| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win7: AVIRA findet TR/Vundo.Gen, TR/Trustezeb.235520 und TR/Crypt.ZPACK.188761Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
17.10.2015, 09:27
| #1 |
 |  Win7: AVIRA findet TR/Vundo.Gen, TR/Trustezeb.235520 und TR/Crypt.ZPACK.188761 Hallo Trojaner-Board, vor 2 Tagen habe ich mir wohl einen Virus oder Trojaner eingefangen und würde gerne eure Hilfe in Anspruch nehmen. Ich habe blöderweise den Anhang einer email wegen letzer Mahnung und so angeklickt. Ich weiss das ist die grösste Dummheit ever, aber es war hektisch an dem Morgen beim Frühstück und die email war sehr gut gemacht.  AVIRA meldet folgende Funde: TR/Vundo.Gen, TR/Trustezeb.235520 und TR/Crypt.ZPACK.188761. Ansonsten läuft der PC bis jetzt noch normal, aber ich benutze ihn aktuell nur wenn unbedingt notwendig. Ich habe mit AVIRA Mitteln versucht die Viren/Trojaner zu entfernen. Das hat aber nur teilweise geklappt. Zumindest sieht es für mich als Viren/Trojaner-Laie so aus. Gemäss der Anleitung hier im Forum habe ich jetzt die relevanten Informationen mit FRST, Gmer, etc. eingesammelt und poste hier im Fred die log-Files. Da sie aber riessig sind muss ich sie auf mehrere Postings verteilen. Aber irgendwo habe ich hier im Forum gelesen, dass man ein neu eröffneten Beitrag nicht antworten sollte, solange er noch nicht bearbeitet ist, da dann jeder annimmt der Beitrag hat schon einen Bearbeiter. Ich bekomme aber die restlichen Logs nur per Antworten hier rein. Deshalb warte ich mal eine Weile und poste dann die anderen Logs. Ich hoffe das ist so ok. Könntet ihr mir bitte helfen das Problem zu lösen ? Herzlichen Dank schon einmal im Voraus ! schmiro Defogger Logs: defogger_disable.log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:19 on 17/10/2015 (schmiro64)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST.txt FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:16-10-2015
durchgeführt von schmiro64 (Administrator) auf WIN764 (17-10-2015 09:32:46)
Gestartet von D:\_____xxx20151015
Geladene Profile: schmiro64 (Verfügbare Profile: schmiro64 & xxx64 & internet1 & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Garmin Ltd. or its subsidiaries) C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\obexsrv.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\PowerControlHelp.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Garmin Ltd. or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
() C:\Users\schmiro64\AppData\Local\Amazon Music\Amazon Music Helper.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\SnagIt32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\TscHelp.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\audiosrv.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(TechSmith Corporation) C:\Program Files (x86)\TechSmith\SnagIt 8\SnagPriv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
(Microsoft Corporation) C:\Windows\SysWOW64\ftp.exe
(Crystal Dew World) C:\_systools\noinstall\diskinfo\DiskInfo.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\openfiles.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [438784 2010-12-17] ()
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [571192 2014-08-14] (Acronis)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782520 2015-09-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452272 2012-08-31] (CANON INC.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [186408 2013-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [407904 2014-11-27] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153952 2014-11-27] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5380368 2015-07-20] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [693336 2015-07-20] (Acronis International GmbH)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-07-27] (Samsung Electronics Co., Ltd.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1403192 2015-09-11] (Garmin Ltd. or its subsidiaries)
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\Run: [ApacheTomcatMonitor7.0_Tomcat7] => C:\Program Files (x86)\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7w.exe [104448 2013-10-18] (Apache Software Foundation)
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\Run: [Amazon Music] => C:\Users\schmiro64\AppData\Local\Amazon Music\Amazon Music Helper.exe [5887808 2015-07-21] ()
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\Run: [rule-know] => C:\Users\schmiro64\AppData\Local\Temp\Ruledisappointed\rule-bicycle.exe [231936 2015-10-16] () <===== ACHTUNG
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\Run: [economy-earn] => C:\Users\schmiro64\AppData\Local\Temp\Economyadapt\economy-encouraging.exe [148992 2015-10-17] () <===== ACHTUNG
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\RunOnce: [rule-know] => C:\Users\schmiro64\AppData\Local\Temp\Ruledisappointed\rule-bicycle.exe [231936 2015-10-16] () <===== ACHTUNG
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\RunOnce: [economy-earn] => C:\Users\schmiro64\AppData\Local\Temp\Economyadapt\economy-encouraging.exe [148992 2015-10-17] () <===== ACHTUNG
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\MountPoints2: {45a7dc50-5364-11e2-b921-806e6f6e6963} - H:\.\Bin\ASSETUP.exe
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\...\MountPoints2: {479fb6ff-c967-11e2-b0e7-50465db51cac} - K:\LGAutoRun.exe
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1403192 2015-09-11] (Garmin Ltd. or its subsidiaries)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-09-12] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-09-12] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-09-12] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SnagIt 8.lnk [2014-06-08]
ShortcutTarget: SnagIt 8.lnk -> C:\Program Files (x86)\TechSmith\SnagIt 8\SnagIt32.exe (TechSmith Corporation)
