ____D () C:\Users\X\AppData\Roaming\Winamp
2015-03-27 13:05 - 2013-05-04 19:51 - 00000121 _____ () C:\Users\Public\LMDebug.log
2015-03-27 11:09 - 2014-05-26 09:23 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-27 10:13 - 2014-05-26 09:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-27 10:13 - 2014-05-26 09:23 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-03-27 09:33 - 2011-11-18 04:00 - 00287348 ____N () C:\Windows\Minidump\032715-56519-01.dmp
2015-03-26 20:53 - 2014-03-19 18:12 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-26 19:26 - 2013-09-08 09:36 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2015-03-26 19:26 - 2012-05-23 19:40 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-26 19:25 - 2011-10-10 18:18 - 00000000 ____D () C:\Windows\Panther
2015-03-26 17:10 - 2011-11-17 21:39 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-25 10:54 - 2015-02-17 00:28 - 00000000 ____D () C:\Users\X\AppData\Roaming\Music Editor Free
2015-03-24 10:08 - 2012-10-18 09:20 - 00000000 ____D () C:\Fraps
2015-03-24 10:08 - 2011-11-26 23:40 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2015-03-24 09:55 - 2011-11-17 21:59 - 00118176 _____ () C:\Users\Feisal\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-24 09:54 - 2009-07-14 06:45 - 05006584 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-24 09:50 - 2015-01-30 20:32 - 00000009 _____ () C:\Windows\ULEAD32.INI
2015-03-24 08:38 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-23 08:44 - 2011-11-23 19:52 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-23 08:44 - 2011-11-23 19:52 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-23 08:44 - 2011-11-18 01:04 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-23 08:35 - 2012-09-04 19:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-21 11:37 - 2014-05-24 01:10 - 00000000 ____D () C:\Program Files\CyberGhost 5
2015-03-19 22:46 - 2015-02-05 09:05 - 00000000 ____D () C:\Users\X.Venice
2015-03-19 22:46 - 2014-11-12 14:45 - 00000000 ____D () C:\Users\Guest
2015-03-19 22:46 - 2014-06-05 12:26 - 00000000 ____D () C:\Users\Login
2015-03-17 20:17 - 2014-07-01 11:28 - 00000000 ____D () C:\Users\X\Documents\Scan
2015-03-17 16:12 - 2013-05-06 13:51 - 00000000 ____D () C:\ProgramData\boost_interprocess
2015-03-12 15:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-12 08:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-12 08:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-12 00:31 - 2013-05-28 13:44 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-03-12 00:31 - 2011-11-17 22:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-12 00:19 - 2009-07-14 04:34 - 00000565 _____ () C:\Windows\win.ini
2015-03-12 00:17 - 2013-07-16 15:32 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-12 00:12 - 2014-06-20 01:00 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-06 16:55 - 2013-05-06 13:51 - 00000000 ____D () C:\Users\X\Documents\Scannen
2015-03-05 10:49 - 2013-07-27 01:45 - 00000000 ____D () C:\Users\X\Documents\Benutzerdefinierte Office-Vorlagen
2015-03-04 17:18 - 2011-12-24 00:33 - 00000000 ____D () C:\ProgramData\Origin
2015-03-04 17:18 - 2011-12-24 00:33 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-02-27 08:56 - 2009-07-14 07:08 - 00032608 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

==================== Files in the root of some directories =======

2014-06-10 15:45 - 2015-01-12 09:49 - 0000132 _____ () C:\Users\X\AppData\Roaming\Adobe BMP Format CS5 Prefs
2012-07-14 22:00 - 2015-02-16 09:59 - 0000132 _____ () C:\Users\X\AppData\Roaming\Adobe PNG Format CS5 Prefs
2012-10-18 09:11 - 2012-10-28 12:37 - 0018910 _____ () C:\Users\X\AppData\Roaming\fefe
2012-10-28 13:54 - 2012-10-28 13:54 - 1169224 _____ (Microsoft Corporation) C:\Users\X\AppData\Roaming\T8WPAKPUI7.exe
2015-03-28 17:22 - 2015-03-28 17:22 - 1065984 _____ () C:\Users\X\AppData\Local\file__0.localstorage
2014-05-29 14:14 - 2014-05-29 14:14 - 0001223 _____ () C:\Users\X\AppData\Local\recently-used.xbel
2013-07-08 08:27 - 2014-05-28 09:02 - 0007605 _____ () C:\Users\X\AppData\Local\resmon.resmoncfg
2013-01-20 18:18 - 2014-02-19 12:43 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt
2012-04-19 00:15 - 2012-04-19 00:15 - 2097590 _____ () C:\ProgramData\SPL19E6.tmp
2012-04-19 00:40 - 2012-04-19 00:40 - 4736838 _____ () C:\ProgramData\SPL57F3.tmp

Some content of TEMP:
====================
C:\Users\X\AppData\Local\Temp\7z920.exe
C:\Users\X\AppData\Local\Temp\CH.dll
C:\Users\X\AppData\Local\Temp\Copy.dll
C:\Users\X\AppData\Local\Temp\dllnt_dump.dll
C:\Users\X\AppData\Local\Temp\drm_dialogs.dll
C:\Users\X\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\X\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\X\AppData\Local\Temp\HitmanPro.exe
C:\Users\X\AppData\Local\Temp\ICReinstall_FreeYouTubeToMP3Converter.exe
C:\Users\X\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\X\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\X\AppData\Local\Temp\Kickstarter.exe
C:\Users\X\AppData\Local\Temp\PidGenX.dll
C:\Users\X\AppData\Local\Temp\proxy_vole8216552691486519215.dll
C:\Users\X\AppData\Local\Temp\raptr_stub.exe
C:\Users\X\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\X\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\X\AppData\Local\Temp\tmd_34011087.exe
C:\Users\X\AppData\Local\Temp\tmd_34017743.exe
C:\Users\X\AppData\Local\Temp\tmd_34018483.exe
C:\Users\X\AppData\Local\Temp\tmp55CC.exe
C:\Users\X\AppData\Local\Temp\tmp6C7E.exe
C:\Users\X\AppData\Local\Temp\tmp983E.exe
C:\Users\X\AppData\Local\Temp\tmpBAE.exe
C:\Users\X\AppData\Local\Temp\uninst1.exe
C:\Users\X\AppData\Local\Temp\Uninstall.exe
C:\Users\X\AppData\Local\Temp\WatermarkImageSetup.3.4.2.6.exe
C:\Users\X\AppData\Local\Temp\ZAL4894.exe
C:\Users\X\AppData\Local\Temp\ZALD6B7.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-25 14:58

