Trojaner-Board - TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung.

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung. (https://www.trojaner-board.de/149657-taskmgr-windows-sicherheitsdient-firewall-lassen-starten-hohe-cpu-auslastung.html)

Redblood

12.02.2014 10:13

TaskMgr,Windows Sicherheitsdient, Firewall lassen sich nicht starten und hohe CPU-Auslastung.

Guten Morgen.

Seit ca. einer halben Woche hat mein Computer die ersten Syptome für einen Virus gezeigt. Die da wären:
-Sicherheitscenter lässt sich nicht starten, da der Dienst deaktiviert ist. Wenn ich ihn auf Automatisch stelle aktiviert er sich, ist aber beim Neustart wieder aus.

-Nach der Aktivierung vom Sicherheitcenter kriege ich die Fehlermeldung Windows Firewall konnte nicht gestartet werden. Manuell starten kann ich ihn nicht.

-Der Taskmanager ist grau hinterlegt, wenn ich ihn mit Rechtsklick in der Taskleiste versuche zu starten. Wenn ich Strg-Alt-Entf drücke wird der Button für den Taskmanager gar nicht angezeigt. Das Problem ist, das der Wert im Schlüssel auf 1 gesetzt ist. Wenn ich den Wert auf 0 setze ändert er sich automatisch wieder zu 1.

-Malwarebytes blockiert alle 20 Sekunden eine Verbindung mit einer schädlichen Website. Die Verbindung wird von cvtres.exe automatisch gestartet.

-Der Prozess svchost.exe hat eine ungewöhnlich hohe Auslastung von 300.000.

Ich habe den Computer einmal mit Malwarebytes und ein Mal mit Norton Security durchlaufen lassen und so einiges gefunden, jedoch hat sich nichts geändert. Ich weiß wirklich nicht mehr was ich tun könnte. Sogar mein Mauszeiger hängt sich beim Bewegen auf und beim Tippen erscheinen die Buchstaben mit verzögerung.

Ich habe einen Fx-6100 Prozessor mit 8 GB RAM und Win 7.
Ich glaube ich weiß welches Programm den Virus eingeschleußt hat, jedoch weiß ich nicht wie ich ihn wieder entfernen könnte.

Hier die Log Files.

Addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-02-2014 01

Ran by Pc at 2014-02-11 22:29:03

Running from C:\Users\Pc\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

µTorrent (HKCU Version: 3.3.2.30303 - BitTorrent Inc.)

Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7 - Adobe Systems Incorporated)

Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden

Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment)

Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment) Hidden

Age of Conan: Unchained (x32 Version:  - Funcom)

Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios)

Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden

AI Suite (x32 Version: 1.06.22 - )

AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge)

AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge) Hidden

AirPlus XtremeG DWL-G122 (x32 Version: 1.0.30 - D-Link)

Aiseesoft MP4 Video Converter 7.1.20 (x32 Version: 7.1.20 - Aiseesoft Studio)

Akamai NetSession Interface (HKCU Version:  - Akamai Technologies, Inc)

Akamai NetSession Interface (x32 Version:  - Akamai Technologies, Inc)

Alliance of Valiant Arms (x32 Version:  - )

AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden

AMD APP SDK Runtime (Version: 10.0.923.1 - Advanced Micro Devices Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden

AMD Fuel (Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden

AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden

AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden

American Conquest Fight Back (x32 Version:  - )

ANNO 2070 (x32 Version: 1.0.0.0 - Ubisoft)

ASUS WebStorage (x32 Version: 3.0.94.193 - eCareme Technologies, Inc.)

ASUSUpdate (x32 Version: 7.18.03 - ASUSTeK Computer Inc.)

ATI AVIVO64 Codecs (Version: 11.6.0.10707 - ATI Technologies Inc.) Hidden

Audacity 2.0.2 (x32 Version: 2.0.2 - Audacity Team)

Babylon Chrome Toolbar (x32 Version: 2.0.0.4 - Babylon Ltd) <==== ATTENTION

Babylon toolbar  (x32 Version:  - BabylonToolbar) <==== ATTENTION

Battle For Graxia (x32 Version:  - )

BioShock Infinite (x32 Version:  - Irrational Games)

Black & White® 2 (x32 Version: 1.00.0000 - Lionhead Studios)

Blitzkrieg Burning Horizon (x32 Version:  - )

Brick-Force  (x32 Version:  - Infernum Productions AG)

Browser Defender 3.0 (x32 Version: 3.0.0.314 - Threat Expert Ltd.)

Brytenwalda Version 1.40 (x32 Version: 1.40 - Brytenwalda Dev.)

Bundled software uninstaller (x32 Version:  - ) <==== ATTENTION

CAESAR IV (x32 Version: 1.2 - Tilted Mill Entertainment)

Call of Duty: Black Ops II - Multiplayer (x32 Version:  - )

Call of Duty: Black Ops II - Zombies (x32 Version:  - )

Camtasia Studio 8 (x32 Version: 8.0.3.994 - TechSmith Corporation)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

CCleaner (Version: 4.09 - Piriform)

CDBurnerXP (x32 Version: 4.5.1.3868 - CDBurnerXP)

Celtic Kings - The Punic Wars (x32 Version:  - )

Chivalry Medieval Warfare (c) Torn Banner Studios version 1 (x32 Version: 1 - )

Codec Pack Packages (HKCU Version:  - ) <==== ATTENTION

Cossacks - The Art Of War (x32 Version:  - )

Cossacks 2 - Battle for Europe (x32 Version:  - )

Cossacks II (x32 Version:  - )

Cross Fire En (x32 Version:  - Z8Games.com)

Crossfire Europe (x32 Version: 1.107 - SG INTERACTIVE)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DAEMON Tools Lite (x32 Version: 4.48.1.0347 - Disc Soft Ltd)

DarthMod: Shogun II (x32 Version:  - )

DBO_CT_TW (x32 Version: 1.57.22 - Cayennetech)

DC-Bass Source 1.3.0 (x32 Version:  - )

Die Schlacht um Mittelerde™ II (x32 Version:  - )

DirectVobSub 2.40.4209 (x32 Version: 2.40.4209 - MPC-HC Team)

DivX-Setup (x32 Version: 2.6.1.8 - DivX, LLC)

Dota 2 (x32 Version:  - Valve )

Dungeons and Dragons Online (HKCU Version:  - )

Dynasty Warriors Online (x32 Version:  - )

Elsword_DE (x32 Version:  - )

EPU-4 Engine (x32 Version: 1.02.01 - )

Europa Universalis IV (x32 Version:  - Paradox Interactive)

ExpressFiles (HKCU Version: 1.8.1 - hxxp://www.express-files.com/) <==== ATTENTION

ffdshow v1.1.4399 [2012-03-22] (x32 Version: 1.1.4399.0 - )

Floris Mod Pack 2.54 (x32 Version:  - )

Forged By Chaos (x32 Version:  - )

Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Fraps (remove only) (x32 Version:  - )

Free Audio CD Burner version 2.0.22.320 (x32 Version: 2.0.22.320 - DVDVideoSoft Ltd.)

Free MP4 Video Converter version 5.0.20.1031 (x32 Version: 5.0.20.1031 - DVDVideoSoft Ltd.)

From Dust (x32 Version: 1.0.0 - Ubisoft)

FuNDeaulls (x32 Version:  - FFunDeals)

Gameforge Live 1.7.0 "Legend" (x32 Version: 1.7.0 - Gameforge)

GameRanger (HKCU Version:  - GameRanger Technologies)

GamersFirst LIVE! (HKCU Version:  - GamersFirst)

Ghost Recon Online (EU) (HKCU Version: 1.34.9860.1 - Ubisoft)

GIMP 2.8.2 (Version: 2.8.2 - The GIMP Team)

Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)

Google Drive (x32 Version: 1.13.5782.599 - Google, Inc.)

Google Earth (x32 Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Toolbar for Internet Explorer (x32 Version: 7.5.4805.320 - Google Inc.)

Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden

Gothic III (x32 Version: 1.0.0 - JoWooD Productions Software AG)

grafstat4 (x32 Version: 4.276 - DrSoft)

GS-Supporter 1.80 (x32 Version:  - Verified Publisher) <==== ATTENTION

Guild Wars 2 (x32 Version:  - NCsoft Corporation, Ltd.)

Haali Media Splitter (x32 Version:  - )

Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)

Haunt 1.0 64bit (HKCU Version:  - )

Hi-Rez Studios Authenticate and Update Service (x32 Version: 3.0.0.0 - Hi-Rez Studios)

HydraVision (x32 Version: 4.2.208.0 - ATI Technologies Inc.) Hidden

Infestation: Survivor Stories (x32 Version:  - Hammerpoint Interactive)

inSSIDer 3 (x32 Version: 3.0.6.42 - MetaGeek, LLC)

Installation (HKCU Version: 1.0.0.8 - Installation)

Intel(R) Processor Graphics (x32 Version: 8.15.10.2266 - Intel Corporation)

IrfanView (remove only) (x32 Version: 4.32 - Irfan Skiljan)

Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

JDownloader 0.9 (x32 Version: 0.9 - AppWork GmbH)

King Arthur II (x32 Version:  - Paradox Interactive)

K-Lite Codec Pack 9.4.0 (Basic) (x32 Version: 9.4.0 - )

Lagarith Lossless Codec (1.3.27) (x32 Version:  - )

LAME v3.99.3 (for Windows) (x32 Version:  - )

League of Legends (x32 Version: 1.3 - Riot Games)

League of Legends (x32 Version: 3.0.1 - Riot Games )

League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden

LOCO EVOLUTION (x32 Version: EVOLUTION - DanalGames)

Logitech Print Service (x32 Version:  - )

Logitech QuickCam-Software (x32 Version: 8.47.0000 - Logitech, Inc.)

LOLReplay (x32 Version: 0.8.5.1 - www.leaguereplays.com)

Lost Empire - Immortals (x32 Version: 1.0.0 - Pollux Gamelabs)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)

Metin2 (x32 Version:  - Gameforge 4D GmbH)

Microsoft .NET Framework 1.1 (x32 Version:  - )

Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden

Microsoft Age of Empires II (x32 Version:  - )

Microsoft Age of Empires II: The Conquerors Expansion (x32 Version:  - )

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (x32 Version: 11.0.51106.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (x32 Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden

Microsoft XNA Framework Redistributable 1.0 Refresh (x32 Version: 1.1.10405.0 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 3.1 (x32 Version: 3.1.10527.0 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (x32 Version: 4.0.20823.0 - Microsoft Corporation)

Mobistel Cynus T1 Drivers(x86) (x32 Version: 2.00 - Mobistel)

Mount&Blade Warband (x32 Version:  - )

Mount&Blade With Fire and Sword (x32 Version:  - )

MountMusket Battalion (x32 Version: 0.4.2 - MountMusket Battalion Team)

Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Movie2KDownloader (x32 Version: 2.1 Build 26473 - Movie2KDownloader.com)

Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)

MySQL Connector/ODBC 3.51 (x32 Version: 3.51.12 - MySQL AB)

Napoleonic Wars (x32 Version: 1.0 - Mount&Blade Napoleonic Wars)

NC Launcher (GameForge) (x32 Version:  - NCsoft)

Nero 9 Essentials (x32 Version:  - Nero AG)

Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden

Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden

Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden

Nero StartSmart (x32 Version: 9.4.12.100 - Nero AG) Hidden

Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Norton Internet Security (x32 Version: 21.1.0.18 - Symantec Corporation)

Notepad++ (x32 Version: 6.4.2 - Notepad++ Team)

NVIDIA 3D Vision Treiber 270.61 (Version: 270.61 - NVIDIA Corporation)

NVIDIA Drivers (Version: 1.10.57.35 - NVIDIA Corporation)

NVIDIA ForceWare Network Access Manager (x32 Version: 1.00.7325.0 - NVIDIA Corporation)

NVIDIA Grafiktreiber 270.61 (Version: 270.61 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.2.22.1 (Version: 1.2.22.1 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.270.54.0 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.10.0513 - NVIDIA Corporation)

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.7061 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 270.61 (Version: 270.61 - NVIDIA Corporation) Hidden

Open It! (x32 Version: 1.1.1 - OpenIt)

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)

OpenSource Flash Video Splitter 1.0.0.5 (x32 Version: 1.0.0.5 - )

Pando Media Booster (x32 Version: 2.6.0.8 - Pando Networks Inc.)

Panzar (x32 Version: 1.0 - Panzar)

Patch v2.2 (x32 Version:  - RUNEFORGE Games Studios)

Patrizier IV (x32 Version: 1.0.0 - Kalypso Media)

PC Probe II (x32 Version: 1.04.92 - ASUSTeK Computer Inc.)

Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

PileFile reminder (HKCU Version:  - FINEDREAM INVEST LTD)

Pixsta (HKCU Version: 2.5.0.48600 - Pokki)

PlanetSide 2 (HKCU Version: 1.0.3.183 - Sony Online Entertainment)

Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden

Pokki (HKCU Version: 0.266.1.172 - Pokki)

Pokki Download Helper (HKCU Version: 1.3.1.282 - Pokki)

PowerISO (x32 Version: 5.4 - Power Software Ltd)

PrivitizeVPN (x32 Version: 1.0.0 - OOO Industry) <==== ATTENTION

ProtectDisc Driver, Version 11 (x32 Version: 11.0.0.14 - ProtectDisc Software GmbH)

PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)

Qtrax Connection Manager (HKCU Version: 20.13.07.02 - Qtrax Inc)

Qtrax Player (HKCU Version:  - portal.qtrax.com)

QuickShare (x32 Version: 1.38.61.10911 - Linkury Inc.) <==== ATTENTION

RaiderZ (x32 Version: 1.0.0.36787 - Gameforge)

RAIDXpert (x32 Version: 3.2.1540.10 - AMD)

RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden

Realtek Ethernet Controller Driver (x32 Version: 7.52.203.2012 - Realtek)

Realtek Ethernet Diagnostic Utility (x32 Version: 1.00.0000 - Realtek)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6526 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation) Hidden

Rise and Fall (x32 Version: 1.00.0000 - Midway Games)

Roads of Rome 3 (x32 Version:  - Realore Studios)

Roma Surrectum Deutsch 1.1.0.5 (x32 Version: 1.1.0.5 - ecozone)

Roma Surrectum II 2.5 (x32 Version: 2.5 - Roma Surrectum Team)

Rome - Total War(TM) (x32 Version: 1.0 - Activision)

Rome - Total War(TM) (x32 Version: 1.0 - Activision) Hidden

Rome Total War - patch 1.3 (x32 Version: 1.3 - )

S4 League_EU (x32 Version: 1.00.0000 - )

Search Protect (x32 Version: 2.7.23.2 - Conduit) <==== ATTENTION

Security Task Manager 1.8g (x32 Version: 1.8g - Neuber Software)

SeeSimilar (x32 Version: 1.0.0.5 - SeeSimilar.com)

Sid Meier's Civilization IV Colonization (x32 Version: 1.00 - Firaxis Games)

Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)

Smite (x32 Version: 0.1.1850.0 - Hi-Rez Studios)

SOE Web Installer (HKCU Version: 1.0.3.171 - Sony Online Entertainment)

Sony Ericsson Update Engine (x32 Version: 2.13.6.201305161305 - Sony Ericsson Communications AB)

Sony PC Companion 2.10.181 (x32 Version: 2.10.181 - Sony)

Special Force 2  1.0 (x32 Version:  - )

Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)

Spotydl 0.9.36.0 (x32 Version: 0.9.36.0 - spotydl.com)

Spyware Doctor 8.0 (x32 Version: 8.0 - PC Tools)

Steam (x32 Version: 1.0.0.0 - Valve Corporation)

Stronghold 2 (x32 Version: 1.00 - Firefly Studios)

surf aand kEEp (x32 Version: 1.2.0.1049 - surif aand keep) <==== ATTENTION

Swords and Sandals 3 Multiplae Ultratus (x32 Version: 1.2.7 - 3rdsense Pty Ltd)

System Requirements Lab CYRI (x32 Version: 6.0.7.0 - Husdawg, LLC)

System Requirements Lab Detection (x32 Version: 1.0.5.0 - Husdawg, LLC)

System Requirements Lab for Intel (x32 Version: 4.5.13.0 - Husdawg, LLC)

TAP-Windows 9.9.2 (Version: 9.9.2 - )

TeamSpeak 3 Client (Version: 3.0.13.1 - TeamSpeak Systems GmbH)

The War Z version 1.0 (x32 Version: 1.0 - Arktos Entertainment Group LLC)

Tube Karaoke (x32 Version:  - Dacotta SoftEngineering)

Tunngle beta (x32 Version:  - Tunngle.net GmbH)

Turbo Key (x32 Version: 1.01.03 - )

Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)

Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1 - Microsoft Corporation)

Vanguard: Saga of Heroes (x32 Version: 1.00.000 - Sigil Games Online)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

VIA Plattform-Geräte-Manager (x32 Version: 1.34 - VIA Technologies, Inc.)

Video downloader 2.0.0.433 (Version: 2.0.0.433 - Southstarco)

VirtualCloneDrive (x32 Version:  - Elaborate Bytes)

VLC media player 2.0.2 (x32 Version: 2.0.2 - VideoLAN)

VLC Media Player DB Toolbar Toolbar (x32 Version:  - )

War Thunder Launcher 1.0.1.278 (x32 Version:  - 2013 Gaijin Entertainment Corporation)

Wargame AirLand Battle (c) Focus Home Interactive version RLD! (x32 Version: RLD! - )

Winamp (x32 Version: 5.63  - Nullsoft, Inc)

Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Mobile Device Updater Component (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

WinRAR 4.00 (64-Bit) (Version: 4.00.0 - win.rar GmbH)

World of Tanks (x32 Version:  - Wargaming.net)

Xfire (remove only) (x32 Version:  - )

Xvid Video Codec (x32 Version: 1.3.2 - Xvid Team)

YGOPro DevPro Version 1.9.6 r0 (x32 Version: 1.9.6 r0 - YGOPro DevPro Online)

Yontoo 1.12.02 (Version: 1.12.02 - Yontoo LLC) <==== ATTENTION

YoutubeAdblocker (x32 Version: 2.3.0.1751 - YoutubeAdblocker) <==== ATTENTION

Zip Opener Packages (HKCU Version:  - ) <==== ATTENTION

Zune (Version: 04.08.2345.00 - Microsoft Corporation)

Zune (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (CHS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (CHT) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (CSY) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (DAN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (DEU) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (ELL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (ESP) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (FIN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (FRA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (HUN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (IND) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (ITA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (JPN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (KOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (MSL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (NLD) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (NOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (PLK) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (PTB) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (PTG) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (RUS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (SVE) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
 

==================== Restore Points  =========================
 

04-02-2014 12:03:18 Windows-Sicherung

04-02-2014 12:09:33 Microsoft Visual C++ 2005 Redistributable (x64) wird installiert

04-02-2014 12:10:40 Installed League of Legends

04-02-2014 12:11:27 DirectX wurde installiert

04-02-2014 14:39:51 Windows-Sicherung

04-02-2014 16:41:35 Windows-Sicherung

04-02-2014 17:06:40 Windows-Sicherung

04-02-2014 18:20:49 Windows Defender Checkpoint

10-02-2014 16:09:55 Windows-Sicherung

11-02-2014 14:49:45 Windows Update

11-02-2014 15:28:55 Installed Java 7 Update 51

11-02-2014 15:33:50 avast! Free Antivirus Setup

11-02-2014 16:17:07 Norton_Power_Eraser_20140211171701336
 

==================== Hosts content: ==========================
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {07441F79-075D-46D1-9621-B4385A0413E1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)

Task: {0ACDB7B0-58EC-44A5-B853-C74A95AB7C8B} - System32\Tasks\{350C38A0-1817-4215-9180-5D11686186E7} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()

Task: {175BF8A3-9AD4-4F9A-B98B-598E8F706334} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)

Task: {2691ADFB-DB4E-45E7-9439-ACD0C99AA70D} - System32\Tasks\{B7AB28D8-B0B8-4B92-82A6-19F4C878FB44} => C:\Users\Public\Sony Online Entertainment\Installed Games\PlanetSide 2 PSG\LaunchPad.exe [2013-03-05] (Sony Online Entertainment)

Task: {278F70B7-06C4-4D40-B948-858B1C8E33C9} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe [2013-08-01] (Symantec Corporation)

Task: {2B8021C3-95EB-4032-8827-F4F20FC80119} - System32\Tasks\{2AF4B969-DDA4-42BC-AC4D-0202126F86FA} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()

Task: {2E3A57BD-04E8-453A-AE42-B25FECD4F834} - System32\Tasks\{B08B504C-C99F-4CA5-AB04-41F9856C1544} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)

Task: {46983AB9-9DB0-4B15-9866-70EB3D8ED964} - System32\Tasks\Digital Sites => C:\Users\Pc\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE

Task: {4913A02B-EF24-4AAE-98AF-0834AF4DCD6F} - System32\Tasks\{BB6CE9F5-E484-406C-AD0E-5A4DC75E4283} => D:\support\DrvSetup.exe

Task: {742E0C46-1F1B-4465-9AFF-E499A0C68AA9} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)

Task: {78BBB10A-F364-4E92-8219-8439ED42836E} - System32\Tasks\PileFile reminder => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION

Task: {7F1E600F-A1FB-44A2-95B1-0A9CFB4AED02} - System32\Tasks\{BEE78D85-4CF3-4479-8433-33E17174DFEB} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)

Task: {85F44FDF-4E73-4F08-858C-DC3F9505CFEB} - System32\Tasks\DSite => C:\Users\Pc\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {8BDCC15A-AFC6-4F6B-9A3E-2D7C1ACF8C54} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe [2013-10-08] (Symantec Corporation)

Task: {8EDAF150-B25F-4F96-8025-08EF10739F82} - System32\Tasks\{31CDF611-4FF3-4119-866C-074E0E880CD6} => D:\support\DrvSetup.exe

Task: {8EDF384F-376F-4AB7-BA38-D81A4DAC2105} - System32\Tasks\DealPly => C:\Users\Pc\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {981EBD38-9CF4-43D6-917F-8EFD65DC3C76} - System32\Tasks\{59A28418-2F35-48CC-8491-DB29133B4A07} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()

Task: {99E34A15-E072-4951-88AF-47AFBAFFADE7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {9F055FC0-CA38-4918-A35F-E6909C3003BB} - System32\Tasks\{0CA4769F-3858-49F3-9E24-950045D22EC6} => D:\support\DrvSetup.exe

Task: {9FE6EAD7-A7CA-4ADC-BDE3-78CA35F5CD32} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-07] (Adobe Systems Incorporated)

Task: {ADB9BBC4-A3DA-49FF-A644-3E893812D24D} - System32\Tasks\PileFile logon => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION

Task: {B2D48DE0-F4A7-42F9-816C-1AC56B1A8872} - System32\Tasks\DealPlyUpdate => C:\Program

Task: {B5285F3B-D7AF-45AE-9F2E-1BB7DBCFE22C} - System32\Tasks\EPUpdater => C:\Users\Pc\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe <==== ATTENTION

Task: {B7F72847-9DC9-4BB9-83F3-9AADE971AD15} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)

Task: {BDAE8D31-C31A-436B-B816-F52EBF6947BA} - System32\Tasks\{69E6A0E4-9323-4511-9F4D-F69A398016E0} => D:\support\DrvSetup.exe

Task: {BE8F4974-67DF-4139-8246-206804A585FD} - System32\Tasks\{0C835611-E4AA-47E2-B53B-38A3543F30E8} => C:\Program Files (x86)\Cossacks - Back To War\dmcr.exe

Task: {C68FBEF9-502F-4103-B36B-27B4CDCDDD95} - System32\Tasks\{DA870EE4-507F-42F9-9DFB-BB41BD1ACED8} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)

Task: {CA19F92B-7524-4334-B5E5-3F47A5A3A453} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()

Task: {D57D1710-AB16-40CD-A68E-A83485C47529} - System32\Tasks\{C02B44A9-7C7F-4B5E-87FD-8BFE74268C40} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)

Task: {EB55C353-1ABB-4AFA-91C2-31D786524836} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe [2013-08-01] (Symantec Corporation)

Task: {F04B063C-0CD8-4D1E-941D-A30B17FF7A50} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Pc\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\DSite.job => C:\Users\Pc\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-11-01 06:31 - 2013-11-01 06:31 - 02329928 _____ () C:\Users\Pc\AppData\Local\Pokki\ocdeskband_0.dll

2011-04-11 04:34 - 2011-04-11 04:34 - 00003584 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.94.193\LogicNP.PropSheetExtensionHelper_x64.dll

2011-05-10 01:56 - 2011-03-02 11:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll

2012-10-18 00:42 - 2009-03-19 21:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll

2012-10-18 00:42 - 2009-03-19 21:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll

2012-10-18 00:42 - 2009-01-15 13:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll

2012-10-18 00:42 - 2009-03-25 15:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll

2009-12-15 16:40 - 2009-12-15 16:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

2009-12-15 22:44 - 2009-12-15 22:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll

2013-08-18 17:42 - 2014-01-24 22:17 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2014-02-11 17:54 - 2011-09-01 14:50 - 00157656 _____ () C:\Program Files (x86)\PC Tools Security\NetworkLayer\PCTCFHook.dll

2014-02-11 17:54 - 2011-09-01 14:50 - 00091608 _____ () C:\Program Files (x86)\PC Tools Security\avengine\sdkBSCtrl.dll

2014-02-11 17:54 - 2011-09-01 14:51 - 01394648 _____ () C:\Program Files (x86)\PC Tools Security\UserModeFileCache.dll

2009-12-15 16:40 - 2009-12-15 16:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe

2009-12-15 16:41 - 2009-12-15 16:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe

2012-10-18 00:33 - 2009-04-29 13:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll

2012-10-18 00:33 - 2009-04-29 13:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll

2012-10-18 00:33 - 2009-04-29 13:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll

2013-09-07 03:11 - 2013-09-07 03:11 - 00569856 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\ppGoogleNaClPluginChrome.dll

2013-09-07 03:11 - 2013-09-07 03:11 - 01400846 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avcodec-54.dll

2013-09-07 03:11 - 2013-09-07 03:11 - 00151054 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avutil-51.dll

2013-09-07 03:11 - 2013-09-07 03:11 - 00222734 _____ () C:\Users\Pc\AppData\Local\Pokki\Engine\avformat-54.dll

2013-12-20 11:56 - 2013-12-20 11:56 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2011-04-07 20:54 - 2011-04-07 20:54 - 00239720 _____ () C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