Startup: C:\Users\schmiro64\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bginfo.exe - Verknüpfung.lnk [2013-03-23]
ShortcutTarget: Bginfo.exe - Verknüpfung.lnk -> C:\_systools\noinstall\BGInfo\Bginfo.exe (Sysinternals)
GroupPolicyScripts: Beschränkung <======= ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\..\Interfaces\{AA160C9A-E0F5-4D8C-9654-DBEF5B5C7961}: [NameServer] 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1582384673-2009952006-1762237435-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 8\DLLx64\SnagItBHO64.dll [2007-05-16] (TechSmith Corporation)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-08-04] (Microsoft Corporation)
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll [2013-11-28] (CANON INC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-06-22] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-09-11] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-11] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-06-22] (Oracle Corporation)
BHO-x32: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItBHO.dll [2007-05-16] (TechSmith Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-08-04] (Microsoft Corporation)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2013-11-28] (CANON INC.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-09-12] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-09-12] (Microsoft Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll [2013-11-28] (CANON INC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2013-11-28] (CANON INC.)
Toolbar: HKLM-x32 - SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 8\SnagItIEAddin.dll [2007-05-16] (TechSmith Corporation)
Handler-x32: li5bin - {1E39F80A-E02D-40CC-AA23-9620BC3F2A0B} - C:\_systools\install\LOGINventory5\LoginProtocolHandler.dll [2013-11-29] (Schmidt's LOGIN GmbH)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\schmiro64\AppData\Roaming\Mozilla\Firefox\Profiles\kfgrd4bd.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-10-04] ()
FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-06-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-06-22] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: synology.com/SurveillancePlugin_x86_64 -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.581\npSurveillancePlugin_x86_64.dll [2015-07-22] (Synology)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-10-04] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2014-11-27] (Citrix Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-10-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-19] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin-x32: synology.com/SurveillancePlugin -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.581\npSurveillancePlugin.dll [2015-07-22] (Synology)
FF Extension: O2CPlayer Plugin - C:\Users\schmiro64\AppData\Roaming\Mozilla\Firefox\Profiles\kfgrd4bd.default\Extensions\o2cplayer@eleco.com [2015-03-10]
FF Extension: Garmin Communicator - C:\Users\schmiro64\AppData\Roaming\Mozilla\Firefox\Profiles\kfgrd4bd.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2015-05-14]
FF Extension: Firebug - C:\Users\schmiro64\AppData\Roaming\Mozilla\Firefox\Profiles\kfgrd4bd.default\Extensions\firebug@software.joehewitt.com.xpi [2013-02-13]
FF Extension: FirePath - C:\Users\schmiro64\AppData\Roaming\Mozilla\Firefox\Profiles\kfgrd4bd.default\Extensions\FireXPath@pierre.tholence.com.xpi [2013-02-13]
FF Extension: NoScript - C:\Users\schmiro64\AppData\Roaming\Mozilla\Firefox\Profiles\kfgrd4bd.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-01-03]
Chrome:
=======
CHR Profile: C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-15]
CHR Extension: (Google Docs) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-15]
CHR Extension: (Google Drive) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-03-15]
CHR Extension: (YouTube) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-03-15]
CHR Extension: (Google-Suche) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-15]
CHR Extension: (Google Tabellen) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-15]
CHR Extension: (Google Text & Tabellen Offline) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-20]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-15]
CHR Extension: (Google Mail) - C:\Users\schmiro64\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-15]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [932912 2015-09-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-09-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-09-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1147720 2015-10-14] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe [1475744 2012-05-25] (ASUSTeK Computer Inc.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2774104 2015-09-11] (Microsoft Corporation)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2014-11-23] (Macrovision Europe Ltd.) [Datei ist nicht signiert]
R3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2014-11-23] (Macrovision Europe Ltd.) [Datei ist nicht signiert]
R2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [762272 2015-09-11] (Garmin Ltd. or its subsidiaries)
R3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160768 2011-05-27] (Intel Corporation) [Datei ist nicht signiert]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2014-12-15] (NETGEAR)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5405456 2014-11-12] (TeamViewer GmbH)
S3 Tomcat7; C:\Program Files (x86)\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7.exe [80896 2013-10-18] (Apache Software Foundation) [Datei ist nicht signiert]
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2014-02-25] ()
R2 vmware-converter-agent; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe [479312 2013-10-07] (VMware, Inc.)