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by X at 2015-03-29 08:35:34
Running from C:\Users\X\Downloads\New Loads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG Internet Security 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG Internet Security 2014 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Photoshop CS5.1 (HKLM-x32\...\{9158FF30-78D7-40EF-B83E-451AC5334640}) (Version: 12.1 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AntiLogger (HKLM-x32\...\AntiLogger) (Version:  - Zemana Ltd.)
AntiLogger (x32 Version: 1.9.3.527 - Zemana Ltd.) Hidden
Apotheon (HKLM-x32\...\Apotheon_is1) (Version:  - Alientrap)
Application Profiles (x32 Version: 2.0.4331.36041 - Ihr Firmenname) Hidden
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.1.000 - Asmedia Technology)
ASRock App Charger v1.0.4 (HKLM\...\ASRock App Charger_is1) (Version:  - ASRock Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.35 - Atheros Communications Inc.)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4311 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 3.2.0.18 - AVG Technologies)
AVS Audio Editor 7.3 (HKLM-x32\...\AVS Audio Editor_is1) (Version: 7.3.1.493 - Online Media Technologies Ltd.)
Belladonna (HKLM-x32\...\Belladonna_is1) (Version:  - Neckbolt)
CCleaner (HKLM\...\CCleaner) (Version: 4.02 - Piriform)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
DAEMON Tools Pro (HKLM-x32\...\DAEMON Tools Pro) (Version: 5.2.0.0348 - DT Soft Ltd)
Dark Souls Prepare to Die Edition (HKLM-x32\...\GFWL_{4E4D0FA1-F880-4CCB-999A-501000008200}) (Version: 1.0.0000.130 - NAMCO BANDAI Games Europe S.A.S.)
Dark Souls Prepare to Die Edition (x32 Version: 1.0.0000.130 - NAMCO BANDAI Games Europe S.A.S.) Hidden
Dark Souls Prepare to Die Edition (x32 Version: 1.0.0002.130 - NAMCO BANDAI Games Europe S.A.S.) Hidden
Dark Souls: Prepare to Die Edition (HKLM-x32\...\Steam App 211420) (Version:  - )
DARK SOULS™ II (HKLM-x32\...\Steam App 236430) (Version:  - FromSoftware, Inc)
EVEREST Ultimate Edition v5.50 (HKLM-x32\...\EVEREST Ultimate Edition_is1) (Version: 5.50 - Lavalys, Inc.)
FLV Player 2.0 (build 25) (HKLM-x32\...\FLV Player) (Version: 2.0 (build 25) - Martijn de Visser)
Free Studio version 6.5.0.219 (HKLM-x32\...\Free Studio_is1) (Version: 6.5.0.219 - DVDVideoSoft Ltd.)
Free Video Editor version 1.4.0.530 (HKLM-x32\...\Free Video Editor_is1) (Version: 1.4.0.530 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.35.514 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.35.514 - DVDVideoSoft Ltd.)
Heaven Benchmark version 4.0 (HKLM-x32\...\Unigine Heaven Benchmark (Basic Edition)_is1) (Version: 4.0 - Unigine Corp.)
High-Definition Video Playback (x32 Version: 11.1.10400.2.65 - Nero AG) Hidden
iDRS(tm) OCR Software by I.R.I.S (HKLM-x32\...\iDRS(tm) OCR Software by I.R.I.S) (Version: 1.00.17 (17.04.2012) - Samsung Electronics Co., Ltd.)
IESnap (HKLM-x32\...\IESnap) (Version: 1.2 - Tonec Inc)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.21.1134 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2761 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.26 - Intel(R) Corporation) Hidden
Java 7 Update 71 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417071FF}) (Version: 7.0.710 - Oracle)
Java 7 Update 72 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217072FF}) (Version: 7.0.720 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
JavaFX 2.1.0 (HKLM-x32\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
K-Lite Codec Pack 8.9.2 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 8.9.2 - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MediaInfo 0.7.61 (HKLM\...\MediaInfo) (Version: 0.7.61 - MediaArea.net)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{86CE1746-9EFF-3C9C-8755-81EA8903AC34}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Minecraft1.6.2 (HKLM-x32\...\Minecraft1.6.2) (Version:  - )
MKVToolNix 6.2.0 (HKLM-x32\...\MKVToolNix) (Version: 6.2.0 - Moritz Bunkus)
MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MPC-HC 1.6.5.6366 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.6.5.6366 - MPC-HC Team)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Music Editor Free v9.9.4 (HKLM-x32\...\Music Editor Free_is1) (Version:  - Copyright(C) 2005-2014 MEFMedia, Inc.)
MyFreeCodec (HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\MyFreeCodec) (Version:  - )
Nero 11 (HKLM-x32\...\{8A7ABBD4-A617-4AE8-9C6D-1510DE46EC35}) (Version: 11.0.15500 - Nero AG)
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.10000.1.0 - Nero AG)
Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PC Inspector smart recovery (HKLM-x32\...\{C9A87D86-FDFD-418B-BF96-EF09320973B3}) (Version: 4.50 - )
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 5.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.1 - pdfforge)
Pinnacle VideoSpin (HKLM-x32\...\{FEB15887-0932-4D2D-BB85-6AC03FBF1AA8}) (Version: 2.0.0.669 - Pinnacle Systems)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6482 - Realtek Semiconductor Corp.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.0.9.5 - Rockstar Games)
roomeon 3D-Planer (HKLM-x32\...\{E94EF5B3-85D9-40C0-97DB-FA2BB29814E5}) (Version: 1.6.2 - roomeon GmbH)
Rosetta Stone Ltd Services (HKLM-x32\...\{7BB2EF8A-5376-4BAE-96D0-38BE49501F40}) (Version: 3.2.17 - Rosetta Stone Ltd.)
Rosetta Stone TOTALe (HKLM-x32\...\com.rosettastone.rosettastonetotale) (Version: 4.1.15.1 - Rosetta Stone, Ltd)
Rosetta Stone TOTALe (x32 Version: 4.1.1 - Rosetta Stone, Ltd) Hidden
Rosetta Stone TOTALe (x32 Version: 4.1.15.1 - Rosetta Stone, Ltd) Hidden
Samsung CLX-3300 Series (HKLM-x32\...\Samsung CLX-3300 Series) (Version: 1.01 (01.05.2012) - Samsung Electronics Co., Ltd.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.02.09 (25.04.2012) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.02.45.02(01.05.2012) - Samsung Electronics Co., Ltd.)
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00.04 - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.00.18.04 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.6.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Sound Blaster X-Fi MB (HKLM-x32\...\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}) (Version: 1.0 - Creative Technology Limited)
SpyHunter (HKLM-x32\...\{AF549236-6258-4AC6-A043-5B5B89C6EB61}) (Version: 4.17.6.4336 - Enigma Software Group USA, LLC)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab CYRI (HKLM-x32\...\{E5F05232-96B6-4552-A480-785A60A94B21}) (Version: 5.0.6.0 - Husdawg, LLC)
System Requirements Lab for Intel (HKLM-x32\...\{04C4B49D-45D9-4A28-9ED1-B45CBD99B8C7}) (Version: 4.5.24.0 - Husdawg, LLC)
The LEGO Movie - Videogame (HKLM-x32\...\The LEGO Movie - Videogame_is1) (Version:  - Warner Bros. Interactive Entertainment)
Tormentum (HKLM-x32\...\Tormentum_is1) (Version:  - OhNoo Studio)
TSR Watermark Image software version 3.4.2.4 - Free version (HKLM-x32\...\TSR Watermark Image - Free version_is1) (Version: 3.4.2.4 - TSR Software)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Ulead GIF Animator 5 Test (HKLM-x32\...\{8AF3E926-ED59-11D4-A44B-0000E86D2305}) (Version:  - )
Uplay (HKLM-x32\...\Uplay) (Version: 3.0 - Ubisoft)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
vLite (HKLM-x32\...\vLite_is1) (Version: 1.2 - Dino Nuhagic (nuhi))
welcome (x32 Version: 11.0.21500.0.4 - Nero AG) Hidden
WhoCrashed 5.03 (HKLM\...\WhoCrashed_is1) (Version:  - Resplendence Software Projects Sp.)
Winamp (HKLM-x32\...\Winamp) (Version: 5.622  - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows-Treiberpaket - Intel (iaStor) hdc  (10/17/2011 10.8.0.1003) (HKLM\...\4D0C3CE71E3E56C85A44C7C0A8F3984B6762569C) (Version: 10/17/2011 10.8.0.1003 - Intel)
Windows-Treiberpaket - Intel (iaStor) SCSIAdapter  (10/17/2011 10.8.0.1003) (HKLM\...\80EA9D0E08E92108D79178D7CF6DB4D92102558C) (Version: 10/17/2011 10.8.0.1003 - Intel)
WinImage (HKU\S-1-5-21-2798733552-1552239651-28545706-1000\...\WinImage) (Version:  - )
WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
XFastUsb (HKLM-x32\...\XFastUsb) (Version:  - )
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2012-04-05 22:34 - 00000854 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {059C920E-263E-4EC2-84C4-86ACDAC8D959} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {56E90639-B562-4B24-BD62-9C587501652D} - System32\Tasks\AdobeAAMUpdater-1.0-Venice-Feisal => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {69821FDB-C0FD-470F-A4E9-8E751F640A81} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe
Task: {70356A41-FD6B-4528-B393-F03568AAEF48} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {7D92BE01-8048-4A5B-8F73-B12D3325C311} - System32\Tasks\{8B0EAC92-DF8A-4C66-BC96-5123535C5C02} => pcalua.exe -a "C:\Users\Feisal\Downloads\New Loads\VirtualDub-1.9.11\auxsetup.exe" -d "C:\Users\X\Downloads\New Loads\VirtualDub-1.9.11"
Task: {84639AF0-09DD-4064-BFBA-4A8A496B8D8B} - System32\Tasks\{EA8886CC-27AD-4372-B7A1-463AD66958DB} => pcalua.exe -a "C:\Users\X\AppData\Roaming\Windows Net Data\uninstaller.exe"
Task: {95908D64-3F0C-4F96-B208-38A6A25BA015} - System32\Tasks\{880FBB0B-7EF4-4C59-88FA-6960214508D9} => pcalua.exe -a E:\INSTALL.EXE -d E:\
Task: {A54B09A3-246B-4662-B830-F0148323B519} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {A644007E-12AB-4B06-A320-EC5CD724F26E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {B0B33AE0-C1BF-47A1-8D21-1B8431329765} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {CCBA5D8F-F589-4268-A426-B5ED56BDEA4C} - System32\Tasks\{1E611397-371F-451C-A1FF-B5BBC90F9C05} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -c -runfromtemp -l0x0007 -removeonly
Task: {FD13169D-9459-4764-8624-0C44CC73C73D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-23] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe

==================== Loaded Modules (whitelisted) ==============

2012-01-09 11:47 - 2012-01-09 11:47 - 00034304 _____ () C:\Windows\System32\sst7clm.dll
2011-11-17 23:06 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2011-11-17 21:45 - 2009-02-06 19:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2011-11-17 21:45 - 2009-04-20 12:55 - 00148480 _____ () C:\Windows\SysWOW64\APOMngr.DLL

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:2AD33723
AlternateDataStreams: C:\ProgramData\TEMP:3086B95F

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2798733552-1552239651-28545706-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Feisal\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-2798733552-1552239651-28545706-1000.bak\Control Panel\Desktop\\Wallpaper -> C:\Users\Feisal.Venice\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-2798733552-1552239651-28545706-1006\Control Panel\Desktop\\Wallpaper -> C:\Users\Login\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-2798733552-1552239651-28545706-501\Control Panel\Desktop\\Wallpaper -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: RunDLLEntry => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry

==================== Accounts: =============================

Administrator (S-1-5-21-2798733552-1552239651-28545706-500 - Administrator - Disabled)
Feisal (S-1-5-21-2798733552-1552239651-28545706-1000 - Administrator - Enabled) => C:\Users\Feisal
Guest (S-1-5-21-2798733552-1552239651-28545706-501 - Limited - Enabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-2798733552-1552239651-28545706-1004 - Limited - Enabled)
Login (S-1-5-21-2798733552-1552239651-28545706-1006 - Administrator - Enabled) => C:\Users\Login

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/29/2015 08:18:35 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (03/28/2015 10:21:30 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (03/28/2015 08:18:30 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (03/28/2015 07:25:14 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (03/28/2015 06:04:57 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (03/28/2015 05:33:57 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (03/28/2015 05:07:19 PM) (Source: Software Protection Platform Service) (EventID: 8193) (User: )
Description: Fehler beim Lizenzaktivierungsplaner (sppuinotify.dll). Fehlercode:
0x80070005

Error: (03/28/2015 04:03:58 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.