AlternateDataStreams: C:\ProgramData\TEMP:430C6D84

AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\Services: AdobeARMservice => 2

MSCONFIG\Services: McComponentHostService => 3

MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2

MSCONFIG\Services: Sony PC Companion => 3

MSCONFIG\Services: TunngleService => 3

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^Pc^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk => C:\Windows\pss\GamersFirst LIVE!.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: Aeria Ignite => "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent

MSCONFIG\startupreg: ASUSWebStorage => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSPanel.exe /S

MSCONFIG\startupreg: cefbaeacdccceasacfsfdsf => "C:\ProgramData\cefbaeacdccceasacfsfdsf.exe"

MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe

MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

MSCONFIG\startupreg: HDAudDeck => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

MSCONFIG\startupreg: ISUSPM => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

MSCONFIG\startupreg: LogitechSoftwareUpdate => "C:\Program Files (x86)\Logitech\Video\ManifestEngine.exe" boot

MSCONFIG\startupreg: LogitechVideoRepair => C:\Program Files (x86)\Logitech\Video\ISStart.exe /RegAll

MSCONFIG\startupreg: LogitechVideoTray => C:\Program Files (x86)\Logitech\Video\LogiTray.exe

MSCONFIG\startupreg: Pokki => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform

MSCONFIG\startupreg: PrivitizeVPN => C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe /autorun

MSCONFIG\startupreg: QtraxNotification => C:\Users\Pc\Qtrax\Player\Notification.exe

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background

MSCONFIG\startupreg: Spotify => "C:\Users\Pc\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Pc\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun

MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent

MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

MSCONFIG\startupreg: uTorrent => "C:\Users\Pc\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED

MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"

MSCONFIG\startupreg: Xvid => C:\Program Files (x86)\Xvid\CheckUpdate.exe

MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"
 

==================== Faulty Device Manager Devices =============
 

Name: TAP-Win32 Adapter V9 (Tunngle)

Description: TAP-Win32 Adapter V9 (Tunngle)

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: TAP-Win32 Provider V9 (Tunngle)

Service: tap0901t

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: 

Description: 

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 

Name: PC Tools Data Store

Description: PC Tools Data Store

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: pctDS

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (02/11/2014 05:48:58 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (02/11/2014 03:43:11 PM) (Source: Software Protection Platform Service) (User: )

Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:

0x80080005
 

Error: (02/05/2014 01:05:13 PM) (Source: Application Hang) (User: )

Description: Programm Infestation.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 105c
 

Startzeit: 01cf22667e20cc8f
 

Endzeit: 281
 

Anwendungspfad: C:\Program Files (x86)\Steam\steamapps\common\The War Z\Infestation.exe
 

Berichts-ID:
 

Error: (02/05/2014 10:07:05 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (02/04/2014 10:22:24 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4

Name des fehlerhaften Moduls: wwanapi.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5be0a8

Ausnahmecode: 0xc0000005

Fehleroffset: 0x00000000000333eb

ID des fehlerhaften Prozesses: 0x714

Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0

Pfad der fehlerhaften Anwendung: Explorer.EXE1

Pfad des fehlerhaften Moduls: Explorer.EXE2

Berichtskennung: Explorer.EXE3
 

Error: (02/04/2014 10:15:34 PM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (02/04/2014 07:20:49 PM) (Source: VSS) (User: )

Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert

.

Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
 
 

Vorgang:

   Generatordaten werden gesammelt
 

Kontext:

   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}

   Generatorname: System Writer

   Generatorinstanz-ID: {eb0c23e6-5da4-4c15-af73-54cfc9bff500}
 

Error: (02/04/2014 06:07:56 PM) (Source: Application Hang) (User: )

Description: Programm firefox.exe, Version 26.0.0.5087 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 978
 

Startzeit: 01cf21cb7fe36447
 

Endzeit: 62
 

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

Berichts-ID: e06d2591-8dbe-11e3-badf-3085a94266a8
 

Error: (02/04/2014 06:06:17 PM) (Source: Windows Backup) (User: )

Description: Die Sicherung war nicht erfolgreich. Fehler: "Der RPC-Server ist nicht verfügbar. (0x800706BA)"
 

Error: (02/04/2014 05:33:07 PM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 
 

System errors:

=============

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Automatische WLAN-Konfiguration" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Dienst "Diagnosesystemhost" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Überwachung verteilter Verknüpfungen (Client)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Programmkompatibilitäts-Assistent-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerkverbindungen" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Zugriff auf Eingabegeräte" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Offlinedateien" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (02/11/2014 09:44:08 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows-Audio-Endpunkterstellung" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 
 

Microsoft Office Sessions:

=========================

Error: (02/11/2014 05:48:58 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Pc\Downloads\SoftonicDownloader_fuer_pc-tools-spyware-doctor-mit-antivirus-2011.exe
 

Error: (02/11/2014 03:43:11 PM) (Source: Software Protection Platform Service)(User: )

Description: 0x80080005
 

Error: (02/05/2014 01:05:13 PM) (Source: Application Hang)(User: )

Description: Infestation.exe0.0.0.0105c01cf22667e20cc8f281C:\Program Files (x86)\Steam\steamapps\common\The War Z\Infestation.exe
 

Error: (02/05/2014 10:07:05 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (02/04/2014 10:22:24 PM) (Source: Application Error)(User: )

Description: Explorer.EXE6.1.7601.175674d672ee4wwanapi.dll6.1.7600.163854a5be0a8c000000500000000000333eb71401cf21ee3eb25316C:\Windows\Explorer.EXEC:\Windows\system32\wwanapi.dll70658b1d-8de2-11e3-bd0b-3085a94266a8
 

Error: (02/04/2014 10:15:34 PM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (02/04/2014 07:20:49 PM) (Source: VSS)(User: )

Description: 0x80070005, Zugriff verweigert
 
 

Vorgang:

   Generatordaten werden gesammelt
 

Kontext:

   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}

   Generatorname: System Writer

   Generatorinstanz-ID: {eb0c23e6-5da4-4c15-af73-54cfc9bff500}
 

Error: (02/04/2014 06:07:56 PM) (Source: Application Hang)(User: )

Description: firefox.exe26.0.0.508797801cf21cb7fe3644762C:\Program Files (x86)\Mozilla Firefox\firefox.exee06d2591-8dbe-11e3-badf-3085a94266a8
 

Error: (02/04/2014 06:06:17 PM) (Source: Windows Backup)(User: )

Description: Der RPC-Server ist nicht verfügbar. (0x800706BA)
 

Error: (02/04/2014 05:33:07 PM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-02-11 21:35:50.012

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 21:35:49.887

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 21:35:16.487

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 21:35:16.378

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 17:29:57.547

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 17:29:57.438

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 17:29:25.599

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 17:29:25.489

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 16:57:44.864

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-02-11 16:57:44.755

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 43%

Total physical RAM: 8174.12 MB

Available physical RAM: 4613.23 MB

Total Pagefile: 16346.41 MB

Available Pagefile: 12342.45 MB

Total Virtual: 8192 MB

Available Virtual: 8191.78 MB
 

==================== Drives ================================
 

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:261.45 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 85EAEEE9)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

FRST.txt

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-02-2014 01

Ran by Pc (administrator) on PC-PC on 11-02-2014 22:27:43

Running from C:\Users\Pc\Desktop

Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Threat Expert Ltd.) C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe

(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe

(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsSvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(PC Tools) C:\Program Files (x86)\PC Tools Security\pctsGui.exe

(Threat Expert Ltd.) C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe

(Microsoft Corporation) C:\Windows\system32\taskmgr.exe

(AutoIt Team) C:\Users\Pc\cc4j5zs76kd2kj\SQeUDVpi.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Pokki) C:\Users\Pc\AppData\Local\Pokki\Engine\pokki.exe

(PC Tools) C:\Program Files (x86)\PC Tools Security\upgrade.exe

(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [ISTray] - C:\Program Files (x86)\PC Tools Security\pctsGui.exe [1600984 2011-09-01] (PC Tools)

HKLM-x32\...\Run: [PCTools FGuard] - C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe [247760 2011-09-01] (Threat Expert Ltd.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0

HKLM\...\Policies\Explorer: [HideSCAHealth] 0

HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0

HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Akamai NetSession Interface] - "C:\Users\Pc\AppData\Local\Akamai\netsession_win.exe"

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Load] - C:\Users\Pc\AppData\Roaming\vbc.exe [1169224 2010-11-05] (Microsoft Corporation)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Wcenter] - C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter34.exe [32768 2010-11-05] (Microsoft Corporation)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\RunOnce: [cc4j5zs76kd2kj] - C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs [190 2014-02-11] ()

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\system: [DisableTaskMgr] 1

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [NoFolderOptions] 1

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\MountPoints2: {045dbeba-7158-11e3-9483-3085a94266a8} - E:\setup.exe

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\MountPoints2: {2549caac-7476-11e2-9477-3085a94266a8} - H:\Startme.exe

AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => File Not Found

AppInit_DLLs-x32: c:\progra~2\gs-ena~1\browsafe.dll => File Not Found

Startup: C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

ShortcutTarget: start.lnk -> C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.

URLSearchHook: HKCU - ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar\tbhelper.dll ()

URLSearchHook: HKCU - PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}

SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}

SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=f0e6090c-d942-4ce4-94f4-095b9a73bb7a&searchtype=ds&q={searchTerms}&installDate=07/04/2013

SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=289500240103DCA8&affID=121963&tsp=4980

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File

BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)

BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File

BHO-x32: PC Tools Browser Guard BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKCU - No Name - {338B4DFE-2E2C-4338-9E41-E176D497299E} -  No File

DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.0.0\ViProtocol.dll No File

Winsock: Catalog9 01 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)

Winsock: Catalog9 02 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)

Winsock: Catalog9 03 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)

Winsock: Catalog9 04 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)

Winsock: Catalog9 05 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)

Winsock: Catalog9 06 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)

Winsock: Catalog9 18 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll [329688] (PC Tools Research Pty Ltd.)

Winsock: Catalog9-x64 01 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)

Winsock: Catalog9-x64 02 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)

Winsock: Catalog9-x64 03 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)

Winsock: Catalog9-x64 04 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)

Winsock: Catalog9-x64 05 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)

Winsock: Catalog9-x64 06 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)

Winsock: Catalog9-x64 18 C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp64.dll [447960] (PC Tools Research Pty Ltd.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566

FF user.js: detected! => C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js

FF NewTab: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\\npsitesafety.dll No File

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml

FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]

FF HKLM\...\Firefox\Extensions: [{77BEC163-D389-42c1-91A4-C758846296A5}] - C:\Program Files\Video downloader\Firefox

FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF

FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2014-02-11]

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []

FF HKLM-x32\...\Firefox\Extensions: [{cb84136f-9c44-433a-9048-c5cd9df1dc16}] - C:\Program Files (x86)\PC Tools Security\BDT\Firefox\

FF Extension: Browser Defender Toolbar - C:\Program Files (x86)\PC Tools Security\BDT\Firefox\ []

FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\

FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
 

Chrome: 

=======

CHR HomePage: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E

CHR RestoreOnStartup: "hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E"

CHR DefaultSearchKeyword: conduit.search

CHR DefaultSearchProvider: Conduit Search

CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}

CHR DefaultNewTabURL: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Happy Cloud Plugin) - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

CHR Plugin: (SOE Web Installer) - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()

CHR Plugin: (Pokki Download Helper) - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File

CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File

CHR Extension: (FuNDeaulls) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll [2013-12-31]

CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]

CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]

CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]

CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]

CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]

CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKLM-x32\...\Chrome\Extension: [fmfnfnpmhcllokmkepffndflpnadjmma] - C:\Program Files (x86)\DealPly\DealPly.crx [2013-07-29]

CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Pc\AppData\Local\Wajam\Chrome\wajam.crx [2012-07-26]

CHR HKLM-x32\...\Chrome\Extension: [khialnikbocfgkohdegnebhmmaifoglp] - C:\Program Files (x86)\LyricsMonkey\Chrome.crx [2012-07-26]

CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\Exts\Chrome.crx [2014-02-11]

CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx [2013-02-10]

CHR HKLM-x32\...\Chrome\Extension: [pggagllhehfjjfgnfnfkjedjlmbchamf] - C:\Users\Pc\AppData\Roaming\SeeSimilar\SeeSimilar.crx [2013-06-20]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 Browser Defender Update Service; C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe [337872 2011-09-01] (Threat Expert Ltd.)