R2 vmware-converter-server; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479312 2013-10-07] (VMware, Inc.)
R2 vmware-converter-worker; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479312 2013-10-07] (VMware, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [30720 2015-01-26] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [37376 2015-01-26] (LG Electronics Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
R3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [163544 2015-09-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-08-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [74952 2015-09-22] (Avira Operations GmbH & Co. KG)
S3 bmdrvr; C:\Windows\SysWow64\drivers\bmdrvr.sys [75344 2013-08-28] (VMware, Inc.)
S3 btmaudio; C:\Windows\System32\drivers\btmaud.sys [40960 2010-03-01] (Motorola, Inc.)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [296736 2015-03-15] (Acronis International GmbH)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [30592 2013-01-07] (REALiX(tm))
R2 NPF; C:\Windows\system32\drivers\npf.sys [35344 2015-02-26] (CACE Technologies, Inc.)
S3 NUServer64; C:\Windows\System32\DRIVERS\NUServer64.sys [240128 2010-09-17] ( ) [Datei ist nicht signiert]
R2 tib; C:\Windows\System32\DRIVERS\tib.sys [1058632 2015-08-21] (Acronis International GmbH)
R2 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [248648 2015-08-21] (Acronis International GmbH)
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [90928 2012-03-01] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [632752 2012-03-01] (Paragon)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-08-28] (VMware, Inc.)
S3 WIMMount; G:\ctnot\Projects\Tools\Win8PESE\X64\wimmount.sys [40392 2012-07-25] (Microsoft Corporation)
S3 andnetadb; System32\Drivers\lgandnetadb.sys [X]
S3 andnetndis; system32\DRIVERS\lgandnetndis64.sys [X]
S3 EST_BusEnum; system32\DRIVERS\GenBus.sys [X]
S3 NUS_Bus; system32\DRIVERS\NUS_Bus.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-17 09:32 - 2015-10-17 09:32 - 00000000 ____D C:\FRST
2015-10-17 09:19 - 2015-10-17 09:19 - 00000000 _____ C:\Users\schmiro64\defogger_reenable
2015-10-17 08:59 - 2015-10-17 08:59 - 00075068 _____ C:\Users\schmiro64\Downloads\AVSCAN-20151016-233643-1B0F2AFC.LOG
2015-10-16 20:10 - 2015-10-16 20:10 - 00063188 _____ C:\Users\schmiro64\Downloads\AVSCAN-20151016-192519-C32CBE66.LOG
2015-10-15 22:35 - 2015-10-16 19:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-15 21:32 - 2015-10-15 22:49 - 00000000 ____D C:\Users\schmiro64\Downloads\20151015
2015-10-15 21:31 - 2015-10-15 21:31 - 00331526 _____ C:\Users\schmiro64\Downloads\20151015.zip
2015-10-14 20:04 - 2015-09-18 21:31 - 00391784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-10-14 20:04 - 2015-09-18 20:58 - 00345688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-10-14 20:04 - 2015-09-16 06:48 - 25851904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-10-14 20:04 - 2015-09-16 06:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-10-14 20:04 - 2015-09-16 06:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-10-14 20:04 - 2015-09-16 06:22 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-10-14 20:04 - 2015-09-16 06:21 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-10-14 20:04 - 2015-09-16 06:21 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-10-14 20:04 - 2015-09-16 06:21 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-10-14 20:04 - 2015-09-16 06:21 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-10-14 20:04 - 2015-09-16 06:21 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-10-14 20:04 - 2015-09-16 06:14 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-10-14 20:04 - 2015-09-16 06:13 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-10-14 20:04 - 2015-09-16 06:10 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-10-14 20:04 - 2015-09-16 06:09 - 05990912 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-10-14 20:04 - 2015-09-16 06:08 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-10-14 20:04 - 2015-09-16 06:08 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-10-14 20:04 - 2015-09-16 06:08 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-10-14 20:04 - 2015-09-16 06:08 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-10-14 20:04 - 2015-09-16 06:01 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-10-14 20:04 - 2015-09-16 05:58 - 20357632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-10-14 20:04 - 2015-09-16 05:58 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-10-14 20:04 - 2015-09-16 05:50 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-10-14 20:04 - 2015-09-16 05:46 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-10-14 20:04 - 2015-09-16 05:45 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-10-14 20:04 - 2015-09-16 05:45 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-10-14 20:04 - 2015-09-16 05:43 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-10-14 20:04 - 2015-09-16 05:41 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-10-14 20:04 - 2015-09-16 05:33 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-10-14 20:04 - 2015-09-16 05:33 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-10-14 20:04 - 2015-09-16 05:32 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-10-14 20:04 - 2015-09-16 05:32 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-10-14 20:04 - 2015-09-16 05:31 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-10-14 20:04 - 2015-09-16 05:31 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-10-14 20:04 - 2015-09-16 05:29 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-10-14 20:04 - 2015-09-16 05:29 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-10-14 20:04 - 2015-09-16 05:28 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-10-14 20:04 - 2015-09-16 05:28 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-10-14 20:04 - 2015-09-16 05:26 