Error: (03/28/2015 01:51:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm rufus-2.1.exe, Version 2.1.649.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 14cc

Startzeit: 01d0694d40b37289

Endzeit: 5498

Anwendungspfad: C:\Users\Feisal\Downloads\New Loads\rufus-2.1.exe

Berichts-ID: c5a766f2-d540-11e4-aaef-002522df2e49

Error: (03/28/2015 01:47:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm WinToUSB.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: bec

Startzeit: 01d0694c63421bd8

Endzeit: 1487

Anwendungspfad: C:\Program Files\WinToUSB\bin\WinToUSB.exe

Berichts-ID: 2708389d-d540-11e4-aaef-002522df2e49


System errors:
=============
Error: (03/29/2015 08:34:40 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution Protocol" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/29/2015 08:34:40 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peer Networking Grouping" ist vom Dienst "Peer Name Resolution Protocol" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/29/2015 08:34:40 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution Protocol" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/29/2015 08:34:40 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peer Networking Grouping" ist vom Dienst "Peer Name Resolution Protocol" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/29/2015 08:34:40 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/29/2015 08:34:40 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/29/2015 08:34:29 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Peer Name Resolution Protocol" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/29/2015 08:34:29 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Peer Networking Grouping" ist vom Dienst "Peer Name Resolution Protocol" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/29/2015 08:34:29 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801

Error: (03/29/2015 08:18:52 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
iaStor
StarOpen


Microsoft Office Sessions:
=========================
Error: (03/29/2015 08:18:35 AM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (03/28/2015 10:21:30 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (03/28/2015 08:18:30 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (03/28/2015 07:25:14 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (03/28/2015 06:04:57 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (03/28/2015 05:33:57 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (03/28/2015 05:07:19 PM) (Source: Software Protection Platform Service) (EventID: 8193) (User: )
Description: 0x80070005

Error: (03/28/2015 04:03:58 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: 0x800700050x00000000

Error: (03/28/2015 01:51:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: rufus-2.1.exe2.1.649.014cc01d0694d40b372895498C:\Users\Feisal\Downloads\New Loads\rufus-2.1.exec5a766f2-d540-11e4-aaef-002522df2e49

Error: (03/28/2015 01:47:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: WinToUSB.exe0.0.0.0bec01d0694c63421bd81487C:\Program Files\WinToUSB\bin\WinToUSB.exe2708389d-d540-11e4-aaef-002522df2e49


CodeIntegrity Errors:
===================================
  Date: 2014-05-26 21:24:07.060
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\E95B.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-26 21:24:06.980
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\E95B.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-26 21:22:45.750
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\E95B.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-05-26 21:22:45.670
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\E95B.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz
Percentage of memory in use: 51%
Total physical RAM: 8157.18 MB
Available physical RAM: 3996.73 MB
Total Pagefile: 16312.54 MB
Available Pagefile: 12633.06 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1953.12 GB) (Free:1312.33 GB) NTFS
Drive f: (IRM_SP1_X64FRE_MUI_DVD) (CDROM) (Total:5.91 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 2794.5 GB) (Disk ID: E9ADB2BC)

Partition: GPT Partition Type.

==================== End Of Log ============================

Code:

ATTFilter

--------------------------------------------------------------------------------
Welcome to WhoCrashed (HOME EDITION) v 5.03
--------------------------------------------------------------------------------

This program checks for drivers which have been crashing your computer. If your computer has displayed a blue screen of death, suddenly rebooted or shut down then this program will help you find the root cause and possibly a solution.

Whenever a computer suddenly reboots without displaying any notice or blue screen of death, the first thing that is often thought about is a hardware failure. In reality, on Windows most crashes are caused by malfunctioning device drivers and kernel modules. In case of a kernel error, many computers do not show a blue screen unless they are configured for this. Instead these systems suddenly reboot without any notice.

This program will analyze your crash dumps with the single click of a button. It will tell you what drivers are likely to be responsible for crashing your computer. It will report a conclusion which offers suggestions on how to proceed in any situation while the analysis report will display internet links which will help you further troubleshoot any detected problems.

To obtain technical support visit www.resplendence.com/support

Click here to check if you have the latest version or if an update is available.

Just click the Analyze button for a comprehensible report ...

--------------------------------------------------------------------------------
Home Edition Notice
--------------------------------------------------------------------------------

This version of WhoCrashed is free for use at home only. If you would like to use this software at work or in a commercial environment you should get the professional edition of WhoCrashed which allows you to perform more thorough and detailed analysis. It also offers a range of additional features such as remote analysis on remote directories and remote computers on the network.

Click here for more information on the professional edition.
Click here to buy the the professional edition of WhoCrashed.

--------------------------------------------------------------------------------
System Information (local)
--------------------------------------------------------------------------------

computer name: VENICE
windows version: Windows 7 Service Pack 1, 6.1, build: 7601
windows dir: C:\Windows
Hardware: ASRock, H61DE/S3
CPU: GenuineIntel Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz Intel586, level: 6
4 logical processors, active mask: 15
RAM: 8553418752 total

--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Sat 28.03.2015 06:50:56 GMT your computer crashed
crash dump file: C:\Windows\Minidump\032815-49109-01.dmp
This was probably caused by the following module: wdf01000.sys (Wdf01000+0x52A46)
Bugcheck code: 0x10D (0x5, 0x0, 0x1202, 0xFFFFFA800A6A9E40)
Error: WDF_VIOLATION
file path: C:\Windows\system32\drivers\wdf01000.sys
product: Betriebssystem Microsoft® Windows®
company: Microsoft Corporation
description: Kernelmodustreiber-Frameworklaufzeit
Bug check description: This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

On Fri 27.03.2015 07:31:55 GMT your computer crashed
crash dump file: C:\Windows\Minidump\032715-56519-01.dmp
This was probably caused by the following module: wdf01000.sys (Wdf01000+0x52A46)
Bugcheck code: 0x10D (0x5, 0x0, 0x1202, 0xFFFFFA80089F4E40)
Error: WDF_VIOLATION
file path: C:\Windows\system32\drivers\wdf01000.sys
product: Betriebssystem Microsoft® Windows®
company: Microsoft Corporation
description: Kernelmodustreiber-Frameworklaufzeit
Bug check description: This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

On Sun 01.03.2015 09:40:11 GMT your computer crashed
crash dump file: C:\Windows\Minidump\030115-45068-01.dmp
This was probably caused by the following module: wdf01000.sys (Wdf01000+0x52A46)
Bugcheck code: 0x10D (0x5, 0x0, 0x1202, 0xFFFFFA8009CAB4F0)
Error: WDF_VIOLATION
file path: C:\Windows\system32\drivers\wdf01000.sys
product: Betriebssystem Microsoft® Windows®
company: Microsoft Corporation
description: Kernelmodustreiber-Frameworklaufzeit
Bug check description: This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

On Sun 01.03.2015 06:54:42 GMT your computer crashed
crash dump file: C:\Windows\Minidump\030115-90714-01.dmp
This was probably caused by the following module: atikmdag.sys (atikmdag+0x7C5CD)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000094, 0xFFFFF8800F6B05CD, 0xFFFFF88004682B38, 0xFFFFF88004682390)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\drivers\atikmdag.sys
product: ATI Radeon Family
company: Advanced Micro Devices, Inc.
description: ATI Radeon Kernel Mode Driver
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: atikmdag.sys (ATI Radeon Kernel Mode Driver, Advanced Micro Devices, Inc.).
Google query: Advanced Micro Devices, Inc. SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M

Code:

ATTFilter

RogueKiller V10.5.7.0 (x64) [Mar 22 2015] by Adlice Software
Mail : hxxp://www.adlice.com/contact/
Feedback : hxxp://forum.adlice.com
Website : hxxp://www.adlice.com/softwares/roguekiller/
Blog : hxxp://www.adlice.com

Betriebssystem : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
gestarted in : normaler Modus
User : X[Administrator]
Started from : C:\Users\X\Downloads\New Loads\RogueKillerX64.exe
Modus : Scannen -- Datum : 03/28/2015  18:32:21

¤¤¤ Prozesse : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Aufgaben : 0 ¤¤¤

¤¤¤ Dateien : 0 ¤¤¤

¤¤¤ Host Dateien : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 activate.adobe.com

¤¤¤ Antirootkit : 7 (Driver: geladen) ¤¤¤
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_CREATE[0] : Unknown @ 0x66b82c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_CLOSE[2] : Unknown @ 0x66b82c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_DEVICE_CONTROL[14] : Unknown @ 0x66b82c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_INTERNAL_DEVICE_CONTROL[15] : Unknown @ 0x66b82c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_POWER[22] : Unknown @ 0x66b82c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_SYSTEM_CONTROL[23] : Unknown @ 0x66b82c0
[IRP:Addr(Hook.IRP)] \SystemRoot\system32\drivers\PCIIDEX.SYS - IRP_MJ_PNP[27] : Unknown @ 0x66b82c0

¤¤¤ Web Browser : 0 ¤¤¤

¤¤¤ MBR Überprüfung : ¤¤¤
+++++ PhysicalDrive0: ST3000DM001-9YN166 ATA Device +++++
--- User ---
[MBR] 0a571fe39c8647b756a9bccc8a21297d
[BSP] acdf01760ccf8cac6a54cc6a1f632d7e : Windows Vista/7/8 MBR Code
Partition table:
0 -  | Offset (sectors): 34 | Size: 127 MB
1 - [MAN-MOUNT] Basic data partition | Offset (sectors): 262144 | Size: 100 MB
2 - [MAN-MOUNT] Basic data partition | Offset (sectors): 466944 | Size: 2000000 MB
3 - Basic data partition | Offset (sectors): 4096466944 | Size: 861359 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_03282015_095337.log - RKreport_DEL_03282015_164237.log - RKreport_SCN_03282015_094039.log - RKreport_SCN_03282015_095026.log
RKreport_SCN_03282015_095538.log - RKreport_SCN_03282015_164109.log - RKreport_SCN_03282015_164854.log - RKreport_SCN_03282015_181709.log

Und noch die Analyse mit Malwarebytes Anti-Rootkit

Code:

ATTFilter

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.09.1.1004

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17691

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8553418752, free: 5681635328

Downloaded database version: v2015.03.29.03
Downloaded database version: v2015.03.26.01
Downloaded database version: v2015.03.09.01
=======================================
Initializing...
------------ Kernel report ------------
     03/29/2015 10:41:27
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\sptd.sys
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\vsflt67.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\compbatt.sys
\SystemRoot\system32\drivers\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\DRIVERS\asahci64.sys
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\NBVol.sys
\SystemRoot\system32\DRIVERS\NBVolUp.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\system32\DRIVERS\fltsrv.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\avgrkx64.sys
\SystemRoot\system32\DRIVERS\avgloga.sys
\SystemRoot\system32\DRIVERS\avgmfx64.sys
\SystemRoot\system32\DRIVERS\avgidsha.sys
\SystemRoot\system32\DRIVERS\dtsoftbus01.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\Windows\system32\drivers\avgtpx64.sys
\SystemRoot\System32\drivers\FNETURPX.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\avgfwd6a.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\avgtdia.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\avgldx64.sys
\SystemRoot\system32\DRIVERS\avgidsdrivera.sys
\SystemRoot\system32\DRIVERS\avgdiska.sys
\SystemRoot\system32\DRIVERS\AsrAppCharger.sys
\??\C:\Windows\system32\drivers\AntiLog64.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\atikmpag.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\System32\Drivers\aaqrdla0.SYS
\SystemRoot\System32\Drivers\SCSIPORT.SYS
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\AtihdW76.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_asahci64.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\??\C:\Windows\system32\Drivers\SSPORT.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\udfs.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
IRP handler 0 of \Driver\atapi points to an unknown module
Unhooking enabled.