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S4 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)

S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [275696 2013-10-08] (Symantec Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()

R2 sdAuxService; C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe [371472 2011-02-18] (PC Tools)

R2 sdCoreService; C:\Program Files (x86)\PC Tools Security\pctsSvc.exe [1117144 2011-09-01] (PC Tools)

S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)

S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]

S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service

S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140121.001\BHDrvx64.sys [1526488 2014-01-21] (Symantec Corporation)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)

S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-02-11] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-02-11] (Symantec Corporation)

R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140209.002\IDSvia64.sys [521944 2014-02-09] (Symantec Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140211.003\ENG64.SYS [126040 2014-02-11] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140211.003\EX64.SYS [2099288 2014-02-11] (Symantec Corporation)

R0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [360696 2011-08-23] (PC Tools)

R0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [452872 2010-06-29] (PC Tools)

R0 pctEFA; C:\Windows\System32\drivers\pctEFA64.sys [816016 2010-07-16] (PC Tools)

R1 PCTSD; C:\Windows\System32\Drivers\PCTSD64.sys [228392 2011-08-18] (PC Tools)

S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)

S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)

R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))

R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))

R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))

R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()

R1 SRTSP; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\NISx64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NISx64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-02-11] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\system32\drivers\NISx64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)

S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-11 22:27 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-11 22:24 - 2014-02-11 22:27 - 00031586 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-11 22:23 - 2014-02-11 22:27 - 00000000 ____D () C:\FRST

2014-02-11 22:22 - 2014-02-11 22:23 - 02151424 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable

2014-02-11 22:20 - 2014-02-11 22:20 - 00050477 _____ () C:\Users\Pc\Desktop\Defogger.exe

2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 18:03 - 2011-09-01 11:39 - 02189264 _____ (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll

2014-02-11 18:03 - 2011-09-01 11:39 - 01533904 _____ (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll

2014-02-11 18:03 - 2011-09-01 11:39 - 00149456 _____ (PC Tools) C:\Windows\SGDetectionTool.dll

2014-02-11 18:03 - 2011-09-01 11:38 - 00767952 _____ () C:\Windows\BDTSupport.dll

2014-02-11 18:03 - 2011-01-06 10:54 - 00002125 _____ () C:\Windows\UDB.zip

2014-02-11 18:03 - 2010-08-20 09:50 - 00000882 _____ () C:\Windows\RegSDImport.xml

2014-02-11 18:03 - 2010-01-22 08:44 - 00000879 _____ () C:\Windows\RegISSImport.xml

2014-02-11 18:03 - 2008-11-26 11:08 - 00000131 _____ () C:\Windows\IDB.zip

2014-02-11 17:54 - 2014-02-11 21:51 - 00000000 ____D () C:\Program Files (x86)\PC Tools Security

2014-02-11 17:54 - 2014-02-11 18:16 - 00141312 _____ (PC Tools) C:\Windows\system32\Drivers\pctwfpfilter64.sys

2014-02-11 17:54 - 2014-02-11 17:55 - 02514894 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-11 17:54 - 2014-02-11 17:54 - 00002072 _____ () C:\Users\Public\Desktop\Spyware Doctor.lnk

2014-02-11 17:54 - 2011-08-23 11:45 - 00360696 _____ (PC Tools) C:\Windows\system32\Drivers\PCTCore64.sys

2014-02-11 17:54 - 2011-08-18 09:31 - 00228392 _____ (PC Tools) C:\Windows\system32\Drivers\PCTSD64.sys

2014-02-11 17:54 - 2011-07-19 09:23 - 00092896 _____ (PC Tools) C:\Windows\system32\Drivers\pctplsg64.sys

2014-02-11 17:54 - 2011-07-19 09:18 - 00336512 _____ (PC Tools) C:\Windows\system32\Drivers\pctgntdi64.sys

2014-02-11 17:54 - 2010-07-16 14:53 - 00816016 _____ (PC Tools) C:\Windows\system32\Drivers\pctEFA64.sys

2014-02-11 17:54 - 2010-06-29 10:35 - 00452872 _____ (PC Tools) C:\Windows\system32\Drivers\pctDS64.sys

2014-02-11 17:50 - 2014-02-11 17:54 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-11 17:50 - 2014-02-11 17:50 - 00507360 _____ () C:\Users\Pc\Desktop\sdsetup_2011.exe

2014-02-11 16:55 - 2014-02-11 21:33 - 00035740 _____ () C:\Windows\PFRO.log

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00177752 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

2014-02-11 16:37 - 2014-02-11 16:37 - 00008222 _____ () C:\Windows\system32\Drivers\SYMEVENT64x86.CAT

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:37 - 2014-02-11 16:37 - 00002585 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-02-11 16:37 - 2014-02-11 16:37 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-02-11 16:35 - 2014-02-11 21:35 - 00000280 _____ () C:\Windows\Tasks\Digital Sites.job

2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites

2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites

2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Windows\system32\Drivers\NISx64

2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 16:19 - 2014-02-11 21:45 - 00000280 _____ () C:\Windows\setupact.log

2014-02-11 16:19 - 2014-02-11 16:19 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj

2014-02-04 16:14 - 2013-09-29 23:55 - 00043810 _____ () C:\Users\Pc\AppData\Roaming\poclbm130302.cl

2014-02-04 16:14 - 2013-06-12 15:15 - 00119888 _____ (Open Source Software community LGPL) C:\Users\Pc\AppData\Roaming\pthreadGC2.dll

2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll

2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:45 - 2014-02-04 13:45 - 00000134 _____ () C:\Users\Pc\Desktop\Microsoft Fix*it.url

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-04 13:09 - 2014-02-04 13:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5

2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk

2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe

2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
 

==================== One Month Modified Files and Folders =======
 

2014-02-11 22:27 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-11 22:27 - 2014-02-11 22:24 - 00031586 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-11 22:27 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST

2014-02-11 22:23 - 2014-02-11 22:22 - 02151424 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable

2014-02-11 22:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-11 22:21 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc

2014-02-11 22:20 - 2014-02-11 22:20 - 00050477 _____ () C:\Users\Pc\Desktop\Defogger.exe

2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-11 21:51 - 2014-02-11 17:54 - 00000000 ____D () C:\Program Files (x86)\PC Tools Security

2014-02-11 21:45 - 2014-02-11 16:19 - 00000280 _____ () C:\Windows\setupact.log

2014-02-11 21:36 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-02-11 21:35 - 2014-02-11 16:35 - 00000280 _____ () C:\Windows\Tasks\Digital Sites.job

2014-02-11 21:35 - 2013-05-21 18:33 - 00000274 _____ () C:\Windows\Tasks\DSite.job

2014-02-11 21:34 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-11 21:34 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-11 21:33 - 2014-02-11 16:55 - 00035740 _____ () C:\Windows\PFRO.log

2014-02-11 21:31 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-11 21:31 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites

2014-02-11 21:23 - 2014-02-04 15:05 - 00000000 _RSHD () C:\Users\Pc\aoajz

2014-02-11 21:23 - 2014-02-04 12:08 - 00000000 _RSHD () C:\Users\Pc\xripb

2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls

2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\50Coeuupons

2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC

2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki

2014-02-11 18:16 - 2014-02-11 17:54 - 00141312 _____ (PC Tools) C:\Windows\system32\Drivers\pctwfpfilter64.sys

2014-02-11 17:55 - 2014-02-11 17:54 - 02514894 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-11 17:54 - 2014-02-11 17:54 - 00002072 _____ () C:\Users\Public\Desktop\Spyware Doctor.lnk

2014-02-11 17:54 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-11 17:50 - 2014-02-11 17:50 - 00507360 _____ () C:\Users\Pc\Desktop\sdsetup_2011.exe

2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:51 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00177752 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

2014-02-11 16:37 - 2014-02-11 16:37 - 00008222 _____ () C:\Windows\system32\Drivers\SYMEVENT64x86.CAT

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:37 - 2014-02-11 16:37 - 00002585 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk

2014-02-11 16:37 - 2014-02-11 16:37 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites

2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Windows\system32\Drivers\NISx64

2014-02-11 16:35 - 2014-02-11 16:35 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security

2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG

2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle

2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java

2014-02-11 16:19 - 2014-02-11 16:19 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-11 16:17 - 2011-05-10 01:27 - 01478483 _____ () C:\Windows\WindowsUpdate.log

2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite

2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent

2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client

2014-02-11 16:03 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps

2014-02-11 16:03 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj

2014-02-11 15:34 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files

2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files

2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype

2014-02-10 18:30 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat

2014-02-10 18:30 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat

2014-02-10 18:30 - 2009-07-14 06:13 - 01651686 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt

2014-02-07 14:59 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-07 14:59 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-07 14:59 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr

2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe

2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:45 - 2014-02-04 13:45 - 00000134 _____ () C:\Users\Pc\Desktop\Microsoft Fix*it.url

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:12 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-04 13:11 - 2012-10-28 14:16 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin

2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele

2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache

2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT

2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-01-26 16:16 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe

2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}

2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft

2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment

2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify

2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify

2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5

2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk

2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe

2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler

2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-01-16 14:30 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT

2014-01-16 14:24 - 2012-10-18 05:30 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 

Files to move or delete:

====================

C:\ProgramData\cefbaeacdccceasacfsfdsf.exe

C:\ProgramData\libnspr4.dll
 
 

Some content of TEMP:

====================

C:\Users\Pc\AppData\Local\Temp\27132-673656-spyware-doctor.exe

C:\Users\Pc\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-02-11 14:00
 

==================== End Of Log ============================

--- --- ---

Ich habe zu viele Zeichen benutzt, weshalb ich die Log von Malwarebyte und Gmer.txt nicht reinstellen kann.

sunjojo

12.02.2014 10:34

:hallo:

Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld :)

Redblood

12.02.2014 10:38

Vielen Dank. Da jemand nun geantwortet hat, werde ich jetzt auch noch die anderen Logs reinstellen.

Gmer.txt

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-02-12 09:15:52

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Hitachi_HUA721010KLA330 rev.GKAOAB0A 931,51GB

Running: pn49km1w.exe; Driver: C:\Users\Pc\AppData\Local\Temp\pgldapog.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text    C:\Windows\SysWOW64\svchost.exe[1064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                  00000000759e1465 2 bytes [9E, 75]

.text    C:\Windows\SysWOW64\svchost.exe[1064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                 00000000759e14bb 2 bytes [9E, 75]

.text    ...                                                                                                                                                            * 2

.text    C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                           00000000759e1465 2 bytes [9E, 75]

.text    C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                          00000000759e14bb 2 bytes [9E, 75]

.text    ...                                                                                                                                                            * 2

.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  00000000759e1465 2 bytes [9E, 75]

.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe[2468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                 00000000759e14bb 2 bytes [9E, 75]

.text    ...                                                                                                                                                            * 2

.text    C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe[2876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          00000000759e1465 2 bytes [9E, 75]

.text    C:\Program Files (x86)\PC Tools Security\BDT\FGuard.exe[2876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         00000000759e14bb 2 bytes [9E, 75]

.text    ...                                                                                                                                                            * 2

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe[680] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                         00000000759e1465 2 bytes [9E, 75]

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe[680] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                        00000000759e14bb 2 bytes [9E, 75]

.text    ...                                                                                                                                                            * 2

.text    C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                00000000759e1465 2 bytes [9E, 75]

.text    C:\Program Files (x86)\PC Tools Security\BDT\BDTUpdateService.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                               00000000759e14bb 2 bytes [9E, 75]

.text    ...                                                                                                                                                            * 2

.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                        0000000074611a22 2 bytes [61, 74]

.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                        0000000074611ad0 2 bytes [61, 74]

.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                        0000000074611b08 2 bytes [61, 74]

.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                        0000000074611bba 2 bytes [61, 74]

.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                        0000000074611bda 2 bytes [61, 74]

.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                 00000000759e1465 2 bytes [9E, 75]

.text    C:\Windows\SysWOW64\PnkBstrA.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                00000000759e14bb 2 bytes [9E, 75]

.text    ...                                                                                                                                                            * 2

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWaitForSingleObject                                             000000007751f8bc 5 bytes JMP 0000000176de0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtReadFile                                                        000000007751f8f0 5 bytes JMP 00000001770c0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                       000000007751f928 5 bytes JMP 00000001770e0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                           000000007751f9e0 5 bytes JMP 0000000177040000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryObject                                                     000000007751f9f8 5 bytes JMP 0000000176ae0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationFile                                            000000007751fa10 5 bytes JMP 0000000177060000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                         000000007751fa28 5 bytes JMP 0000000176c60000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                               000000007751fa40 5 bytes JMP 0000000176d00000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey                                                        000000007751fa90 5 bytes JMP 0000000176c20000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                   000000007751faa8 5 bytes JMP 0000000176be0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryInformationProcess                                         000000007751fad8 5 bytes JMP 0000000176a60000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                       000000007751fb40 5 bytes JMP 0000000176d80000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                              000000007751fc38 5 bytes JMP 0000000177080000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                000000007751fc50 5 bytes JMP 0000000176f80000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                              000000007751fc80 5 bytes JMP 0000000176f40000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey                                                    000000007751fd4c 5 bytes JMP 0000000176d20000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                        000000007751fd64 5 bytes JMP 00000001774f0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                              000000007751fd98 5 bytes JMP 0000000176ea0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                     000000007751fdc8 5 bytes JMP 0000000177000000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFsControlFile                                                   000000007751fdf8 5 bytes JMP 0000000176e20000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                 000000007751fe44 5 bytes JMP 0000000176f20000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile                                             000000007751fe5c 5 bytes JMP 0000000176fc0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryVolumeInformationFile                                      000000007751ff8c 2 bytes JMP 0000000176ee0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryVolumeInformationFile + 3                                  000000007751ff8f 2 bytes [9C, FF]

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                   000000007751ffa4 2 bytes JMP 0000000177020000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection + 3                                               000000007751ffa7 2 bytes [B0, FF]

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushBuffersFile                                                000000007751ffbc 2 bytes JMP 0000000176e40000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushBuffersFile + 3                                            000000007751ffbf 2 bytes [92, FF]