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-10-14 20:04 - 2015-09-16 05:26 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-10-14 20:04 - 2015-09-16 05:26 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-10-14 20:04 - 2015-09-16 05:24 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-10-14 20:04 - 2015-09-16 05:23 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-10-14 20:04 - 2015-09-16 05:22 - 14458368 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-10-14 20:04 - 2015-09-16 05:22 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-10-14 20:04 - 2015-09-16 05:22 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-10-14 20:04 - 2015-09-16 05:15 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-10-14 20:04 - 2015-09-16 05:11 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-10-14 20:04 - 2015-09-16 05:10 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-10-14 20:04 - 2015-09-16 05:07 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-10-14 20:04 - 2015-09-16 05:06 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-10-14 20:04 - 2015-09-16 05:05 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-10-14 20:04 - 2015-09-16 05:05 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-10-14 20:04 - 2015-09-16 05:04 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-10-14 20:04 - 2015-09-16 04:59 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-10-14 20:04 - 2015-09-16 04:58 - 12853760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-10-14 20:04 - 2015-09-16 04:58 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-10-14 20:04 - 2015-09-16 04:56 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-10-14 20:04 - 2015-09-16 04:55 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-10-14 20:04 - 2015-09-16 04:55 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-10-14 20:04 - 2015-09-16 04:48 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-10-14 20:04 - 2015-09-16 04:37 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-10-14 20:04 - 2015-09-16 04:34 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-10-14 20:04 - 2015-09-16 04:32 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-10-14 20:03 - 2015-08-06 20:04 - 14176768 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-10-14 20:03 - 2015-08-06 20:03 - 01866752 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-10-14 20:03 - 2015-08-06 19:44 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-10-14 20:03 - 2015-08-06 19:44 - 01498624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-10-14 20:02 - 2015-09-29 05:16 - 05569472 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-10-14 20:02 - 2015-09-29 05:13 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-10-14 20:02 - 2015-09-29 05:11 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-10-14 20:02 - 2015-09-29 05:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-10-14 20:02 - 2015-09-29 05:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-10-14 20:02 - 2015-09-29 05:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-10-14 20:02 - 2015-09-29 05:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-10-14 20:02 - 2015-09-29 05:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-10-14 20:02 - 2015-09-29 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-10-14 20:02 - 2015-09-29 05:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-10-14 20:02 - 2015-09-29 05:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-10-14 20:02 - 2015-09-29 05:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-10-14 20:02 - 2015-09-29 05:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-10-14 20:02 - 2015-09-29 05:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-10-14 20:02 - 2015-09-29 05:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-10-14 20:02 - 2015-09-29 05:05 - 03990976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-10-14 20:02 - 2015-09-29 05:05 - 03936192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-10-14 20:02 - 2015-09-29 05:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-10-14 20:02 - 2015-09-29 05:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-10-14 20:02 - 2015-09-29 05:02 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 05:01 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:59 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-10-14 20:02 - 2015-09-29 04:59 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-10-14 20:02 - 2015-09-29 04:59 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-10-14 20:02 - 2015-09-29 04:59 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-10-14 20:02 - 2015-09-29 04:59 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-10-14 20:02 - 2015-09-29 04:59 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-10-14 20:02 - 2015-09-29 04:58 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-10-14 20:02 - 2015-09-29 04:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-10-14 20:02 - 2015-09-29 04:58 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-10-14 20:02 - 2015-09-29 04:58 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-10-14 20:02 - 2015-09-29 04:57 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-10-14 20:02 - 2015-09-29 04:57 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-10-14 20:02 - 2015-09-29 04:57 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-10-14 20:02 - 2015-09-29 04:57 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-10-14 20:02 - 2015-09-29 04:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-10-14 20:02 - 2015-09-29 04:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 04:49 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 03:50 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-10-14 20:02 - 2015-09-29 03:49 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-10-14 20:02 - 2015-09-29 03:49 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-10-14 20:02 - 2015-09-29 03:43 