Scan started
Database versions:
  main:    v2015.03.29.03
  rootkit: v2015.03.26.01

<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8007784060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP4T0L0-8\
Lower Device Object: 0xfffffa8007142680
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8007784060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007784b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007784060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800764f880, DeviceName: Unknown, DriverName: \Driver\vidsflt67\
DevicePointer: 0xfffffa8007142680, DeviceName: \Device\Ide\IdeDeviceP4T0L0-8\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a0169ddd10, 0xfffffa8007784060, 0xfffffa800913f500
Lower DeviceData: 0xfffff8a008b959f0, 0xfffffa8007142680, 0xfffffa8007e0d690
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: E9ADB2BC

GPT Protective MBR Partition information:

    Partition 0 type is EFI-GPT (0xee)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1  Numsec = 4294967295

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

GPT Partition information:

    GPT Header Signature 4546492050415254
    GPT Header Revision 65536 Size 92 CRC 1487306886
    GPT Header CurrentLba = 1 BackupLba 5860533167
    GPT Header FirstUsableLba 34  LastUsableLba 5860533134
    GPT Header Guid 2af4f230-d613-40f0-a022-5c4f50925fe9
    GPT Header Contains 128 partition entries starting at LBA 2
    GPT Header Partition entry size = 128

    Backup GPT header Signature 1397a9c3f04bfdae
    Backup GPT header Revision 3771946998 Size 1921024553 CRC 3547653478
    Backup GPT header CurrentLba = 11274629701026367397 BackupLba 263249483720580154
    Backup GPT header FirstUsableLba 13516675636487801936  LastUsableLba 137890212000288224
    Backup GPT header Guid a8a31040-ab07-1e8a-ce2-f785303b1444
    Backup GPT header Contains 4055782333 partition entries starting at LBA 15279813677734147328
    Backup GPT header Partition entry size = 1438712596

    GPT header and Backup GPT header have conflicting data

    Backup GPT partition header signature doesn't match "EFI PART" magic

    Partition 0 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b
    Partition ID 25c4782a-48e3-4c2e-3d39-d9127e8a66de
    FirstLBA 34  Last LBA 262143
    Attributes 0
    Partition Name                                     

    GPT Partition 0 is bootable
    Partition 1 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID dd189044-7a42-4533-68b9-d2364d407b8c
    FirstLBA 262144  Last LBA 466943
    Attributes 0
    Partition Name                 Basic data partition

    Partition 2 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID a2d2ab9-2be0-41fa-658c-baba92f79e41
    FirstLBA 466944  Last LBA 4096466943
    Attributes 0
    Partition Name                 Basic data partition

    Partition 3 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID 67e216de-2dce-478e-a093-368d5edb38d3
    FirstLBA 4096466944  Last LBA 5860530175
    Attributes 0
    Partition Name                 Basic data partition

Disk Size: 3000592982016 bytes
Sector size: 512 bytes

Done!
File "c:\programdata\avg2014\chjw\4296f67e96f671b1.dat:6ba3c12c-da74-4b7f-8d77-b2245fcc7137" is sparse (flags = 32768)
File "c:\programdata\avg2014\chjw\4296f67e96f671b1.dat:a0790f1e-a77e-4625-8671-c20330dc985c" is sparse (flags = 32768)
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished

schrauber · 29.03.2015, 16:29

Hi,

was ist alles externes am Rechner angeklemmt?

Gammelfisch · 29.03.2015, 17:01

Zitat:

Zitat von schrauber

Hi,

was ist alles externes am Rechner angeklemmt?

Eine P2S Tastatur, Lautsprecher, eine USB- Maus und manchmal mein Ps3- Controller via USB am Rechner angeschlossen.
Sonst eigentlich nichts, manchmal vielleicht ein USB-Stick.

Habe nebenher mal einige Tutorials durchgeblättert und bin auf aswMBR gestoßen, jedoch bekomme ich dauernd diesen Absturz,

Code:

ATTFilter

Problemsignatur:
  Problemereignisname:	APPCRASH
  Anwendungsname:	aswMBR.exe
  Anwendungsversion:	1.0.1.2252
  Anwendungszeitstempel:	5465ba64
  Fehlermodulname:	ntdll.dll
  Fehlermodulversion:	6.1.7601.18247
  Fehlermodulzeitstempel:	521ea8e7
  Ausnahmecode:	c0000005
  Ausnahmeoffset:	0002e41b
  Betriebsystemversion:	6.1.7601.2.1.0.256.4
  Gebietsschema-ID:	1031
  Zusatzinformation 1:	0a9e
  Zusatzinformation 2:	0a9e372d3b4ad19135b953a78882e789
  Zusatzinformation 3:	0a9e
  Zusatzinformation 4:	0a9e372d3b4ad19135b953a78882e789

Code:

ATTFilter

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2015-03-29 17:44:00
-----------------------------
17:44:00.453    OS Version: Windows x64 6.1.7601 Service Pack 1
17:44:00.453    Number of processors: 4 586 0x2A07
17:44:00.453    ComputerName: VENICE  UserName: Feisal
17:44:02.185    Initialize success
17:44:02.216    VM: initialized successfully
17:44:02.216    VM: Intel CPU supported 
17:44:05.775    VM: disk I/O atapi.sys
17:44:27.256    AVAST engine defs: 15032900
17:46:57.328    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-8
17:46:57.344    Disk 0 Vendor: ST3000DM001-9YN166 CC4B Size: 2861588MB BusType: 11
17:46:57.344    Disk 0 MBR read successfully
17:46:57.344    Disk 0 MBR scan
17:46:57.359    Disk 0 Windows 7 default MBR code
17:46:57.359    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
17:46:57.422    Disk 0 scanning C:\Windows\system32\drivers
17:47:11.212    Service scanning
17:47:26.953    Modules scanning
17:47:26.953    Disk 0 trace - called modules:
17:47:27.514    ntoskrnl.exe CLASSPNP.SYS disk.sys vsflt67.sys >>UNKNOWN [0xfffffa80066b82c0]<<sptd.sys ataport.SYS PCIIDEX.SYS hal.dll asahci64.sys 
17:47:27.514    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007806060]
17:47:27.530    3 CLASSPNP.SYS[fffff88001af943f] -> nt!IofCallDriver -> [0xfffffa8007573b30]
17:47:27.530    5 vsflt67.sys[fffff880011e67cd] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-8[0xfffffa8007140680]
17:47:27.530    \Driver\atapi[0xfffffa8007084e70] -> IRP_MJ_CREATE -> 0xfffffa80066b82c0
17:47:29.261    AVAST engine scan C:\Windows
17:47:33.692    AVAST engine scan C:\Windows\system32

Bis hierher dann stürtzt das Pogramm ab.

Gruss Gammler

schrauber · 30.03.2015, 05:16

Klemm alles externe ab ausser Maus und Keyboard. Kommt der Bluescreen dann immer noch? Wenn ja:

Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

Gammelfisch · 30.03.2015, 08:41

Hi,
eigentlich bekomme ich diese Bluescreens solange das Internet.
Habe testweise mal das System Gestern ohne eine Netzwerkverbindungen benutzt und da bekam
ich keine Bluescreens nur eben das eine Mal als aswMBR benutzt hatte und die Netzwerkverbindungen aktiv war.
Gruß Gammel

schrauber · 30.03.2015, 17:18

Mach auf jeden Fall das Repair Tool

Gammelfisch · 30.03.2015, 21:40

Danke dir schrauber für die bereitwillige Hilfe.

Ich habe nach der Anleitung hier meine komplette Festplatte formatiert, neu aufgesetzt und im anschluss meine Passwörtrer geändert.

Ich könnte Hilfe gebrauchen um nachträglich meine Logfiles zu analysieren, müsste ich jetzt dieses Thema schließen und ein neues eröffnen?

Nebenher habe ich das hier von meinem Router kann ich dagegen etwas unternehmen?

Code:

ATTFilter

Mar/30/2015 15:54:33 	
Ip Spoofing from IP 10.175.145.81 to IP 54.195.243.69 dropped
Mar/30/2015 16:01:07 	Ip Spoofing from IP 10.175.145.81 to IP 173.194.65.188 dropped
Mar/30/2015 16:01:07 	Ip Spoofing from IP 10.175.145.81 to IP 54.195.243.69 dropped[1 times]
Mar/30/2015 16:35:48 	Ip Spoofing from IP 10.175.145.81 to IP 173.194.65.188 dropped[1 times]
Mar/30/2015 16:45:10 	Ip Spoofing from IP 10.175.145.81 to IP 54.195.243.69 dropped[1 times]

Zu dem ganzen habe ich jetzt ein Gastkonto eingerichtet, damit eben durchs surfen nicht die Möglichkeit besteht auf einfachem Wegen einen Rootkit einzufangen.

schrauber · 31.03.2015, 05:28

Da wird einfach nur die IP gespooft, nicht wild. Poste mal frische FRST Logs, ich schau gerne nochmal drüber.

Gammelfisch · 31.03.2015, 07:57

Danke, hier nochmal die Logs.
Anbei, könntest du freundlicherweise mir auch dabei Helfen einen Portscan zu analysieren?