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQuerySection                                                    0000000077520050 5 bytes JMP 0000000176f60000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                      00000000775200b4 5 bytes JMP 00000001774d0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtWaitForMultipleObjects                                          0000000077520148 5 bytes JMP 0000000176dc0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                     00000000775201c4 5 bytes JMP 0000000176b40000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheck                                                     0000000077520228 5 bytes JMP 0000000176a20000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                      00000000775209e4 5 bytes JMP 00000001770a0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                       00000000775209fc 5 bytes JMP 0000000176d60000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                  0000000077520a44 5 bytes JMP 0000000176d40000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtExtendSection                                                   0000000077520b1c 5 bytes JMP 0000000176da0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey                                                        0000000077520b80 5 bytes JMP 0000000176ce0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFlushVirtualMemory                                              0000000077520bb4 5 bytes JMP 0000000176fe0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLoadKey                                                         0000000077520e0c 5 bytes JMP 0000000176cc0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLoadKey2                                                        0000000077520e24 5 bytes JMP 0000000176ca0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtLockFile                                                        0000000077520e54 5 bytes JMP 0000000176e80000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeDirectoryFile                                       0000000077520f58 5 bytes JMP 0000000176e00000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey                                                 0000000077520f70 5 bytes JMP 0000000176c80000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx                                                       0000000077521018 5 bytes JMP 0000000176c40000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile                                         000000007752133c 5 bytes JMP 0000000176f00000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey                                           000000007752147c 5 bytes JMP 0000000176c00000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject                                             0000000077521528 5 bytes JMP 0000000176a40000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey                                                       0000000077521718 5 bytes JMP 0000000176b00000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtReplaceKey                                                      0000000077521748 5 bytes JMP 0000000176bc0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtRestoreKey                                                      00000000775217e0 5 bytes JMP 0000000176ba0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSaveKey                                                         0000000077521874 5 bytes JMP 0000000176b80000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey                                               0000000077521a58 5 bytes JMP 0000000176b60000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject                                               0000000077521b9c 5 bytes JMP 0000000176fa0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetVolumeInformationFile                                        0000000077521c9c 5 bytes JMP 0000000176ec0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnloadKey                                                       0000000077521e70 5 bytes JMP 0000000176b20000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtUnlockFile                                                      0000000077521eb8 5 bytes JMP 0000000176e60000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!RtlQueryInformationActivationContext                              000000007753ba2c 5 bytes JMP 0000000176ac0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                        000000007753c4dd 5 bytes JMP 0000000176aa0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                      0000000077541287 5 bytes JMP 0000000176a80000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateProcessW                                                 000000007575103d 5 bytes JMP 00000001756f0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateProcessA                                                 0000000075751072 5 bytes JMP 0000000175710000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!CreateActCtxW                                                  00000000757591e7 5 bytes JMP 0000000175730000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\kernel32.dll!WinExec                                                        00000000757d2c51 5 bytes JMP 00000001755d0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserW                                           00000000763ec532 5 bytes JMP 00000001763d0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!EncryptFileW                                                   00000000764228f8 5 bytes JMP 00000001763b0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ADVAPI32.dll!DecryptFileW                                                   0000000076422947 5 bytes JMP 0000000176390000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject                                             0000000075f921e1 5 bytes JMP 0000000175f70000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoGetClassObject                                                  0000000075fb54ad 5 bytes JMP 0000000175ed0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                  0000000075fc9d0b 5 bytes JMP 0000000175f10000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                0000000075fc9d4e 5 bytes JMP 0000000175ef0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject                                               000000007600eacf 5 bytes JMP 0000000175f50000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoFreeUnusedLibraries                                             0000000076010cc2 5 bytes JMP 0000000175f30000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\ole32.dll!CoRegisterSurrogate                                               00000000760609bf 5 bytes JMP 0000000175eb0000

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                         00000000759e1465 2 bytes [9E, 75]

.text    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe[2216] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                        00000000759e14bb 2 bytes [9E, 75]

.text    ...                                                                                                                                                            * 2
 

---- Trace I/O - GMER 2.1 ----
 

Trace    ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore64.sys ACPI.sys >>UNKNOWN [0xfffffa8007a16d90]<< sfsync04.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys   fffffa8007a16d90

Trace    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007a2c790]                                                                                                fffffa8007a2c790

Trace    3 CLASSPNP.SYS[fffff88001c0143f] -> nt!IofCallDriver -> [0xfffffa800799a940]                                                                                   fffffa800799a940

Trace    5 PCTCore64.sys[fffff88001287a40] -> nt!IofCallDriver -> [0xfffffa800798d9b0]                                                                                  fffffa800798d9b0

Trace    7 ACPI.sys[fffff88000f177a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa8006ab3680]                                                          fffffa8006ab3680

Trace    \Driver\atapi[0xfffffa8006adf3a0] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0xfffffa8007a16d90                                                                      fffffa8007a16d90
 

---- Threads - GMER 2.1 ----
 

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4772]                                                                                           000000000066ca30

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4776]                                                                                           000000000066c3c0

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4780]                                                                                           000000000066c3c0

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4784]                                                                                           000000000066c3c0

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4788]                                                                                           000000000066c3c0

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4760]                                                                                           000000000066c3c0

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4796]                                                                                           000000000066c3c0

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4800]                                                                                           000000000066c3c0

Thread   C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216:4812]                                                                                           000000000066c3c0

---- Processes - GMER 2.1 ----
 

Library  :\{9019ACD6-BC11-4308-8C49-92E0601DF38D}\temp\2216\bxsdk32.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]         0000000010000000

Library  C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]                 0000000013900000

Library  C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]              0000000011000000

Library  C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]              0000000013800000

Library  C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll (*** suspicious ***) @ C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe [2216]                  0000000013000000
 

---- Registry - GMER 2.1 ----
 

Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001fcf206b16                                                                                    

Reg      HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export                                                                                        ????FA?????????????????????????????????????????????????????????????????{??????????????????????-AC58-425A-A466-AA544D7B3A97}"?"??? ???????|???????????u?:????????????&????????????????????????????????2?????e??????T??????????????d??????????????????????????????????????? ???????|?????????????:????????????&????????????????????8??? ??????????????????????????????????????wvmbus.inf_amd64_neutral_f6b968c04185b840???.NT??????????????????????????????????????????????????????i??????????????? ???????n??????????????????????????&????????????????????4??????? ?????????????????????0????????????&???????????????????????? ?????????????????????0????????????????????? ???????????????????j?0????????????????????? ???????? ????????????0????????????&???????????????????????? ?????????????????????0?????????????????????????E??? ???????????????????j?0????????????????????????????? ?????????????????????0????????????&????????????????????-??? ?????????????????????0????????????????????????????? ?????????????????????0???????????????????????????????

Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001fcf206b16 (not active ControlSet)                                                                
 

---- EOF - GMER 2.1 ----

Malwarebyte

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2014.02.11.08
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

Pc :: PC-PC [Administrator]
 

Schutz: Aktiviert
 

11.02.2014 21:03:15

mbam-log-2014-02-11 (21-03-15).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 250063

Laufzeit: 18 Minute(n), 36 Sekunde(n)
 

Infizierte Speicherprozesse: 1

C:\Users\Pc\AppData\Local\Temp\ba58Installer.exe (PUP.Optional.Vittalia) -> 2284 -> Löschen bei Neustart.
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 64

HKCR\CLSID\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\AppID\{562B9316-C08A-444A-9482-62080DD851AE} (PUP.Optional.SpeedAnalysis3.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\AppID\{685F23D9-FCFD-475C-B56A-362645945C5A} (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{291BCCC1-6890-484a-89D3-318C928DAC1B} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\esrv.BabylonESrvc.1 (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\esrv.BabylonESrvc (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5} (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\wajam.WajamDownloader.1 (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\wajam.WajamDownloader (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\b (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Typelib\{6E8BF012-2C85-4834-B10A-1B31AF173D70} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252} (PUP.Optional.GreatSaver.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF987D06-1DCF-7B36-5B43-13BC8699C44C} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DSite (PUP.Optional.DigitalSites.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\esrv.ividiESrvc (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\esrv.ividiESrvc.1 (PUP.Optional.iVIDI.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ividi.ividiappCore (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ividi.ividiappCore.1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\AppID\priam_bho.DLL (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\BabylonToolbar (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\SmartbarBackup (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\SmartbarLog (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\delta LTD (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\iVIDI Plugin (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\Google\Chrome\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl (PUP.Optional.SmartBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\WAJAM (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\BabylonToolbar (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Google\chrome\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Vittalia\AxtanInstaller (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{211B330A-499B-415E-B1F1-B7132A8751D2} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{D18734A5-B131-4335-A3E0-15FF90AC90EE} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\i (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{905E34C2-F4EB-49BE-A36B-47692CF957A8} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\CLSID\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ividi.ividiHlpr.1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\ividi.ividiHlpr (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8B8B2E80-1444-451D-AC8E-EB9A847F3887} (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 9

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|22857 (Spyware.Zbot.ED) -> Daten: c:\progra~3\msxcjos.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Wcenter (Trojan.Agent) -> Daten: C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter11.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\DealPly|Partner (PUP.Optional.DealPly.A) -> Daten: iron -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoFolderOptions (Hijack.FolderOptions) -> Daten: 1 -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\Mozilla\Firefox\Extensions|{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2} (PUP.Optional.Wajam.A) -> Daten: C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCU\Software\Wajam|affiliate_id (PUP.Optional.Wajam.A) -> Daten: 6447 -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\DealPly|ChromeCrxPath (PUP.Optional.DealPly.A) -> Daten: C:\Program Files (x86)\DealPly\DealPly.crx -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 2

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Conduit.A) -> Bösartig: (hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
 

Infizierte Verzeichnisse: 19

C:\Users\Pc\AppData\Roaming\Unitech LLC (PUP.Optional.Unitech.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Documents\PCSpeedUp (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Documents\PCSpeedUp\RestorePoints (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Documents\PCSpeedUp\ScanResults (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsFinder (PUP.Optional.AddLyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey\FF (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey\FF\chrome (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey\FF\chrome\content (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Mysearchdial (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\bh (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1 (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\YoutubeAdblocker (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 105

C:\Users\Pc\AppData\Local\Temp\ba58Installer.exe (PUP.Optional.Vittalia) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\msxcjos.exe (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\50Coeuupons\gKoa.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\FuNDeaulls\DD2qL.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz15FC.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz16DA.tmp (Trojan.ExploitDrop.BV) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz1DE9.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz25E6.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz2DE3.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz2E12.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz35DF.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz360F.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz3E0C.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz4608.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz4E24.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz5611.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz5E0E.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz603.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz660A.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz6E07.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz7613.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz7E10.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz861C.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz8E19.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz9615.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trz9E31.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzA62E.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzAE2A.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzB637.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzBE24.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzC630.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzCE1D.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzD619.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzDE16.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzE00.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzE613.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzE7BF.tmp (Trojan.ExploitDrop.BV) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzEE00.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\trzFE7.tmp (Trojan.Ransom.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\50Coeuupons\gKoa.exe (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\50Coeuupons\gKoa.x64.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\FuNDeaulls\DD2qL.x64.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\ProgramData\InstallMate\{FA676CA0-EE7A-4B03-A9E8-A65821844E56}\Custom.dll (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\libcurl-4.dll (Trojan.Miner) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe (PUP.Optional.DigitalSites.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Temp\instloffer.exe (PUP.Optional.Vittalia) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\msntoz.exe (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\aoajz\vfYREdWoH.exe (Misused.Legit.AI) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\Blade_.exe (PUP.Optional.ToolBarInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\Europa Universalis IV-FLT.exe (PUP.Optional.InstalleRex) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\LOL Replay provided through GetNow.exe (PUP.Optional.LiveSoftAction.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\Lord_of_the_Rings-Battle_for_Middle-Earth_II_secure.exe (PUP.Optional.Topmedia) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\My flower collection(1).rar (Hacktool.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\My flower collection.rar (Hacktool.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe (PUP.Optional.FilePile.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\Rust_hack steam undetected by VAC.zip (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\SoftonicDownloader_for_instagram-downloader.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\SoftonicDownloader_fuer_pc-tools-spyware-doctor-mit-antivirus-2011.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\SoftonicDownloader_fuer_rome-total-war-barbarian-invasion.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\SoftonicDownloader_per_yu-gi-oh-online-3.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\swords and sandals 3 multiplae ultratus setup.exe (PUP.Optional.AdBundle) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Downloads\YTDSetup_3.9.3.exe (PUP.Optional.MyEmoticons.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\xripb\UPlCliaaJ.exe (Misused.Legit.AI) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Windows\Installer\875b1.msi (PUP.Optional.SmartBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.exe (Trojan.Dropper.SFX) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\Unitech LLC\sqlite3.dll (PUP.Optional.Unitech.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\Microsoft\Wcenter11.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\config.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\info.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\phatk121016.cl (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\scrypt130511.cl (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\mysearchdial_speedial_v9.0.2.crx (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\Documents\PCSpeedUp\App.log (PUP.Optional.PCSpeedUp.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey\chrome.manifest (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey\FF\chrome.manifest (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey\FF\install.rdf (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey\FF\chrome\content\icon.png (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\LyricsMonkey\FF\chrome\content\overlay.xul (PUP.Optional.LyricsMonkey.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Mysearchdial\uninst.dat (PUP.Optional.MySearchDial.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk (PUP.Optional.Wajam.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividi.crx (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividiApp.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividiEng.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\ividisrv.exe (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\uninstall.exe (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\Unitech LLC\ividi\1.8.23.0\bh\ividi.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\appCntrl.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\bg.html (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\bg.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\CrmAdpt.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\ct.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\CTB.dll (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\dpk.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\hprtkMsg.htm (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\hprtkMsg.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\json2.min.js (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\logo.png (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\manifest.json (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_1\pref.json (PUP.Optional.Ividi.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\YoutubeAdblocker\3ooCV2jP.dat (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Program Files (x86)\YoutubeAdblocker\3ooCV2jP.tlb (PUP.Optional.Multiplug) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

protection log

Code:

2014/02/11 20:59:27 +0100        PC-PC        Pc        MESSAGE        Starting protection

2014/02/11 20:59:27 +0100        PC-PC        Pc        MESSAGE        Protection started successfully

2014/02/11 20:59:27 +0100        PC-PC        Pc        MESSAGE        Starting IP protection

2014/02/11 20:59:39 +0100        PC-PC        Pc        MESSAGE        IP Protection started successfully

2014/02/11 20:59:47 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49302, Process: cvtres.exe)

2014/02/11 20:59:47 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 28769, Process: svchost.exe)

2014/02/11 20:59:47 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)

2014/02/11 20:59:56 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)

2014/02/11 20:59:56 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50335, Process: cvtres.exe)

2014/02/11 20:59:56 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)

2014/02/11 20:59:56 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50336, Process: cvtres.exe)

2014/02/11 20:59:56 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)

2014/02/11 21:00:00 +0100        PC-PC        Pc        MESSAGE        Starting database refresh

2014/02/11 21:00:00 +0100        PC-PC        Pc        MESSAGE        Stopping IP protection

2014/02/11 21:00:02 +0100        PC-PC        Pc        MESSAGE        IP Protection stopped successfully

2014/02/11 21:00:07 +0100        PC-PC        Pc        MESSAGE        Database refreshed successfully

2014/02/11 21:00:07 +0100        PC-PC        Pc        MESSAGE        Starting IP protection

2014/02/11 21:00:09 +0100        PC-PC        Pc        MESSAGE        IP Protection started successfully

2014/02/11 21:01:11 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50343, Process: cvtres.exe)

2014/02/11 21:01:12 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50373, Process: cvtres.exe)

2014/02/11 21:01:12 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50381, Process: cvtres.exe)

2014/02/11 21:01:20 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50385, Process: cvtres.exe)

2014/02/11 21:01:36 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50396, Process: cvtres.exe)

2014/02/11 21:02:08 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50405, Process: cvtres.exe)

2014/02/11 21:03:03 +0100        PC-PC        Pc        MESSAGE        Executing scheduled update:  Daily

2014/02/11 21:03:08 +0100        PC-PC        Pc        MESSAGE        Database already up-to-date

2014/02/11 21:03:12 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50413, Process: cvtres.exe)

2014/02/11 21:05:22 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50425, Process: cvtres.exe)

2014/02/11 21:06:11 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)

2014/02/11 21:06:59 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 50343, Process: svchost.exe)

2014/02/11 21:08:44 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50446, Process: cvtres.exe)

2014/02/11 21:11:54 +0100        PC-PC        Pc        DETECTION        C:\ProgramData\msxcjos.exe        Spyware.Zbot.ED        QUARANTINE

2014/02/11 21:12:07 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50474, Process: cvtres.exe)

2014/02/11 21:12:07 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 49302, Process: svchost.exe)

2014/02/11 21:12:56 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: incoming, Port: 50343, Process: svchost.exe)

2014/02/11 21:15:23 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50480, Process: cvtres.exe)

2014/02/11 21:18:46 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50507, Process: cvtres.exe)

2014/02/11 21:22:03 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50523, Process: cvtres.exe)

2014/02/11 21:25:27 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50535, Process: cvtres.exe)

2014/02/11 21:28:40 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 50550, Process: cvtres.exe)

2014/02/11 21:31:09 +0100        PC-PC        Pc        DETECTION        C:\ProgramData\msxcjos.exe        Spyware.Zbot.ED        QUARANTINE

2014/02/11 21:35:58 +0100        PC-PC        Pc        MESSAGE        Starting protection

2014/02/11 21:35:58 +0100        PC-PC        Pc        MESSAGE        Protection started successfully

2014/02/11 21:35:58 +0100        PC-PC        Pc        MESSAGE        Starting IP protection

2014/02/11 21:35:59 +0100        PC-PC        Pc        MESSAGE        IP Protection started successfully

2014/02/11 21:38:57 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49180, Process: cvtres.exe)

2014/02/11 21:38:57 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49181, Process: cvtres.exe)

2014/02/11 21:39:05 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49182, Process: cvtres.exe)

2014/02/11 21:39:13 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49183, Process: cvtres.exe)

2014/02/11 21:39:30 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49184, Process: cvtres.exe)

2014/02/11 21:40:59 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49215, Process: cvtres.exe)

2014/02/11 21:43:09 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49250, Process: cvtres.exe)

2014/02/11 21:45:27 +0100        PC-PC        Pc        DETECTION        C:\Users\Pc\Downloads\installer_spyware_doctor_9_0_0_2308_Deutsch.exe        PUP.Optional.Vittalia        QUARANTINE

2014/02/11 21:46:16 +0100        PC-PC        Pc        DETECTION        c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe        PUP.Optional.Vittalia        QUARANTINE

2014/02/11 21:46:16 +0100        PC-PC        Pc        ERROR        Quarantine failed:  SDKQuarantine failed with error code 2

2014/02/11 21:46:24 +0100        PC-PC        Pc        DETECTION        c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe        PUP.Optional.Vittalia        QUARANTINE

2014/02/11 21:46:24 +0100        PC-PC        Pc        ERROR        Quarantine failed:  SDKQuarantine failed with error code 2

2014/02/11 21:46:30 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49273, Process: cvtres.exe)

2014/02/11 21:47:20 +0100        PC-PC        Pc        DETECTION        c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe        PUP.Optional.Vittalia        QUARANTINE

2014/02/11 21:47:20 +0100        PC-PC        Pc        ERROR        Quarantine failed:  SDKQuarantine failed with error code 2

2014/02/11 21:48:30 +0100        PC-PC        Pc        DETECTION        c:\users\pc\downloads\installer_spyware_doctor_9_0_0_2308_deutsch.exe        PUP.Optional.Vittalia        QUARANTINE

2014/02/11 21:48:31 +0100        PC-PC        Pc        ERROR        Quarantine failed:  SDKQuarantine failed with error code 2

2014/02/11 21:49:51 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49302, Process: cvtres.exe)

2014/02/11 22:06:12 +0100        PC-PC        Pc        DETECTION        C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe        HackTool.Wpakill        QUARANTINE

2014/02/11 22:06:29 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49434, Process: cvtres.exe)

2014/02/11 22:08:40 +0100        PC-PC        Pc        DETECTION        C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe        HackTool.Wpakill        QUARANTINE

2014/02/11 22:09:23 +0100        PC-PC        Pc        DETECTION        C:\Users\Pc\Desktop\Downloads\Cracks\win 7\Wat\RemoveWAT.2.2.7.0 softwarespro.com\RemoveWAT.2.2.7.0.exe        HackTool.Wpakill        QUARANTINE

2014/02/11 22:09:49 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49455, Process: cvtres.exe)

2014/02/11 22:13:10 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49524, Process: cvtres.exe)

2014/02/11 22:16:30 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49610, Process: cvtres.exe)

2014/02/11 22:19:51 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49708, Process: cvtres.exe)

2014/02/11 22:23:11 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49726, Process: cvtres.exe)

2014/02/11 22:26:32 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49732, Process: cvtres.exe)

2014/02/11 22:29:53 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49739, Process: cvtres.exe)

2014/02/11 22:33:14 +0100        PC-PC        Pc        IP-BLOCK        37.221.163.19 (Type: outgoing, Port: 49743, Process: cvtres.exe)

2014/02/11 22:34:34 +0100        PC-PC        Pc        MESSAGE        Stopping protection

2014/02/11 22:34:34 +0100        PC-PC        Pc        MESSAGE        Protection stopped successfully

2014/02/11 22:34:34 +0100        PC-PC        Pc        MESSAGE        Stopping IP protection

2014/02/11 22:34:35 +0100        PC-PC        Pc        MESSAGE        IP Protection stopped successfully

2014/02/11 22:34:36 +0100        PC-PC        Pc        MESSAGE        Protection stopped

sunjojo

12.02.2014 18:39

Lesestoff:
Banking-Trojaner
Wenn du mit diesem Computer beispielsweise Onlinebanking machst, dann solltest du zumindest dein Passwort von deiner Bank ändern lassen, wenn du ein ansonsten sicheres Verfahren wie beispielsweise "chip-TAN-comfort" nutzt. Hast du noch alte TAN-Bögen auf Papierbasis? Dann ist es höchste Zeit dich bei deiner Bank zu melden und notfalls das Konto temporär sperren zu lassen. Der Sperrnotruf 116 116 von www.sperr-notruf.de kann Tag und Nacht dafür benutzt werden.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

cmd: type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs"

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 3
Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

Poste folgende Logfiles in deiner nächsten Antwort:

FRST-Fix
Combofix-Scan
FSS-Scan

Redblood

12.02.2014 22:22

Ich hatte Probleme bei Combofix. Immer wenn 50% erreicht wurden, erhielt ich einen Bluescreen und der Pc wurde neu gestartet. Also habe ich die Anwendung im abgesicherten Modus gestartet und dann ging es auch.

Folgendes hat sich verbessert:
-Taskmanager lässt sich nun starten
-Sicherheitscenter bleibt aktiviert
-Cvtres.exe stellt keine Verbindung mehr auf Websiten her
-Läuft Spürbar schneller

Folgende Probleme bestehen noch:
-Windows Defender lässt sich weiterhin nicht starten
-hohe CPU Auslastung wenn es anspruchsvoller wird, z.B wenn ich youtube öffne, wo man Flash benutzt. Der Browser hängt sich auf und möchte anschließend ein Skript beenden.
-svchost.exe hat permanent 150.000 K und Firefox 250.000 K. Ob das unnormal ist, weiß ich nicht.

Nun die Logs:

Fixlog

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-02-2014 01

Ran by Pc at 2014-02-12 18:54:45 Run:1

Running from C:\Users\Pc\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

cmd: type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs"

         

*****************
 
 

=========  type "C:\Users\Pc\cc4j5zs76kd2kj\92050.vbs" =========
 

const Hidden = 0

const WaitOnReturn = true

File ="C:\Users\Pc\cc4j5zs76kd2kj\87080.cmd"

set WshShell = CreateObject("WScript.Shell")

WshShell.Run file, Hidden, WaitOnReturn

wscript.quit

========= End of CMD: =========
 
 

==== End of Fixlog ====

Combofix

Code:

ComboFix 14-02-12.01 - Pc 12.02.2014  19:47:01.1.6 - x64 MINIMAL

Microsoft Windows 7 Enterprise   6.1.7601.1.1252.49.1031.18.8174.7341 [GMT 1:00]

ausgeführt von:: c:\users\Pc\Desktop\ComboFix.exe

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\CFLog

c:\cflog\EPLog.txt

C:\install.exe

c:\program files (x86)\VLC Media Player DB Toolbar Toolbar\tbHElper.dll

c:\programdata\cefbaeacdccceac.cfg

c:\programdata\cefbaeacdccceasacfsfdsf.exe

c:\programdata\libnspr4.dll

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json

c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json

c:\users\ASPNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json

c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\background.html

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\content.js

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\lsdb.js

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\manifest.json

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\knibncfcfgbfphbcogcgadggechmcjpj\1.0\nTLmEXxb3b.js

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\background.html

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\content.js

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\lsdb.js

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\manifest.json

c:\users\HomeGroupUser$\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakjkbpcfoccpgfiipnlgdcjhcphpkai\2.7\nAt4RipyWxL.js

c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll

c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\background.html

c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\content.js

c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\E4Apsx8.js

c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\lsdb.js

c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimkiigpdkahjnigfhahhebfencphpll\2.2\manifest.json

c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eimkiigpdkahjnigfhahhebfencphpll_0.localstorage

c:\users\Pc\AppData\Local\Google\Chrome\User Data\Default\Preferences

c:\users\Pc\AppData\Roaming\Microsoft\Wcenter42.exe

c:\users\Pc\AppData\Roaming\Microsoft\Wcenter9.exe

c:\users\Pc\AppData\Roaming\poclbm130302.cl

c:\windows\SysWow64\frapsvid.dll

c:\windows\SysWow64\SET7022.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-01-12 bis 2014-02-12  ))))))))))))))))))))))))))))))

.

.