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-10-14 20:02 - 2015-09-29 03:43 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-10-14 20:02 - 2015-09-29 03:40 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 03:40 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 03:40 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-10-14 20:02 - 2015-09-29 03:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-10-14 20:02 - 2015-09-25 20:07 - 03168768 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-10-14 20:02 - 2015-09-25 20:07 - 02607104 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-10-14 20:02 - 2015-09-25 20:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-10-14 20:02 - 2015-09-25 20:07 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-10-14 20:02 - 2015-09-25 20:07 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-10-14 20:02 - 2015-09-25 20:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-10-14 20:02 - 2015-09-25 20:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-10-14 20:02 - 2015-09-25 20:06 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-10-14 20:02 - 2015-09-25 20:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-10-14 20:02 - 2015-09-25 20:06 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-10-14 20:02 - 2015-09-25 20:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-10-14 20:02 - 2015-09-25 19:59 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-10-14 20:02 - 2015-09-25 19:59 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-10-14 20:02 - 2015-09-25 19:59 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-10-14 20:02 - 2015-09-25 19:59 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-10-14 20:02 - 2015-09-25 19:58 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-10-14 20:02 - 2015-09-18 21:22 - 00025432 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-10-14 20:02 - 2015-09-18 21:19 - 01291264 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-10-14 20:02 - 2015-09-18 21:19 - 00766464 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-10-14 20:02 - 2015-09-18 21:19 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-10-14 20:02 - 2015-09-18 21:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-10-14 20:02 - 2015-09-18 21:19 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-10-14 20:02 - 2015-09-18 21:09 - 01163776 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-10-14 20:02 - 2015-09-15 20:17 - 00157016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-10-14 20:02 - 2015-09-15 20:17 - 00097112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-10-14 20:02 - 2015-09-15 20:11 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-10-14 20:02 - 2015-09-15 20:11 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-10-14 20:02 - 2015-09-15 20:11 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-10-14 20:02 - 2015-09-15 20:11 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-10-14 20:02 - 2015-09-15 20:11 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-10-14 20:02 - 2015-09-15 20:11 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-10-14 20:02 - 2015-09-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-10-14 20:02 - 2015-09-15 19:36 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-10-14 20:02 - 2015-09-15 19:36 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-10-14 20:02 - 2015-09-15 19:36 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-10-14 20:02 - 2015-09-15 19:35 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-10-14 20:01 - 2015-10-01 20:06 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-10-14 20:01 - 2015-10-01 20:04 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-10-14 20:01 - 2015-10-01 20:00 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-10-14 20:01 - 2015-10-01 20:00 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-10-14 20:01 - 2015-10-01 20:00 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-10-14 20:01 - 2015-10-01 20:00 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-10-14 20:01 - 2015-10-01 20:00 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-10-14 20:01 - 2015-10-01 19:50 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-10-14 20:01 - 2015-10-01 19:00 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-10-14 20:01 - 2015-07-18 15:08 - 00984448 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00901264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2015-10-14 20:01 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2015-10-06 15:17 - 2015-10-06 15:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-09-27 23:29 - 2015-09-27 23:30 - 06521184 _____ (Tim Kosse) C:\Users\schmiro64\Downloads\FileZilla_3.14.0_win64-setup.exe
2015-09-22 22:49 - 2015-09-22 22:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-17 09:21 - 2009-07-14 06:45 - 00031680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-17 09:21 - 2009-07-14 06:45 - 00031680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-17 09:19 - 2012-12-31 18:12 - 00000000 ____D C:\Users\schmiro64
2015-10-17 09:18 - 2010-11-21 08:50 - 00702154 _____ C:\Windows\system32\perfh007.dat
2015-10-17 09:18 - 2010-11-21 08:50 - 00150820 _____ C:\Windows\system32\perfc007.dat
2015-10-17 09:18 - 2009-07-14 07:13 - 01628962 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-17 09:16 - 2012-12-31 18:13 - 01139898 _____ C:\Windows\WindowsUpdate.log
2015-10-17 09:13 - 2015-09-12 14:35 - 00002296 _____ C:\Windows\setupact.log
2015-10-17 09:13 - 2015-03-15 17:07 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-17 09:13 - 2013-02-16 21:56 - 00000000 ____D C:\Users\schmiro64\AppData\Local\FreePDF_XP
2015-10-17 09:13 - 2013-01-05 16:33 - 00000000 ____D C:\ProgramData\VMware
2015-10-17 09:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-17 08:39 - 2015-03-15 17:07 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-17 03:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-10-16 23:40 - 2015-03-15 17:08 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-10-16 23:28 - 2013-01-05 18:55 - 00000072 _____ C:\Users\Public\LMDebug.log