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Seufus (administrator) on BRATROLLI on 31-03-2015 08:27:06
Running from C:\Users\Seufus\Desktop
Loaded Profiles: Seufus (Available profiles: Seufus & Blau & Gast)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
(AMD) C:\Windows\System32\atieclxx.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3723728 2015-03-25] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3033112 2015-03-30] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-03-07] (Oracle Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-03-25] (Raptr, Inc)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4216540600-1385818188-3882979393-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={B006D8D8-CF6E-4831-8A5C-55719C8BE82C}&mid=b57f61a7c8d547cda1dad16c643bc7ba-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=AVG&coid=avgtbavg&cmpid=0215pit&pr=fr&d=2015-03-30 13:26:20&v=4.1.0.411&pid=wtu&sg=&sap=hp
HKU\S-1-5-21-4216540600-1385818188-3882979393-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\S-1-5-21-4216540600-1385818188-3882979393-1001 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={B006D8D8-CF6E-4831-8A5C-55719C8BE82C}&mid=b57f61a7c8d547cda1dad16c643bc7ba-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=AVG&coid=avgtbavg&cmpid=0215pit&pr=fr&d=2015-03-30 13:26:20&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4216540600-1385818188-3882979393-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={B006D8D8-CF6E-4831-8A5C-55719C8BE82C}&mid=b57f61a7c8d547cda1dad16c643bc7ba-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=de&ds=AVG&coid=avgtbavg&cmpid=0215pit&pr=fr&d=2015-03-30 13:26:20&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
BHO: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-03-30] (AVG)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-30] (Oracle Corporation)
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-03-30] (AVG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-30] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Seufus\AppData\Roaming\Mozilla\Firefox\Profiles\wc58qiy3.default
FF Homepage: google.de
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.4.0\\npsitesafety.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-30] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-30] (Oracle Corporation)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgfws; C:\Program Files (x86)\AVG\AVG2015\avgfws.exe [1516968 2015-03-25] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3416016 2015-03-25] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-03-25] (AVG Technologies CZ, s.r.o.)
S4 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)
R2 vToolbarUpdater18.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe [1875480 2015-03-30] (AVG Secure Search)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-30] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-06-21] (Advanced Micro Devices)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\system32\DRIVERS\avgfwd6a.sys [58136 2014-12-03] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [281056 2015-03-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [341472 2015-02-03] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [133088 2015-02-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [289248 2015-03-19] (AVG Technologies CZ, s.r.o.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-31 08:27 - 2015-03-31 08:27 - 00010517 _____ () C:\Users\Seufus\Desktop\FRST.txt
2015-03-31 08:26 - 2015-03-31 08:27 - 00000000 ____D () C:\FRST
2015-03-31 08:25 - 2015-03-31 08:25 - 02095616 _____ (Farbar) C:\Users\Seufus\Desktop\FRST64.exe
2015-03-31 00:58 - 2015-03-31 00:58 - 00004383 _____ () C:\Users\Seufus\Downloads\sys_log.log
2015-03-31 00:45 - 2015-03-31 00:45 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2015-03-31 00:45 - 2015-03-31 00:45 - 00000000 ____D () C:\Program Files\Realtek
2015-03-31 00:40 - 2015-03-31 00:40 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-03-31 00:40 - 2015-03-31 00:40 - 00000000 ___SD () C:\Windows\system32\GWX
2015-03-31 00:40 - 2015-03-14 10:20 - 01385256 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-31 00:40 - 2015-03-14 10:13 - 01124352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-31 00:21 - 2015-03-31 00:21 - 00000000 ____D () C:\ProgramData\ATI
2015-03-31 00:16 - 2015-03-31 00:16 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\library_dir
2015-03-31 00:16 - 2015-03-31 00:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2015-03-31 00:15 - 2015-03-31 08:23 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Raptr
2015-03-31 00:15 - 2015-03-31 00:16 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-03-31 00:15 - 2015-03-31 00:15 - 00053736 _____ () C:\Windows\SysWOW64\CCCInstall_201503310015448800.log
2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\ProgramData\AMD
2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2015-03-31 00:15 - 2015-03-31 00:15 - 00000000 ____D () C:\Program Files (x86)\AMD
2015-03-31 00:14 - 2015-03-31 00:14 - 00059972 _____ () C:\Windows\SysWOW64\CCCInstall_201503310014271907.log
2015-03-31 00:06 - 2015-03-31 00:06 - 00000000 ____D () C:\Users\Seufus\Documents\Scan
2015-03-31 00:05 - 2015-03-31 00:05 - 00000000 ____D () C:\ProgramData\boost_interprocess
2015-03-30 23:54 - 2015-03-31 00:05 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Samsung
2015-03-30 23:54 - 2015-03-30 23:58 - 00000000 ____D () C:\ProgramData\Samsung
2015-03-30 23:54 - 2015-03-30 23:54 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung Printers
2015-03-30 23:54 - 2015-03-30 23:54 - 00000000 ____D () C:\Program Files\Common Files\Common Desktop Agent
2015-03-30 23:54 - 2015-03-30 23:54 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-03-30 23:45 - 2015-03-30 23:45 - 00001816 ____R () C:\Users\Seufus\Desktop\BitLocker-Wiederherstellungsschlüssel 68A02BD9-F3BE-40D3-90C1-5A956EE3534D.txt
2015-03-30 23:37 - 2015-03-30 23:37 - 00008704 ___SH () C:\Users\Blau\Desktop\Thumbs.db
2015-03-30 23:35 - 2015-03-30 23:35 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4216540600-1385818188-3882979393-1006
2015-03-30 23:35 - 2015-03-30 23:35 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-03-30 23:32 - 2015-03-30 23:32 - 00000000 ____D () C:\Users\Blau\Desktop\Neuer Ordner (4)
2015-03-30 23:32 - 2015-03-30 23:32 - 00000000 ____D () C:\Users\Blau\Desktop\Ethnic & Oriental Lounge Vol.1 (Relaxation Mystic Chill Out)
2015-03-30 23:32 - 2015-03-30 23:32 - 00000000 ____D () C:\Users\Blau\Desktop\Der kleine Pinz CD 1
2015-03-30 23:31 - 2015-03-30 23:31 - 00000000 ____D () C:\Users\Blau\Desktop\Joaquín Sabina
2015-03-30 23:31 - 2015-03-30 23:31 - 00000000 ____D () C:\Users\Blau\Desktop\jkhkj
2015-03-30 23:23 - 2015-03-30 23:23 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\Mozilla
2015-03-30 23:23 - 2015-03-30 23:23 - 00000000 ____D () C:\Users\Blau\AppData\Local\Mozilla
2015-03-30 23:22 - 2015-03-30 23:39 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\ClassicShell
2015-03-30 23:21 - 2015-03-30 23:22 - 00000000 ____D () C:\Users\Blau\AppData\Local\Packages
2015-03-30 23:21 - 2015-03-30 23:22 - 00000000 ____D () C:\Users\Blau\AppData\Local\AVG Web TuneUp
2015-03-30 23:21 - 2015-03-30 23:21 - 00001454 _____ () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-30 23:21 - 2015-03-30 23:21 - 00000020 ___SH () C:\Users\Blau\ntuser.ini
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Vorlagen
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Startmenü
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Netzwerkumgebung
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Lokale Einstellungen
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Eigene Dateien
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Druckumgebung
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Documents\Eigene Musik
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Documents\Eigene Bilder
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\AppData\Local\Verlauf
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\AppData\Local\Anwendungsdaten
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 _SHDL () C:\Users\Blau\Anwendungsdaten
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\AVG2015
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\ATI
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\Adobe
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Local\VirtualStore
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Local\Avg2015
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau\AppData\Local\ATI
2015-03-30 23:21 - 2015-03-30 23:21 - 00000000 ____D () C:\Users\Blau
2015-03-30 23:21 - 2015-03-10 00:19 - 00000000 ___RD () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-30 23:21 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-30 23:21 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-03-30 23:21 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-03-30 23:21 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-03-30 23:21 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Blau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-03-30 22:48 - 2015-03-30 22:48 - 00002710 _____ () C:\Users\Seufus\Desktop\sys_log.log
2015-03-30 22:25 - 2015-03-30 12:40 - 00000000 ____D () C:\Windows\Panther
2015-03-30 21:13 - 2015-03-30 22:13 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Winamp
2015-03-30 21:09 - 2015-03-30 21:11 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Winamp
2015-03-30 21:09 - 2015-03-30 21:10 - 00000000 ____D () C:\Program Files (x86)\Winamp
2015-03-30 21:09 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2015-03-30 21:09 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-03-30 17:06 - 2015-03-30 17:06 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Mozilla
2015-03-30 17:06 - 2015-03-30 17:06 - 00000000 ____D () C:\Users\Gast\AppData\Local\Mozilla
2015-03-30 17:05 - 2015-03-30 17:06 - 00000000 ____D () C:\Users\Seufus\Desktop\jkhkj
2015-03-30 17:05 - 2015-03-30 17:05 - 00000000 ____D () C:\Users\Seufus\Desktop\Neuer Ordner (4)
2015-03-30 17:05 - 2015-03-30 17:05 - 00000000 ____D () C:\Users\Seufus\Desktop\Joaquín Sabina
2015-03-30 17:05 - 2015-03-30 17:05 - 00000000 ____D () C:\Users\Seufus\Desktop\Ethnic & Oriental Lounge Vol.1 (Relaxation Mystic Chill Out)
2015-03-30 17:05 - 2015-03-30 17:05 - 00000000 ____D () C:\Users\Seufus\Desktop\Der kleine Pinz CD 1
2015-03-30 17:04 - 2015-03-30 22:40 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\ClassicShell
2015-03-30 17:03 - 2015-03-30 17:03 - 00001450 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-30 17:03 - 2015-03-30 17:03 - 00000020 ___SH () C:\Users\Gast\ntuser.ini
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Vorlagen
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Startmenü
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Netzwerkumgebung
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Lokale Einstellungen
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Eigene Dateien
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Druckumgebung
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Musik
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Documents\Eigene Bilder
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Verlauf
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\AppData\Local\Anwendungsdaten
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 _SHDL () C:\Users\Gast\Anwendungsdaten
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\AVG2015
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\ATI
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Adobe
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\VirtualStore
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\Packages
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\Avg2015
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\AVG Web TuneUp
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast\AppData\Local\ATI
2015-03-30 17:03 - 2015-03-30 17:03 - 00000000 ____D () C:\Users\Gast
2015-03-30 17:03 - 2015-03-10 00:19 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-30 17:03 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-30 17:03 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-03-30 17:03 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-03-30 17:03 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-03-30 17:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-03-30 16:34 - 2015-03-30 16:34 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-30 16:34 - 2015-03-30 16:34 - 00000000 ____D () C:\ProgramData\Sun
2015-03-30 16:34 - 2015-03-30 16:34 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-30 16:34 - 2015-03-30 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-03-30 16:34 - 2015-03-30 16:34 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-30 16:29 - 2015-03-30 16:29 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Mozilla
2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Mozilla
2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\ProgramData\Mozilla
2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-30 16:29 - 2015-03-30 16:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-30 16:18 - 2015-03-30 16:18 - 00000000 ____D () C:\Users\Gast\Desktop\Neuer Ordner (4)
2015-03-30 16:17 - 2015-03-30 16:17 - 00000000 ____D () C:\Users\Gast\Desktop\Joaquín Sabina
2015-03-30 16:13 - 2015-03-30 16:13 - 00000000 ____D () C:\Users\Gast\Desktop\jkhkj
2015-03-30 16:12 - 2015-03-30 16:12 - 00000000 ____D () C:\Users\Gast\Desktop\Ethnic & Oriental Lounge Vol.1 (Relaxation Mystic Chill Out)
2015-03-30 16:11 - 2015-03-30 16:11 - 00000000 ____D () C:\Users\Gast\Desktop\Der kleine Pinz CD 1
2015-03-30 16:09 - 2015-03-30 16:09 - 00040448 ___SH () C:\Users\Seufus\Desktop\Thumbs.db
2015-03-30 16:02 - 2015-03-30 16:02 - 00001933 _____ () C:\Users\Seufus\Desktop\aswMBR.txt
2015-03-30 16:02 - 2015-03-30 16:02 - 00000512 _____ () C:\Users\Seufus\Desktop\MBR.dat
2015-03-30 15:55 - 2015-03-30 15:55 - 05198336 _____ (AVAST Software) C:\Users\Seufus\Downloads\aswMBR.exe
2015-03-30 13:43 - 2015-03-30 13:43 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Intel
2015-03-30 13:43 - 2015-03-30 13:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver Update Utility
2015-03-30 13:43 - 2015-03-30 13:43 - 00000000 ____D () C:\Program Files (x86)\Intel Driver Update Utility
2015-03-30 13:39 - 2015-03-30 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavalys
2015-03-30 13:39 - 2015-03-30 13:39 - 00000000 ____D () C:\Program Files (x86)\Lavalys
2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\Users\Seufus\AppData\Local\AVG Web TuneUp
2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\ProgramData\AVG Web TuneUp
2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\ProgramData\AVG Security Toolbar
2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\Program Files\AVG Web TuneUp
2015-03-30 13:26 - 2015-03-30 13:26 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp
2015-03-30 13:19 - 2015-03-30 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ___HD () C:\$AVG
2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\TuneUp Software
2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\AVG2015
2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ____D () C:\ProgramData\AVG2015
2015-03-30 13:19 - 2015-03-30 13:19 - 00000000 ____D () C:\Program Files (x86)\AVG
2015-03-30 13:18 - 2015-03-30 13:19 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Avg2015
2015-03-30 13:17 - 2015-03-31 08:25 - 00000000 ____D () C:\ProgramData\MFAData
2015-03-30 13:17 - 2015-03-30 13:17 - 00000000 ____D () C:\Users\Seufus\AppData\Local\MFAData
2015-03-30 13:17 - 2015-03-30 13:17 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Avg2014
2015-03-30 13:10 - 2015-03-31 08:24 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\ClassicShell
2015-03-30 13:10 - 2015-03-30 13:10 - 00000000 ____D () C:\ProgramData\ClassicShell
2015-03-30 13:09 - 2015-03-30 13:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2015-03-30 13:09 - 2015-03-30 13:09 - 00000000 ____D () C:\Program Files\Classic Shell
2015-03-30 13:07 - 2015-03-30 13:07 - 00000000 __SHD () C:\Users\Seufus\AppData\Local\EmieUserList
2015-03-30 13:07 - 2015-03-30 13:07 - 00000000 __SHD () C:\Users\Seufus\AppData\Local\EmieSiteList
2015-03-30 13:07 - 2015-03-30 13:07 - 00000000 __SHD () C:\Users\Seufus\AppData\Local\EmieBrowserModeList
2015-03-30 13:07 - 2015-03-30 13:07 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Macromedia
2015-03-30 13:04 - 2015-03-31 00:53 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4216540600-1385818188-3882979393-1001