2014-02-12 18:59 . 2014-02-12 18:59        --------        d-----w-        c:\users\hedev\AppData\Local\temp

2014-02-12 18:59 . 2014-02-12 18:59        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-02-12 13:12 . 2014-02-12 13:12        --------        d-----w-        c:\program files (x86)\DLLSuite

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\users\Pc\AppData\Roaming\DriverCure

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\users\Pc\AppData\Roaming\ParetoLogic

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\program files (x86)\Common Files\ParetoLogic

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\programdata\ParetoLogic

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\program files (x86)\ParetoLogic

2014-02-11 21:23 . 2014-02-12 17:54        --------        d-----w-        C:\FRST

2014-02-11 20:23 . 2014-02-11 21:00        --------        d-----w-        c:\programdata\SecTaskMan

2014-02-11 20:22 . 2014-02-11 20:23        --------        d-----w-        c:\program files (x86)\Security Task Manager

2014-02-11 20:03 . 2014-02-11 20:03        --------        d-----w-        c:\users\Pc\AppData\Roaming\TestApp

2014-02-11 16:50 . 2014-02-11 16:54        --------        d-----w-        c:\programdata\PC Tools

2014-02-11 15:54 . 2014-02-11 15:54        --------        d-----w-        c:\programdata\SMR410

2014-02-11 15:50 . 2014-02-11 16:34        --------        d-----w-        c:\users\Pc\AppData\Local\NPE

2014-02-11 15:35 . 2014-02-12 18:44        --------        d-----w-        c:\program files (x86)\Norton Internet Security

2014-02-11 15:35 . 2014-02-11 20:23        --------        d-----w-        c:\users\Pc\AppData\Roaming\DigitalSites

2014-02-11 15:34 . 2014-02-11 15:34        --------        d-s---w-        c:\windows\SysWow64\Microsoft

2014-02-11 15:30 . 2013-12-18 20:09        96168        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2014-02-11 14:59 . 2014-02-11 14:59        --------        d-----w-        c:\users\Pc\AppData\Roaming\Oxy

2014-02-11 14:34 . 2014-02-11 14:34        --------        d-sh--r-        c:\users\Pc\cc4j5zs76kd2kj

2014-02-04 15:14 . 2013-06-12 14:15        119888        ----a-w-        c:\users\Pc\AppData\Roaming\pthreadGC2.dll

2014-02-04 15:14 . 2013-06-12 14:15        100864        ----a-w-        c:\users\Pc\AppData\Roaming\zlib1.dll

2014-02-04 14:05 . 2014-02-11 20:23        --------        d-sh--r-        c:\users\Pc\aoajz

2014-02-04 12:09 . 2014-02-04 12:12        --------        d-----w-        c:\users\Pc\AppData\Roaming\Riot Games

2014-02-04 11:08 . 2014-02-11 20:23        --------        d-sh--r-        c:\users\Pc\xripb

2014-01-31 09:18 . 2013-12-04 03:28        10315576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{BA7BA143-B6AE-460D-B6C1-7DFC7B384AA7}\mpengine.dll

2014-01-21 09:23 . 2014-02-04 11:20        --------        d-----w-        c:\users\Pc\AppData\Local\CyberGhost

2014-01-21 09:22 . 2014-01-21 09:23        --------        d-----w-        c:\program files\TAP-Windows

2014-01-21 09:22 . 2014-01-21 09:27        --------        d-----w-        c:\program files\CyberGhost 5

2014-01-15 12:29 . 2013-11-27 01:41        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2014-01-15 12:29 . 2013-11-27 01:41        99840        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2014-01-15 12:29 . 2013-11-27 01:41        53248        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2014-01-15 12:29 . 2013-11-27 01:41        325120        ----a-w-        c:\windows\system32\drivers\usbport.sys

2014-01-15 12:29 . 2013-11-27 01:41        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2014-01-15 12:29 . 2013-11-27 01:41        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2014-01-15 12:29 . 2013-11-27 01:41        7808        ----a-w-        c:\windows\system32\drivers\usbd.sys

2014-01-15 12:29 . 2013-11-26 10:32        3156480        ----a-w-        c:\windows\system32\win32k.sys

2014-01-15 12:29 . 2013-11-26 11:40        376768        ----a-w-        c:\windows\system32\drivers\netio.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-02-12 07:31 . 2012-10-19 16:25        419840        ----a-w-        c:\windows\system32\systemcpl.dll

2014-02-12 07:31 . 2012-10-19 16:25        14848        ----a-w-        c:\windows\system32\slwga.dll

2014-02-12 07:31 . 2012-10-19 16:25        13824        ----a-w-        c:\windows\SysWow64\slwga.dll

2014-02-12 07:31 . 2012-10-19 16:25        1008640        ----a-w-        c:\windows\system32\user32.dll

2014-02-12 07:31 . 2012-10-19 16:25        833024        ----a-w-        c:\windows\SysWow64\user32.dll

2014-02-07 13:59 . 2012-12-10 17:25        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-02-07 13:59 . 2012-12-10 17:25        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-02-05 11:36 . 2013-12-28 10:49        291128        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr

2014-02-05 11:36 . 2013-08-18 16:42        291128        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe

2014-02-04 14:46 . 2013-08-18 16:42        291128        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0

2014-01-24 21:17 . 2013-08-18 16:42        76888        ----a-w-        c:\windows\SysWow64\PnkBstrA.exe

2014-01-16 13:24 . 2012-10-18 04:30        86054176        ----a-w-        c:\windows\system32\MRT.exe

2013-12-30 13:47 . 2013-12-30 13:47        283064        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys

2013-12-18 05:13 . 2012-11-06 16:48        270496        ------w-        c:\windows\system32\MpSigStub.exe

2013-12-06 22:07 . 2013-12-06 22:07        78432        ----a-w-        c:\windows\system32\atimpc64.dll

2013-12-06 22:07 . 2013-12-06 22:07        78432        ----a-w-        c:\windows\system32\amdpcom64.dll

2013-12-06 22:07 . 2013-12-06 22:07        71704        ----a-w-        c:\windows\SysWow64\atimpc32.dll

2013-12-06 22:07 . 2013-12-06 22:07        71704        ----a-w-        c:\windows\SysWow64\amdpcom32.dll

2013-12-06 22:04 . 2011-05-25 20:07        143304        ----a-w-        c:\windows\system32\atiuxp64.dll

2013-12-06 22:03 . 2013-12-06 22:03        126336        ----a-w-        c:\windows\SysWow64\atiuxpag.dll

2013-12-06 22:03 . 2011-07-08 02:46        115512        ----a-w-        c:\windows\system32\atiu9p64.dll

2013-12-06 22:02 . 2011-07-08 02:45        98496        ----a-w-        c:\windows\SysWow64\atiu9pag.dll

2013-12-06 22:01 . 2011-07-08 03:28        1318552        ----a-w-        c:\windows\system32\aticfx64.dll

2013-12-06 22:01 . 2011-07-08 03:29        1100216        ----a-w-        c:\windows\SysWow64\aticfx32.dll

2013-12-06 22:00 . 2011-07-08 03:10        9753752        ----a-w-        c:\windows\system32\atidxx64.dll

2013-12-06 21:59 . 2013-12-06 21:59        8406024        ----a-w-        c:\windows\SysWow64\atidxx32.dll

2013-12-06 21:59 . 2011-07-08 02:55        8287008        ----a-w-        c:\windows\SysWow64\atiumdva.dll

2013-12-06 21:58 . 2011-07-08 03:00        6630232        ----a-w-        c:\windows\SysWow64\atiumdag.dll

2013-12-06 21:57 . 2013-12-06 21:57        8927704        ----a-w-        c:\windows\system32\atiumd6a.dll

2013-12-06 21:56 . 2013-12-06 21:56        7751920        ----a-w-        c:\windows\system32\atiumd64.dll

2013-12-06 21:52 . 2013-12-06 21:52        13207552        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2013-12-06 21:38 . 2013-12-06 21:38        230912        ----a-w-        c:\windows\system32\clinfo.exe

2013-12-06 21:38 . 2013-12-06 21:38        1187342        ----a-w-        c:\windows\system32\amdocl_as64.exe

2013-12-06 21:38 . 2013-12-06 21:38        1061902        ----a-w-        c:\windows\system32\amdocl_ld64.exe

2013-12-06 21:38 . 2013-12-06 21:38        995342        ----a-w-        c:\windows\SysWow64\amdocl_as32.exe

2013-12-06 21:38 . 2013-12-06 21:38        798734        ----a-w-        c:\windows\SysWow64\amdocl_ld32.exe

2013-12-06 21:38 . 2013-12-06 21:38        99840        ----a-w-        c:\windows\system32\OpenVideo64.dll

2013-12-06 21:38 . 2013-12-06 21:38        83968        ----a-w-        c:\windows\SysWow64\OpenVideo.dll

2013-12-06 21:38 . 2013-12-06 21:38        86528        ----a-w-        c:\windows\system32\OVDecode64.dll

2013-12-06 21:38 . 2013-12-06 21:38        73728        ----a-w-        c:\windows\SysWow64\OVDecode.dll

2013-12-06 21:37 . 2013-12-06 21:37        29382144        ----a-w-        c:\windows\system32\amdocl64.dll

2013-12-06 21:35 . 2013-12-06 21:35        24860160        ----a-w-        c:\windows\SysWow64\amdocl.dll

2013-12-06 21:33 . 2013-12-06 21:33        63488        ----a-w-        c:\windows\system32\OpenCL.dll

2013-12-06 21:33 . 2013-12-06 21:33        57344        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2013-12-06 21:26 . 2013-12-06 21:26        129536        ----a-w-        c:\windows\system32\coinst_13.251.dll

2013-12-06 21:16 . 2013-12-06 21:16        26352128        ----a-w-        c:\windows\system32\atio6axx.dll

2013-12-06 21:13 . 2013-12-06 21:13        368640        ----a-w-        c:\windows\system32\atiapfxx.exe

2013-12-06 21:12 . 2013-12-06 21:12        62464        ----a-w-        c:\windows\system32\aticalrt64.dll

2013-12-06 21:12 . 2013-12-06 21:12        52224        ----a-w-        c:\windows\SysWow64\aticalrt.dll

2013-12-06 21:12 . 2013-12-06 21:12        55808        ----a-w-        c:\windows\system32\aticalcl64.dll

2013-12-06 21:12 . 2013-12-06 21:12        49152        ----a-w-        c:\windows\SysWow64\aticalcl.dll

2013-12-06 21:12 . 2013-12-06 21:12        15716352        ----a-w-        c:\windows\system32\aticaldd64.dll

2013-12-06 21:09 . 2013-12-06 21:09        14302208        ----a-w-        c:\windows\SysWow64\aticaldd.dll

2013-12-06 20:58 . 2013-12-06 20:58        22157824        ----a-w-        c:\windows\SysWow64\atioglxx.dll

2013-12-06 20:53 . 2013-12-06 20:53        442368        ----a-w-        c:\windows\system32\atidemgy.dll

2013-12-06 20:53 . 2013-12-06 20:53        31232        ----a-w-        c:\windows\system32\atimuixx.dll

2013-12-06 20:53 . 2013-12-06 20:53        588288        ----a-w-        c:\windows\system32\atieclxx.exe

2013-12-06 20:52 . 2013-12-06 20:52        239616        ----a-w-        c:\windows\system32\atiesrxx.exe

2013-12-06 20:50 . 2013-12-06 20:50        190976        ----a-w-        c:\windows\system32\atitmm64.dll

2013-12-06 20:22 . 2013-12-06 20:22        1144320        ----a-w-        c:\windows\system32\atiadlxx.dll

2013-12-06 20:22 . 2013-12-06 20:22        825344        ----a-w-        c:\windows\SysWow64\atiadlxy.dll

2013-12-06 20:22 . 2013-12-06 20:22        74752        ----a-w-        c:\windows\system32\atig6pxx.dll

2013-12-06 20:22 . 2013-12-06 20:22        69632        ----a-w-        c:\windows\SysWow64\atiglpxx.dll

2013-12-06 20:22 . 2013-12-06 20:22        69632        ----a-w-        c:\windows\system32\atiglpxx.dll

2013-12-06 20:22 . 2013-12-06 20:22        100352        ----a-w-        c:\windows\system32\atig6txx.dll

2013-12-06 20:21 . 2013-12-06 20:21        96768        ----a-w-        c:\windows\SysWow64\atigktxx.dll

2013-12-06 20:21 . 2013-12-06 20:21        626176        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2013-12-06 20:18 . 2013-12-06 20:18        43520        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2013-12-06 15:49 . 2013-12-06 15:49        51200        ----a-w-        c:\windows\system32\kdbsdk64.dll

2013-12-06 15:44 . 2013-12-06 15:44        38912        ----a-w-        c:\windows\SysWow64\kdbsdk32.dll

2013-11-26 11:54 . 2013-12-11 23:02        23183360        ----a-w-        c:\windows\system32\mshtml.dll

2013-11-26 10:19 . 2013-12-11 23:02        2724864        ----a-w-        c:\windows\system32\mshtml.tlb

2013-11-26 10:18 . 2013-12-11 23:02        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll

2013-11-26 09:48 . 2013-12-11 23:02        66048        ----a-w-        c:\windows\system32\iesetup.dll

2013-11-26 09:46 . 2013-12-11 23:02        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll

2013-11-26 09:41 . 2013-12-11 23:02        2764288        ----a-w-        c:\windows\system32\iertutil.dll

2013-11-26 09:29 . 2013-12-11 23:02        53760        ----a-w-        c:\windows\system32\jsproxy.dll

2013-11-26 09:27 . 2013-12-11 23:02        33792        ----a-w-        c:\windows\system32\iernonce.dll

2013-11-26 09:23 . 2013-12-11 23:02        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2013-11-26 09:21 . 2013-12-11 23:02        574976        ----a-w-        c:\windows\system32\ieui.dll

2013-11-26 09:18 . 2013-12-11 23:02        139264        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-11-26 09:18 . 2013-12-11 23:02        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe

2013-11-26 09:16 . 2013-12-11 23:02        708608        ----a-w-        c:\windows\system32\jscript9diag.dll

2013-11-26 08:57 . 2013-12-11 23:02        218624        ----a-w-        c:\windows\system32\ie4uinit.exe

2013-11-26 08:35 . 2013-12-11 23:02        5769216        ----a-w-        c:\windows\system32\jscript9.dll

2013-11-26 08:28 . 2013-12-11 23:02        553472        ----a-w-        c:\windows\SysWow64\jscript9diag.dll

2013-11-26 08:16 . 2013-12-11 23:02        4243968        ----a-w-        c:\windows\SysWow64\jscript9.dll

2013-11-26 08:02 . 2013-12-11 23:02        1995264        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-11-26 07:48 . 2013-12-11 23:02        12996608        ----a-w-        c:\windows\system32\ieframe.dll

2013-11-26 07:32 . 2013-12-11 23:02        1928192        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-11-26 07:07 . 2013-12-11 23:02        2334208        ----a-w-        c:\windows\system32\wininet.dll

2013-11-26 06:40 . 2013-12-11 23:02        1395200        ----a-w-        c:\windows\system32\urlmon.dll

2013-11-26 06:34 . 2013-12-11 23:02        817664        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-11-26 06:33 . 2013-12-11 23:02        1820160        ----a-w-        c:\windows\SysWow64\wininet.dll

2013-11-23 18:26 . 2013-12-11 14:34        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll

2013-11-23 17:47 . 2013-12-11 14:34        465920        ----a-w-        c:\windows\system32\WMPhoto.dll

2013-11-19 21:07 . 2013-11-19 21:07        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-11-19 21:07 . 2013-11-19 21:07        194048        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-11-19 21:07 . 2013-11-19 21:07        942592        ----a-w-        c:\windows\system32\jsIntl.dll

2013-11-19 21:07 . 2013-11-19 21:07        86016        ----a-w-        c:\windows\SysWow64\iesysprep.dll

2010-11-05 01:58        32768        --sh--w-        c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[-] 2014-02-12 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll

.