2015-10-16 23:27 - 2013-02-17 13:59 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{357339D0-7A51-47A5-AEF2-2E61E0144585}
2015-10-16 20:09 - 2014-03-03 19:52 - 00000000 ____D C:\Users\schmiro64\Documents\SnagIt Katalog
2015-10-16 19:20 - 2015-09-08 23:30 - 00000000 __SHD C:\Users\schmiro64\AppData\Roaming\gjtdghee
2015-10-16 19:09 - 2015-09-16 22:05 - 00009902 _____ C:\Windows\PFRO.log
2015-10-16 19:09 - 2013-01-03 11:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-10-15 21:56 - 2015-05-01 16:26 - 00000000 ____D C:\Users\schmiro64\AppData\Local\CrashDumps
2015-10-15 21:46 - 2015-05-26 21:17 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-10-15 21:45 - 2015-05-26 21:31 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-10-15 21:27 - 2015-04-19 19:29 - 00000000 ____D C:\Windows\system32\appraiser
2015-10-15 21:27 - 2014-05-06 22:36 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-10-14 20:21 - 2013-08-10 16:47 - 00000000 ____D C:\Windows\system32\MRT
2015-10-14 20:18 - 2013-01-03 12:24 - 143481208 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-10-13 00:07 - 2013-03-24 15:11 - 00000000 ____D C:\Users\schmiro64\AppData\Roaming\BOM
2015-10-09 18:06 - 2013-01-05 16:34 - 00000000 ____D C:\Users\schmiro64\AppData\Local\VMware
2015-10-09 17:56 - 2013-01-05 16:34 - 00000000 ____D C:\Users\schmiro64\AppData\Roaming\VMware
2015-10-09 09:36 - 2015-04-05 12:33 - 00000000 ___SD C:\Windows\system32\GWX
2015-10-08 23:45 - 2015-04-05 12:33 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-10-04 21:57 - 2014-08-10 16:26 - 00082944 _____ C:\Users\schmiro64\Desktop\guzzi_parts.xls
2015-10-04 18:48 - 2014-06-27 21:51 - 00000000 ____D C:\Users\schmiro64\AppData\Roaming\ZoomBrowser EX
2015-10-04 18:48 - 2014-06-27 21:45 - 00000000 ____D C:\Users\schmiro64\AppData\Roaming\CameraWindowDC
2015-10-04 13:09 - 2014-08-21 21:05 - 00000000 ____D C:\Users\schmiro64\AppData\Local\Adobe
2015-10-04 13:08 - 2013-01-03 12:04 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-10-04 13:08 - 2013-01-03 12:04 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-27 23:33 - 2013-03-24 15:06 - 00000000 ____D C:\Users\schmiro64\AppData\Roaming\FileZilla
2015-09-26 22:59 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-09-24 08:23 - 2013-10-24 19:34 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-09-22 22:49 - 2015-05-07 20:20 - 00002014 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk
2015-09-22 22:48 - 2013-05-07 18:49 - 00074952 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-09-22 22:48 - 2013-03-27 21:09 - 00163544 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-09-19 11:33 - 2015-03-15 17:07 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-19 11:33 - 2015-03-15 17:07 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2014-06-17 09:50 - 2015-02-22 17:35 - 0000093 _____ () C:\Users\schmiro64\AppData\Roaming\ARCompanion.log
2013-12-19 20:58 - 2015-04-03 00:09 - 0000545 ____H () C:\Users\schmiro64\AppData\Roaming\eSReg.ini
2013-11-16 21:12 - 2015-04-08 20:09 - 0000600 _____ () C:\Users\schmiro64\AppData\Roaming\winscp.rnd
2013-05-19 17:47 - 2013-05-19 17:47 - 0004608 _____ () C:\Users\schmiro64\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-23 19:16 - 2014-11-24 00:33 - 0006506 _____ () C:\Users\schmiro64\AppData\Local\mbt-actwiz.log
2013-11-16 21:06 - 2015-04-08 21:42 - 0000600 _____ () C:\Users\schmiro64\AppData\Local\PUTTY.RND
2012-12-31 18:52 - 2015-09-04 20:47 - 0007656 _____ () C:\Users\schmiro64\AppData\Local\Resmon.ResmonCfg
Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\Users\schmiro64\AppData\Local\Temp\Ruledisappointed\rule-bicycle.exe
C:\Users\schmiro64\AppData\Local\Temp\Economyadapt\economy-encouraging.exe
Einige Dateien in TEMP:
====================
C:\Users\schmiro64\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-10-11 19:24
==================== Ende von FRST.txt ============================
Gmer Logs: Gmer.txt GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-10-17 09:40:21
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-2 Samsung_ rev.DXT0 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\SCHMIR~1\AppData\Local\Temp\pwldqpoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074f61401 2 bytes JMP 75a6b21b C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074f61419 2 bytes JMP 75a6b346 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074f61431 2 bytes JMP 75ae8fd1 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074f6144a 2 bytes CALL 75a4489d C:\Windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074f614dd 2 bytes JMP 75ae88c4 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074f614f5 2 bytes JMP 75ae8aa0 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074f6150d 2 bytes JMP 75ae87ba C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074f61525 2 bytes JMP 75ae8b8a C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074f6153d 2 bytes JMP 75a5fca8 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074f61555 2 bytes JMP 75a668ef C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074f6156d 2 bytes JMP 75ae9089 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074f61585 2 bytes JMP 75ae8bea C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074f6159d 2 bytes JMP 75ae877e C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074f615b5 2 bytes JMP 75a5fd41 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074f615cd 2 bytes JMP 75a6b2dc C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074f616b2 2 bytes JMP 75ae8f4c C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe[2076] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074f616bd 2 bytes JMP 75ae8713 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074f61401 2 bytes JMP 75a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074f61419 