2015-03-30 12:59 - 2015-03-30 12:59 - 00001454 _____ () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-30 12:59 - 2015-03-30 12:59 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\ATI
2015-03-30 12:59 - 2015-03-30 12:59 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Adobe
2015-03-30 12:59 - 2015-03-30 12:59 - 00000000 ____D () C:\Users\Seufus\AppData\Local\ATI
2015-03-30 12:44 - 2015-03-30 12:44 - 00000000 ____D () C:\Users\Seufus\AppData\Local\VirtualStore
2015-03-30 12:41 - 2015-03-31 00:14 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2015-03-30 12:41 - 2015-03-30 13:43 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-30 12:41 - 2015-03-30 12:41 - 00060817 _____ () C:\Windows\SysWOW64\CCCInstall_201503301241485866.log
2015-03-30 12:40 - 2015-03-31 00:14 - 00000000 ____D () C:\Program Files\AMD
2015-03-30 12:40 - 2015-03-31 00:12 - 00000000 ____D () C:\AMD
2015-03-30 12:40 - 2015-03-30 16:16 - 00000000 ____D () C:\Users\Seufus\AppData\Local\Packages
2015-03-30 12:40 - 2015-03-30 12:40 - 00000000 _____ () C:\Windows\ativpsrm.bin
2015-03-30 12:36 - 2015-03-30 12:59 - 00000000 ____D () C:\Users\Seufus
2015-03-30 12:36 - 2015-03-30 12:36 - 00000020 ___SH () C:\Users\Seufus\ntuser.ini
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Vorlagen
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Startmenü
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Netzwerkumgebung
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Lokale Einstellungen
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Eigene Dateien
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Druckumgebung
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Documents\Eigene Musik
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Documents\Eigene Bilder
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\AppData\Local\Verlauf
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\AppData\Local\Anwendungsdaten
2015-03-30 12:36 - 2015-03-30 12:36 - 00000000 _SHDL () C:\Users\Seufus\Anwendungsdaten
2015-03-30 12:36 - 2015-03-10 00:19 - 00000000 ___RD () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-30 12:36 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-30 12:36 - 2014-11-21 17:14 - 00000000 ___RD () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-03-30 12:36 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-03-30 12:36 - 2014-11-21 09:48 - 00000369 _____ () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-03-30 12:36 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Seufus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-03-30 12:34 - 2015-03-31 00:04 - 00000000 ____D () C:\Program Files\KMSpico
2015-03-30 12:34 - 2015-03-30 12:34 - 00004608 _____ () C:\Windows\SECOH-QAD.exe
2015-03-30 12:34 - 2015-03-30 12:34 - 00003584 _____ () C:\Windows\SECOH-QAD.dll
2015-03-30 12:34 - 2010-12-06 04:16 - 00090112 _____ (Vestris Inc.) C:\Windows\system32\Vestris.ResourceLib.dll
2015-03-30 12:32 - 2015-03-31 08:22 - 01127967 _____ () C:\Windows\WindowsUpdate.log
2015-03-30 12:32 - 2015-03-30 12:32 - 00000000 ____D () C:\Windows\CSC
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Startmenü
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Programme
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Startmenü
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Dokumente
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2015-03-30 12:29 - 2015-03-30 12:29 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2015-03-30 12:28 - 2015-03-30 12:28 - 00000000 __SHD () C:\Recovery
2015-03-30 12:27 - 2015-03-30 12:27 - 00002326 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4216540600-1385818188-3882979393-500
2015-03-25 11:21 - 2015-03-25 11:21 - 00281056 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-03-19 16:05 - 2015-03-19 16:05 - 00289248 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgwfpa.sys
2015-03-11 19:46 - 2015-03-11 19:46 - 00002326 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3926316494-2145053832-294120142-500
2015-03-11 16:52 - 2015-03-31 08:23 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS
2015-03-11 16:52 - 2015-03-11 16:52 - 00000000 ____D () C:\ProgramData\Microsoft Toolkit
2015-03-11 13:36 - 2015-03-11 13:36 - 00002326 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2539250862-3510011041-2209991536-500
2015-03-11 13:35 - 2015-03-30 12:26 - 00001644 _____ () C:\Windows\PFRO.log
2015-03-10 00:48 - 2015-03-31 00:47 - 00019010 _____ () C:\Windows\setupact.log
2015-03-10 00:48 - 2015-03-10 00:48 - 00000000 _____ () C:\Windows\setuperr.log
2015-03-10 00:46 - 2015-03-30 12:28 - 00002832 _____ () C:\Windows\DtcInstall.log
2015-03-10 00:11 - 2015-03-06 04:53 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-10 00:11 - 2015-03-06 04:33 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-10 00:11 - 2015-02-26 01:26 - 04178944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-10 00:11 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-10 00:11 - 2015-02-20 05:03 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-10 00:11 - 2015-02-20 04:58 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-10 00:11 - 2015-02-20 04:20 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-10 00:11 - 2015-02-20 04:15 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-10 00:11 - 2015-02-12 19:40 - 22291584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-10 00:11 - 2015-02-12 19:34 - 19731824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-10 00:11 - 2015-01-31 01:20 - 00203264 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-10 00:11 - 2015-01-29 20:45 - 01763352 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-10 00:11 - 2015-01-29 20:34 - 01488040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-10 00:11 - 2015-01-28 17:41 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-10 00:11 - 2015-01-28 17:41 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-03-10 00:11 - 2015-01-28 17:41 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-03-10 00:11 - 2015-01-28 03:31 - 00402432 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-10 00:11 - 2015-01-28 03:11 - 00357376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-10 00:11 - 2015-01-27 06:22 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-10 00:11 - 2015-01-27 04:11 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-10 00:10 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-10 00:10 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-10 00:10 - 2015-02-21 02:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-03-10 00:10 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-10 00:10 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-10 00:10 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-10 00:10 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-10 00:10 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-10 00:10 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-10 00:10 - 2015-02-20 04:35 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-10 00:10 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-10 00:10 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-10 00:10 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-10 00:10 - 2015-02-20 04:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-03-10 00:10 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-10 00:10 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-10 00:10 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-10 00:10 - 2015-02-20 03:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-03-10 00:10 - 2015-02-20 03:56 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-03-10 00:10 - 2015-02-20 03:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-03-10 00:10 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-10 00:10 - 2015-02-20 03:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-10 00:10 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-10 00:10 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-10 00:10 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-10 00:10 - 2015-02-20 03:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-03-10 00:10 - 2015-02-20 03:29 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-03-10 00:10 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-10 00:10 - 2015-02-20 03:26 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-03-10 00:10 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-10 00:10 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-10 00:10 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-10 00:10 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-10 00:10 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-10 00:10 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-10 00:10 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-10 00:09 - 2015-02-08 01:57 - 01090048 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2015-03-10 00:09 - 2015-02-08 01:49 - 00791040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2015-03-10 00:09 - 2015-02-07 01:09 - 00396419 _____ () C:\Windows\system32\ApnDatabase.xml
2015-03-10 00:09 - 2015-02-06 03:28 - 02257408 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-03-10 00:09 - 2015-02-06 03:08 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-03-10 00:09 - 2015-02-05 22:24 - 01113920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-03-10 00:09 - 2015-02-04 01:58 - 00264000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2015-03-10 00:09 - 2015-02-04 01:58 - 00114496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2015-03-10 00:09 - 2015-02-04 01:58 - 00044024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2015-03-10 00:09 - 2015-02-03 02:03 - 03551744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll
2015-03-10 00:09 - 2015-02-03 02:02 - 04298240 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2015-03-10 00:09 - 2015-02-03 01:53 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\winshfhc.dll
2015-03-10 00:09 - 2015-02-03 01:53 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winshfhc.dll
2015-03-10 00:09 - 2015-01-30 05:01 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidbth.sys
2015-03-10 00:09 - 2015-01-30 04:03 - 01488896 _____ (Microsoft Corporation) C:\Windows\system32\mfc42u.dll
2015-03-10 00:09 - 2015-01-30 04:03 - 01464832 _____ (Microsoft Corporation) C:\Windows\system32\mfc42.dll
2015-03-10 00:09 - 2015-01-30 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42u.dll
2015-03-10 00:09 - 2015-01-30 03:42 - 01204224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42.dll
2015-03-10 00:09 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atlthunk.dll
2015-03-10 00:09 - 2015-01-29 03:04 - 01091072 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2015-03-10 00:09 - 2015-01-29 03:04 - 00864256 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2015-03-10 00:09 - 2015-01-29 02:59 - 02773504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-03-10 00:09 - 2015-01-29 02:49 - 02459136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-03-10 00:09 - 2015-01-28 01:47 - 02501368 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2015-03-10 00:09 - 2015-01-28 01:41 - 02207488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2015-03-10 00:08 - 2015-01-31 01:42 - 03097600 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-03-10 00:08 - 2015-01-31 01:29 - 02484224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-03-10 00:08 - 2015-01-30 04:02 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2015-03-10 00:08 - 2015-01-30 03:40 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappgnui.dll
2015-03-10 00:08 - 2015-01-30 03:37 - 00331776 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll
2015-03-10 00:08 - 2015-01-30 03:24 - 00339456 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll
2015-03-10 00:08 - 2015-01-30 03:24 - 00250880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapp3hst.dll
2015-03-10 00:08 - 2015-01-30 03:16 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapphost.dll
2015-03-10 00:08 - 2015-01-30 03:08 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\eappcfg.dll
2015-03-10 00:08 - 2015-01-30 03:06 - 00278016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappcfg.dll
2015-03-10 00:08 - 2015-01-29 03:58 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll
2015-03-10 00:08 - 2015-01-29 03:29 - 00290816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\photowiz.dll
2015-03-10 00:08 - 2015-01-29 03:11 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-10 00:08 - 2015-01-29 03:00 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-10 00:08 - 2015-01-29 02:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-03-10 00:08 - 2015-01-29 02:50 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-03-10 00:08 - 2015-01-28 04:24 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\StorageContextHandler.dll
2015-03-10 00:08 - 2015-01-28 03:47 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StorageContextHandler.dll
2015-03-10 00:08 - 2015-01-27 05:44 - 00933888 _____ (Microsoft Corporation) C:\Windows\system32\calc.exe
2015-03-10 00:08 - 2015-01-24 03:51 - 00816128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\calc.exe
2015-03-10 00:08 - 2015-01-23 09:17 - 00723072 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2015-03-10 00:08 - 2015-01-23 07:02 - 00560392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2015-03-10 00:08 - 2014-12-11 07:36 - 00046456 _____ (Microsoft Corporation) C:\Windows\system32\LockScreenContentServer.exe
2015-03-09 23:42 - 2014-12-13 23:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-03-09 23:42 - 2014-12-13 23:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Public\Documents\Mes vidéos
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Public\Documents\Mes images
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Public\Documents\Ma musique
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Voisinage réseau
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Voisinage d'impression
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Modèles
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Menu Démarrer
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Documents\Mes vidéos
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Documents\Mes images
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\Documents\Ma musique
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Historique
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\Documents\Mes vidéos
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\Documents\Mes images
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\Documents\Ma musique
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Historique
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\ProgramData\Modèles
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programmes
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\ProgramData\Menu Démarrer
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\ProgramData\Bureau
2015-03-09 23:25 - 2015-03-09 23:25 - 00000000 _SHDL () C:\Program Files\Fichiers communs
2015-03-09 23:19 - 2015-03-09 23:19 - 00002324 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-906833649-1322662672-2572310967-500
2015-03-09 21:16 - 2015-03-31 00:52 - 00764776 _____ () C:\Windows\system32\perfh00C.dat
2015-03-09 21:16 - 2015-03-31 00:52 - 00150868 _____ () C:\Windows\system32\perfc00C.dat
2015-03-09 21:16 - 2015-03-09 21:16 - 00350772 _____ () C:\Windows\system32\perfi00C.dat
2015-03-09 21:16 - 2015-03-09 21:16 - 00040528 _____ () C:\Windows\system32\perfd00C.dat
2015-03-09 21:16 - 2015-03-09 21:16 - 00000000 ____D () C:\Windows\SysWOW64\fr
2015-03-09 21:16 - 2015-03-09 21:16 - 00000000 ____D () C:\Windows\system32\fr
2015-03-09 21:11 - 2015-03-31 00:52 - 00763552 _____ () C:\Windows\system32\perfh00A.dat
2015-03-09 21:11 - 2015-03-31 00:52 - 00158234 _____ () C:\Windows\system32\perfc00A.dat
2015-03-09 21:11 - 2015-03-09 21:11 - 00346516 _____ () C:\Windows\system32\perfi00A.dat
2015-03-09 21:11 - 2015-03-09 21:11 - 00043804 _____ () C:\Windows\system32\perfd00A.dat
2015-03-09 21:11 - 2015-03-09 21:11 - 00000000 ____D () C:\Windows\SysWOW64\es
2015-03-09 21:11 - 2015-03-09 21:11 - 00000000 ____D () C:\Windows\system32\es
2015-03-09 21:06 - 2015-03-31 00:52 - 00726688 _____ () C:\Windows\system32\perfh007.dat
2015-03-09 21:06 - 2015-03-31 00:52 - 00151380 _____ () C:\Windows\system32\perfc007.dat
2015-03-09 21:06 - 2015-03-09 21:06 - 00305634 _____ () C:\Windows\system32\perfi007.dat
2015-03-09 21:06 - 2015-03-09 21:06 - 00040390 _____ () C:\Windows\system32\perfd007.dat
2015-03-09 21:06 - 2015-03-09 21:06 - 00000000 ____D () C:\Windows\SysWOW64\de
2015-03-09 21:06 - 2015-03-09 21:06 - 00000000 ____D () C:\Windows\system32\de

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-31 00:52 - 2014-11-21 09:38 - 03523776 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-31 00:47 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-31 00:46 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-03-31 00:40 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-03-31 00:25 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-03-30 23:27 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-03-30 22:25 - 2013-08-22 17:36 - 00262144 _____ () C:\Windows\system32\config\BCD-Template
2015-03-30 13:21 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2015-03-30 13:19 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2015-03-30 12:59 - 2013-08-22 16:45 - 00000000 ____D () C:\Windows\Setup
2015-03-30 12:40 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\restore
2015-03-30 12:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2015-03-30 12:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows NT
2015-03-30 12:29 - 2013-08-22 15:36 - 00000000 __RHD () C:\Users\Default
2015-03-30 12:28 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\Recovery
2015-03-11 19:50 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Sysprep
2015-03-10 00:22 - 2013-08-22 16:44 - 00338752 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender
2015-03-10 00:19 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-03-10 00:12 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-09 23:45 - 2015-02-16 00:30 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-09 23:44 - 2015-02-16 00:30 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-09 21:16 - 2014-11-21 09:18 - 00000000 ____D () C:\Program Files\Windows Journal
2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\SysWOW64\winrm
2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\SysWOW64\WCN
2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\SysWOW64\slmgr
2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\SysWOW64\Printing_Admin_Scripts
2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\system32\winrm
2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\system32\WCN
2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\system32\slmgr
2015-03-09 21:16 - 2014-11-21 08:54 - 00000000 ____D () C:\Windows\system32\Printing_Admin_Scripts
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ___SD () C:\Windows\system32\dsc
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\Com
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\SystemResetPlatform
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\migwiz
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\Com
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\IME
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Help
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\FileManager
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\System
2015-03-09 21:16 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\oobe
2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-09 21:16 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\servicing
2015-03-04 23:24 - 2015-02-16 00:42 - 00792032 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-04 23:24 - 2015-02-16 00:42 - 00178144 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-03 15:17 - 2015-02-16 00:35 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\Seufus\AppData\Local\Temp\raptrpatch.exe
C:\Users\Seufus\AppData\Local\Temp\raptr_stub.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-15 23:48