2 bytes JMP 75a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074f61431 2 bytes JMP 75ae8fd1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074f6144a 2 bytes CALL 75a4489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074f614dd 2 bytes JMP 75ae88c4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074f614f5 2 bytes JMP 75ae8aa0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074f6150d 2 bytes JMP 75ae87ba C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074f61525 2 bytes JMP 75ae8b8a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074f6153d 2 bytes JMP 75a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074f61555 2 bytes JMP 75a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074f6156d 2 bytes JMP 75ae9089 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074f61585 2 bytes JMP 75ae8bea C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074f6159d 2 bytes JMP 75ae877e C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074f615b5 2 bytes JMP 75a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074f615cd 2 bytes JMP 75a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074f616b2 2 bytes JMP 75ae8f4c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074f616bd 2 bytes JMP 75ae8713 C:\Windows\syswow64\kernel32.dll
.text C:\WINDOWS\SYSWOW64\VMNAT.EXE[2596] C:\WINDOWS\SYSWOW64\SHFOLDER.dll!SHGetFolderPathW + 4 00000000691013b0 2 bytes JMP 763d55f8 C:\Windows\syswow64\SHELL32.dll
.text C:\WINDOWS\SYSWOW64\VMNAT.EXE[2596] C:\WINDOWS\SYSWOW64\SHFOLDER.dll!SHGetFolderPathW + 20 00000000691013c0 2 bytes CALL 755a9cee C:\Windows\syswow64\msvcrt.dll
.text ... * 20
.text C:\WINDOWS\SYSWOW64\VMNAT.EXE[2596] C:\WINDOWS\SYSWOW64\SHFOLDER.dll!SHGetFolderPathA + 22 000000006910153e 2 bytes CALL 76467774 C:\Windows\syswow64\SHELL32.dll
.text C:\WINDOWS\SYSWOW64\VMNAT.EXE[2596] C:\WINDOWS\SYSWOW64\SHFOLDER.dll!SHGetFolderPathA + 43 0000000069101553 2 bytes CALL 75a410ff C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074f61401 2 bytes JMP 75a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074f61419 2 bytes JMP 75a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074f61431 2 bytes JMP 75ae8fd1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074f6144a 2 bytes CALL 75a4489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074f614dd 2 bytes JMP 75ae88c4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074f614f5 2 bytes JMP 75ae8aa0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074f6150d 2 bytes JMP 75ae87ba C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074f61525 2 bytes JMP 75ae8b8a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074f6153d 2 bytes JMP 75a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074f61555 2 bytes JMP 75a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074f6156d 2 bytes JMP 75ae9089 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074f61585 2 bytes JMP 75ae8bea C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074f6159d 2 bytes JMP 75ae877e C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074f615b5 2 bytes JMP 75a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074f615cd 2 bytes JMP 75a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074f616b2 2 bytes JMP 75ae8f4c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[2812] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074f616bd 2 bytes JMP 75ae8713 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074f61401 2 bytes JMP 75a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074f61419 2 bytes JMP 75a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074f61431 2 bytes JMP 75ae8fd1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074f6144a 2 bytes CALL 75a4489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074f614dd 2 bytes JMP 75ae88c4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074f614f5 2 bytes JMP 75ae8aa0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074f6150d 2 bytes JMP 75ae87ba C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074f61525 2 bytes JMP 75ae8b8a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074f6153d 2 bytes JMP 75a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074f61555 2 bytes JMP 75a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074f6156d 2 bytes JMP 75ae9089 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074f61585 2 bytes JMP 75ae8bea C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074f6159d 2 bytes JMP 75ae877e C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074f615b5 2 bytes JMP 75a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074f615cd 2 bytes JMP 75a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074f616b2 2 bytes JMP 75ae8f4c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5220] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074f616bd 2 bytes JMP 75ae8713 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074f61401 2 bytes JMP 75a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074f61419 2 bytes JMP 75a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074f61431 2 bytes JMP 75ae8fd1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074f6144a 2 bytes CALL 75a4489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074f614dd 2 bytes JMP 75ae88c4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074f614f5 2 bytes JMP 75ae8aa0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074f6150d 2 bytes JMP 75ae87ba C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074f61525 2 bytes JMP 75ae8b8a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074f6153d 2 bytes JMP 75a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074f61555 2 bytes JMP 75a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074f6156d 2 bytes JMP 75ae9089 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074f61585 2 bytes JMP 75ae8bea C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074f6159d 2 bytes JMP 75ae877e C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074f615b5 