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Seufus at 2015-03-31 08:27:56
Running from C:\Users\Seufus\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: AVG Internet Security 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
FW: AVG Internet Security 2015 (Enabled) {757AB44A-78C2-7D1A-E37F-CA42A037B368}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5863 - AVG Technologies)
AVG 2015 (Version: 15.0.4321 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5863 - AVG Technologies) Hidden
AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)
Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Intel(R) Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0.4 - Mozilla)
Raptr (HKLM-x32\...\Raptr) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.06.50 (16.12.2014) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.75.00(19.01.2015) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.03.05.22 - Samsung Electronics Co., Ltd.) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

30-03-2015 12:40:58 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {4BF5163A-A246-4088-9436-16C532F1CAE8} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2015-03-11] ()
Task: {4FBF1401-161F-43D7-8C93-C04C07B203CD} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {5DA91D73-C245-4A19-89BF-73D03CF22759} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {9830635D-9B86-4BD0-B68C-43123FAB7144} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {C00834C8-CF82-483C-93A4-271CDF36FBC4} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {DE34A060-BF2B-43BC-B181-B3E08AEE5E7F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-03-09] (Microsoft Corporation)

==================== Loaded Modules (whitelisted) ==============

2015-03-30 13:26 - 2015-03-30 13:26 - 00620056 ____N () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
2015-02-20 08:01 - 2015-02-20 08:01 - 00022528 _____ () C:\Windows\System32\us001lm.dll
2015-03-30 13:26 - 2015-03-30 13:26 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
2014-09-08 13:39 - 2014-09-08 13:39 - 00464608 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2014-09-08 13:38 - 2014-09-08 13:38 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2015-03-30 13:26 - 2015-03-30 13:26 - 03033112 _____ () C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
2015-03-30 13:26 - 2015-03-30 13:26 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\log4cplusU.dll
2015-03-30 13:26 - 2015-03-30 13:26 - 01711128 _____ () C:\Program Files (x86)\AVG Web TuneUp\TBAPI.dll
2015-03-30 13:26 - 2015-03-30 13:26 - 40630296 _____ () C:\Program Files (x86)\AVG Web TuneUp\libcef.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4216540600-1385818188-3882979393-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-4216540600-1385818188-3882979393-500 - Administrator - Disabled)
Blau (S-1-5-21-4216540600-1385818188-3882979393-1006 - Limited - Enabled) => C:\Users\Blau
Gast (S-1-5-21-4216540600-1385818188-3882979393-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-4216540600-1385818188-3882979393-1004 - Limited - Enabled)
Seufus (S-1-5-21-4216540600-1385818188-3882979393-1001 - Administrator - Enabled) => C:\Users\Seufus

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

Error: (03/31/2015 00:14:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Bratrolli)
Description: Die Anwendung oder der Dienst "Catalyst Control Center: Monitoring program" konnte nicht heruntergefahren werden.

Error: (03/31/2015 00:14:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Bratrolli)
Description: Die Anwendung oder der Dienst "Catalyst Control Center: Host application" konnte nicht heruntergefahren werden.

Error: (03/30/2015 11:54:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/30/2015 11:54:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar

Error: (03/31/2015 08:23:30 AM) (Source: DCOM) (EventID: 10016) (User: Bratrolli)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}BratrolliSeufusS-1-5-21-4216540600-1385818188-3882979393-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar


Microsoft Office Sessions:
=========================

Error: (03/31/2015 00:14:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Bratrolli)
Description: 1C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exeCatalyst Control Center: Monitoring program0211762280

Error: (03/31/2015 00:14:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Bratrolli)
Description: 1C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeCatalyst Control Center: Host application021174840

Error: (03/30/2015 11:54:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\Samsung\Easy Document Creator\x64\EDCAddin.dll

Error: (03/30/2015 11:54:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files (x86)\Samsung\Easy Document Creator\x64\EDCAddin.dll




CodeIntegrity Errors:
===================================
  Date: 2015-03-30 13:39:15.204
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Seufus\AppData\Local\Temp\EverestDriver.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-03-30 13:39:15.078
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz
Percentage of memory in use: 15%
Total physical RAM: 8157.18 MB
Available physical RAM: 6914.1 MB
Total Pagefile: 10077.18 MB
Available Pagefile: 8378.77 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1817.44 GB) (Free:1767.75 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 2794.5 GB) (Disk ID: AECC925E)

Partition: GPT Partition Type.

==================== End Of Log ============================

Gruss Gammel.

schrauber · 31.03.2015, 16:50

ICh würde den AVG WebTuneUp Scheiss runter werfen. Ansonsten sieht das gut aus. Die Logs von einem Portscanner sind elend lang und nichtssagend, aber kannste gerne mal posten.

Gammelfisch · 01.04.2015, 13:23

Hallo,

nachdem sich mein Rechner nach einer gewissen Zeit selbst ausgeschlatett hatte "war abwesend"

bin ich mal ins Ereignisprotokoll gegangen und habe folgendes entdeckt.
Bin ich nur paranoid oder hat jemand my System gehackt.

Code:

ATTFilter

Protokollname: Security
Quelle:        Microsoft-Windows-Security-Auditing
Datum:         30.03.2015 12:26:54
Ereignis-ID:   4672
Aufgabenkategorie:Spezielle Anmeldung
Ebene:         Informationen
Schlüsselwörter:Überwachung erfolgreich
Benutzer:      Nicht zutreffend
Computer:      WIN-M8MALAOCIVQ
Beschreibung:
Einer neuen Anmeldung wurden besondere Rechte zugewiesen.

Antragsteller:
	Sicherheits-ID:		SYSTEM
	Kontoname:		SYSTEM
	Kontodomäne:		NT-AUTORITÄT
	Anmelde-ID:		0x3E7

Berechtigungen:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
Ereignis-XML:
<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4672</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12548</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2015-03-30T10:26:54.175760200Z" />
    <EventRecordID>5</EventRecordID>
    <Correlation />
    <Execution ProcessID="520" ThreadID="572" />
    <Channel>Security</Channel>
    <Computer>WIN-M8MALAOCIVQ</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT-AUTORITÄT</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege</Data>
  </EventData>
</Event>

Code:

ATTFilter

Protokollname: Security
Quelle:        Microsoft-Windows-Security-Auditing
Datum:         30.03.2015 12:29:25
Ereignis-ID:   4735
Aufgabenkategorie:Sicherheitsgruppenverwaltung
Ebene:         Informationen
Schlüsselwörter:Überwachung erfolgreich
Benutzer:      Nicht zutreffend
Computer:      Bratrolli
Beschreibung:
Eine sicherheitsaktivierte lokale Gruppe wurde geändert.

Antragsteller:
	Sicherheits-ID:		SYSTEM
	Kontoname:		WIN-3NITD3Q2MG4$
	Kontodomäne:		WORKGROUP
	Anmelde-ID:		0x3E7

Gruppe:
	Sicherheits-ID:		VORDEFINIERT\Gäste
	Gruppenname:		Invités
	Gruppendomäne:		Builtin

Geänderte Attribute:
	SAM-Kontoname:	-
	SID-Verlauf:		-

Weitere Informationen:
	Berechtigungen:		-
Ereignis-XML:
<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4735</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13826</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2015-03-30T10:29:25.060275000Z" />
    <EventRecordID>57</EventRecordID>
    <Correlation />
    <Execution ProcessID="520" ThreadID="544" />
    <Channel>Security</Channel>
    <Computer>Bratrolli</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserName">Invités</Data>
    <Data Name="TargetDomainName">Builtin</Data>
    <Data Name="TargetSid">S-1-5-32-546</Data>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">WIN-3NITD3Q2MG4$</Data>
    <Data Name="SubjectDomainName">WORKGROUP</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="PrivilegeList">-</Data>
    <Data Name="SamAccountName">-</Data>
    <Data Name="SidHistory">-</Data>
  </EventData>
</Event>

Code:

ATTFilter

Protokollname: Security
Quelle:        Microsoft-Windows-Security-Auditing
Datum:         01.04.2015 13:58:16
Ereignis-ID:   4672
Aufgabenkategorie:Spezielle Anmeldung
Ebene:         Informationen
Schlüsselwörter:Überwachung erfolgreich
Benutzer:      Nicht zutreffend
Computer:      Bratrolli
Beschreibung:
Einer neuen Anmeldung wurden besondere Rechte zugewiesen.

Antragsteller:
	Sicherheits-ID:		SYSTEM
	Kontoname:		SYSTEM
	Kontodomäne:		NT-AUTORITÄT
	Anmelde-ID:		0x3E7

Berechtigungen:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
Ereignis-XML:
<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4672</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12548</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2015-04-01T11:58:16.634570400Z" />
    <EventRecordID>4677</EventRecordID>
    <Correlation />
    <Execution ProcessID="1000" ThreadID="1020" />
    <Channel>Security</Channel>
    <Computer>Bratrolli</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT-AUTORITÄT</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege</Data>
  </EventData>
</Event>

Bitte helft mir

Gruss Gammel

schrauber · 01.04.2015, 18:51

Definier mal "Selbst ausgeschaltet".

Gammelfisch · 01.04.2015, 18:55

Verzeih bitte das war der Ruhe Modus, den ich unter der Rubrik "Energieoptionen" ausgeschaltet habe.

Könntest du mir bitte erklären wie ich Ports unter AVG Internet Security 2015 sperren kann?
Unter Firewall, Syxstemdienste,Systemregeln des Benutzers verwalten habe ich zwar die entsprechenden Optionen gefunden, aber weiss mir nicht zu helfen.
Ein Beispiel: Für Protokoll TCP
und die Richtung ist a)eingehend,b) ausgehend oder c) beidseitig
und der locale Port ist
und der remote Port ist
und die Remote-Adresse ist

Gruß Gammelfisch

29.03.2015, 16:29	#4
schrauber /// the machine /// TB-Ausbilder	Regelmäßige Bluescreens und der Verdacht durch Rougekiller auf einen IRP Hook Rootkit Hi, was ist alles externes am Rechner angeklemmt? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

30.03.2015, 17:18	#8
schrauber /// the machine /// TB-Ausbilder	Regelmäßige Bluescreens und der Verdacht durch Rougekiller auf einen IRP Hook Rootkit Mach auf jeden Fall das Repair Tool __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

01.04.2015, 18:51	#14
schrauber /// the machine /// TB-Ausbilder	Regelmäßige Bluescreens und der Verdacht durch Rougekiller auf einen IRP Hook Rootkit Definier mal "Selbst ausgeschaltet". __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Regelmäßige Bluescreens und der Verdacht durch Rougekiller auf einen IRP Hook Rootkit

Log-Analyse und Auswertung: Regelmäßige Bluescreens und der Verdacht durch Rougekiller auf einen IRP Hook Rootkit