2 bytes JMP 75a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074f615cd 2 bytes JMP 75a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074f616b2 2 bytes JMP 75ae8f4c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[5280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074f616bd 2 bytes JMP 75ae8713 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074f61401 2 bytes JMP 75a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074f61419 2 bytes JMP 75a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074f61431 2 bytes JMP 75ae8fd1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074f6144a 2 bytes CALL 75a4489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074f614dd 2 bytes JMP 75ae88c4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074f614f5 2 bytes JMP 75ae8aa0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074f6150d 2 bytes JMP 75ae87ba C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074f61525 2 bytes JMP 75ae8b8a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074f6153d 2 bytes JMP 75a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074f61555 2 bytes JMP 75a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074f6156d 2 bytes JMP 75ae9089 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074f61585 2 bytes JMP 75ae8bea C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074f6159d 2 bytes JMP 75ae877e C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074f615b5 2 bytes JMP 75a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074f615cd 2 bytes JMP 75a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074f616b2 2 bytes JMP 75ae8f4c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074f616bd 2 bytes JMP 75ae8713 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000074f61401 2 bytes JMP 75a6b21b C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000074f61419 2 bytes JMP 75a6b346 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000074f61431 2 bytes JMP 75ae8fd1 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000074f6144a 2 bytes CALL 75a4489d C:\Windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000074f614dd 2 bytes JMP 75ae88c4 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000074f614f5 2 bytes JMP 75ae8aa0 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000074f6150d 2 bytes JMP 75ae87ba C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000074f61525 2 bytes JMP 75ae8b8a C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000074f6153d 2 bytes JMP 75a5fca8 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000074f61555 2 bytes JMP 75a668ef C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000074f6156d 2 bytes JMP 75ae9089 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000074f61585 2 bytes JMP 75ae8bea C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000074f6159d 2 bytes JMP 75ae877e C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000074f615b5 2 bytes JMP 75a5fd41 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000074f615cd 2 bytes JMP 75a6b2dc C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000074f616b2 2 bytes JMP 75ae8f4c C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[5888] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000074f616bd 2 bytes JMP 75ae8713 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074f61401 2 bytes JMP 75a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074f61419 2 bytes JMP 75a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074f61431 2 bytes JMP 75ae8fd1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074f6144a 2 bytes CALL 75a4489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074f614dd 2 bytes JMP 75ae88c4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074f614f5 2 bytes JMP 75ae8aa0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074f6150d 2 bytes JMP 75ae87ba C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074f61525 2 bytes JMP 75ae8b8a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074f6153d 2 bytes JMP 75a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074f61555 2 bytes JMP 75a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074f6156d 2 bytes JMP 75ae9089 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074f61585 2 bytes JMP 75ae8bea C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074f6159d 2 bytes JMP 75ae877e C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074f615b5 2 bytes JMP 75a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074f615cd 2 bytes JMP 75a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074f616b2 2 bytes JMP 75ae8f4c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074f616bd 2 bytes JMP 75ae8713 C:\Windows\syswow64\kernel32.dll
---- Threads - GMER 2.1 ----
Thread C:\Windows\SysWOW64\ftp.exe [6972:6996] 000000007ef9bc78
Thread C:\Windows\SysWOW64\ftp.exe [6972:7000] 000000007ef9bc2a
Thread C:\Windows\SysWOW64\ftp.exe [6972:7016] 000000007ef9d229
Thread C:\Windows\SysWOW64\ftp.exe [6972:7024] 000000007efa2a61
Thread C:\Windows\SysWOW64\ftp.exe [6972:6760] 000000007efa6d96
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001bdc03bd3d
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001bdc03bd3d (not active ControlSet)
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@ExcludeProfileDirs AppData\Local;AppData\LocalLow;$Recycle.Bin
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@BuildNumber 7601
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@FirstLogon 0
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@ParseAutoexec 1
---- EOF - GMER 2.1 ----
Geändert von schmiro (17.10.2015 um 09:44 Uhr) |
| Themen zu Win7: AVIRA findet TR/Vundo.Gen, TR/Trustezeb.235520 und TR/Crypt.ZPACK.188761 |
| antivir, avira, canon, computer, converter, desktop, dnsapi.dll, email, firefox, homepage, internet, mozilla, netgear, problem, prozesse, realtek, registry, rundll, scan, services.exe, software, svchost.exe, synology, system, tr/vundo.gen, usb, virus, windows |
Baum-Darstellung