[-] 2014-02-12 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll

[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HydraVisionMDEngine"="c:\program files (x86)\ATI Technologies\HydraVision\HydraMD.exe" [2011-07-07 569344]

"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-07-07 393216]

"Load"="c:\users\Pc\AppData\Roaming\vbc.exe" [2010-11-05 1169224]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]

"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

"PCTools FGuard"="c:\program files (x86)\PC Tools Security\BDT\FGuard.exe" [2011-09-01 247760]

.

c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

start.lnk - c:\users\Pc\cc4j5zs76kd2kj\92050.vbs [2014-2-11 190]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLUA"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 0 (0x0)

"HideSCAHealth"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 0 (0x0)

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 0 (0x0)

"HideSCAHealth"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

R1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]

R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys;c:\windows\SYSNATIVE\Drivers\PCTSD64.sys [x]

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

R2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]

R2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]

R2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files (x86)\PC Tools Security\BDT\BDTUpdateService.exe;c:\program files (x86)\PC Tools Security\BDT\BDTUpdateService.exe [x]

R2 CGVPNCliService;CyberGhost 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 e81a9dc1;GS-Supporter;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]

R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]

R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]

R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

R2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [x]

R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]

R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]

R3 ArcService;Arc Service;c:\users\Pc\Desktop\ArcService.exe;c:\users\Pc\Desktop\ArcService.exe [x]

R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]

R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]

R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]

R3 hxctlflt;hxctlflt;c:\windows\system32\Drivers\hxctlflt.sys;c:\windows\SYSNATIVE\Drivers\hxctlflt.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

R3 RTL85n64;Realtek 8180/8185 Extensible 802.11-Drahtlosgerätetreiber;c:\windows\system32\DRIVERS\RTL85n64.sys;c:\windows\SYSNATIVE\DRIVERS\RTL85n64.sys [x]

R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]

R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]

R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [x]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]

R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]

R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]

R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]

R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]

R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]

R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]

R3 X6va015;X6va015;c:\windows\SysWOW64\Drivers\X6va015;c:\windows\SysWOW64\Drivers\X6va015 [x]

R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]

R4 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]

R4 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]

R4 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]

S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys;c:\windows\SYSNATIVE\drivers\PCTCore64.sys [x]

S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys;c:\windows\SYSNATIVE\drivers\pctDS64.sys [x]

S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys;c:\windows\SYSNATIVE\drivers\pctEFA64.sys [x]

S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]

S4 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1501000.012\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMDS64.SYS [x]

S4 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1501000.012\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMEFA64.SYS [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Akamai        REG_MULTI_SZ           Akamai

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-12-05 15:20        1210320        ----a-w-        c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-02-12 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-05 13:59]

.

2014-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]

.

2014-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]

.

2014-02-12 c:\windows\Tasks\ParetoLogic Registration3.job

- c:\windows\system32\rundll32.exe [2009-07-13 01:14]

.

2014-02-12 c:\windows\Tasks\ParetoLogic Update Version3.job

- c:\program files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:51]

.

2014-02-12 c:\windows\Tasks\PC Health Advisor Defrag.job

- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]

.

2014-02-12 c:\windows\Tasks\PC Health Advisor.job

- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2011-04-11 03:35        220160        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2011-04-11 03:35        220160        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-20 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-20 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-20 418328]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>

uSearchAssistant = hxxp://www.google.com

IE: Mit Mipony herunterladen - file://c:\program files (x86)\MiPony\Browser\IEContext.htm

LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll

Trusted Zone: aeriagames.com

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.2.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - 

FF - ProfilePath - c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - ExtSQL: 2013-12-18 17:14; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF - user.js: extensions.ividi.tlbrSrchUrl - hxxp://search.ividi.org/?src=tbsp&id=2895594900000000000000240103dca8&affilt=3&q=

FF - user.js: extensions.ividi.id - 2895594900000000000000240103dca8

FF - user.js: extensions.ividi.appId - {685F23D9-FCFD-475C-B56A-362645945C5A}

FF - user.js: extensions.ividi.instlDay - 15989

FF - user.js: extensions.ividi.vrsn - 1.8.23.0

FF - user.js: extensions.ividi.vrsni - 1.8.23.0

FF - user.js: extensions.ividi.vrsnTs - 1.8.23.014:19

FF - user.js: extensions.ividi.prtnrId - ividi

FF - user.js: extensions.ividi.prdct - ividi

FF - user.js: extensions.ividi.aflt - 3

FF - user.js: extensions.ividi.smplGrp - none

FF - user.js: extensions.ividi.tlbrId - base

FF - user.js: extensions.ividi.instlRef - 

FF - user.js: extensions.ividi.dfltLng - 

FF - user.js: extensions.ividi.excTlbr - true

FF - user.js: extensions.ividi.ffxUnstlRst - false

FF - user.js: extensions.ividi.admin - false

FF - user.js: extensions.ividi.autoRvrt - false

FF - user.js: extensions.ividi.rvrt - false

FF - user.js: extensions.ividi.newTab - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\Pc\AppData\Local\Akamai\netsession_win.exe

Wow6432Node-HKCU-Run-Wcenter - c:\users\Pc\AppData\Roaming\Microsoft\Wcenter9.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

BHO-{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - c:\programdata\FuNDeaulls\DD2qL.x64.dll

BHO-{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - c:\programdata\50Coeuupons\gKoa.x64.dll

AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.8.3.8\uninstall.exe

AddRemove-BattleForGraxia - c:\users\Pc\Desktop\uninstall.exe

AddRemove-Roma Surrectum Deutsch 1.1.0.5 - c:\program files (x86)\Activision\Rome - Total War\Mods\Uninstall.exe

AddRemove-Roma Surrectum II - c:\program files (x86)\Activision\Rome - Total War\Mods\uninst.exe

AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe

AddRemove-Special Force 2 Beta_is1 - c:\program files (x86)\SpecialForce2Beta\unins000.exe

AddRemove-YTKaraoke@DacSoft.org - c:\program files (x86)\YTKaraoke\uninstall.exe

AddRemove-{478472F9-9E09-492A-BDAB-42EE595EF1AD} - c:\programdata\FuNDeaulls\DD2qL.exe

AddRemove-{4820778D-AB0D-6D18-C316-52A6A0E1D507} - c:\programdata\YoutubeAdblocker\TWJ1VQCit.exe

AddRemove-{5F189DF5-2D05-472B-9091-84D9848AE48B}{e81a9dc1} - c:\progra~2\GS-ENA~1\Browsafe.dll

AddRemove-{74A84478-70A5-4F7A-966C-FA2771FF91A5}_is1 - c:\users\Pc\Desktop\Downloads\Cracks\Die Gilde\Die Gilde 2 - King Edition\unins000.exe

AddRemove-{A35CA8FF-CB7D-8361-1CB9-83219CD11C78} - c:\programdata\surf aand kEEp\3Lwcvkkk.exe

AddRemove-3942161475.portal.qtrax.com - c:\program files (x86)\Microsoft Silverlight\5.1.20513.0\Silverlight.Configuration.exe

AddRemove-ExpressFiles - c:\program files (x86)\ExpressFiles\uninstall.exe

AddRemove-Qtrax Connection Manager - c:\users\Pc\Qtrax\Player\uninstallnotification.exe

AddRemove-{56837588-F559-40CF-91D9-D439D405FB28} - c:\users\Pc\AppData\Local\Temp\Download_B1D1\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va012]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va013]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va013"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va015]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va015"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\SecuROM\License information*]

"datasecu"=hex:43,48,2f,01,a8,3f,a0,25,9e,c0,d9,1e,5e,c3,db,5d,ba,eb,05,e2,2e,

   74,eb,bc,e8,2e,42,2e,69,b5,96,e7,8d,49,8b,bc,8b,14,15,6d,cb,54,62,ae,12,f4,\

"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb

.

[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}]

@DACL=(02 0000)

@="Pokki"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2014-02-12  20:03:01

ComboFix-quarantined-files.txt  2014-02-12 19:03

.

Vor Suchlauf: 22 Verzeichnis(se), 271.743.991.808 Bytes frei

Nach Suchlauf: 26 Verzeichnis(se), 273.505.619.968 Bytes frei

.

- - End Of File - - 830E141AC8CF0E9AC9EBF08F048DC385

A36C5E4F47E84449FF07ED3517B43A31

und FSS

Code:

Farbar Service Scanner Version: 02-02-2014

Ran by Pc (administrator) on 12-02-2014 at 20:14:06

Running from "C:\Users\Pc\Desktop"

Microsoft Windows 7 Enterprise  Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************
 

Internet Services:

============
 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.
 
 

Windows Firewall:

=============

mpsdrv Service is not running. Checking service configuration:

The start type of mpsdrv service is OK.

The ImagePath of mpsdrv service is OK.
 

MpsSvc Service is not running. Checking service configuration:

The start type of MpsSvc service is set to Disabled. The default start type is Auto.

The ImagePath of MpsSvc service is OK.

The ServiceDll of MpsSvc service is OK.
 
 

Firewall Disabled Policy: 

==================
 
 

System Restore:

============
 

System Restore Disabled Policy: 

========================
 
 

Action Center:

============
 
 

Windows Update:

============
 

Windows Autoupdate Disabled Policy: 

============================
 
 

Windows Defender:

==============
 

Other Services:

==============
 
 

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys => MD5 is legit

C:\Windows\System32\drivers\tdx.sys => MD5 is legit

C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll => MD5 is legit

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll => MD5 is legit

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll => MD5 is legit

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll => MD5 is legit

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\System32\ipnathlp.dll => MD5 is legit

C:\Windows\System32\iphlpsvc.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit
 
 

**** End of log ****

Trotzdem Dankeschön!:rolleyes: Immerhin sind viele der Fehler nun verschwunden.

Mir ist gerade auch aufgefallen, das svchost.exe laut Taskmanager 15 Mal geöffnet ist. Das kann doch nicht normal sein oder?

sunjojo

13.02.2014 07:01

Zitat:

Trotzdem Dankeschön! Immerhin sind viele der Fehler nun verschwunden.

Wir sind auch noch nicht fertig, du hast schon einiges an Malware/Adware gesammelt. Um die Fehler kümmere ich im weiteren Verlauf der Bereinigung :).

Schritt 1
Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link

Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

Code:

Folder:: c:\users\Pc\cc4j5zs76kd2kj c:\users\Pc\aoajz c:\users\Pc\xripb File:: c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk c:\users\Pc\AppData\Roaming\vbc.exe Reg:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Load"=- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc] "Start"=dword:00000002

Speichere dies als CFScript.txt auf deinem Desktop.

Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
Danach wieder anstellen nicht vergessen!

Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.

Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:

Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.

Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Schritt 2
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Schritt 3
Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.

Klicke auf Wählen Sie eine
Kopiere nun folgendes in die Suchleiste

Code:

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
und klicke auf Öffnen.
Klicke auf Scannen!.
Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen

klicke auf Neu analysieren.
Warte bis dir das Analysedatum angezeigt wird und der Scan abgeschlossen ist.
Kopiere den Link aus deiner Adresszeile und poste ihn hier.

Schritt 4
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Poste folgende Logfiles in deiner nächsten Antwort:

Combofix-Fix
TDSSKiller-Scan
FRST-Scan

Redblood

13.02.2014 14:55

FRST-log

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2014 01

Ran by Pc (administrator) on PC-PC on 13-02-2014 14:50:23

Running from C:\Users\Pc\Desktop

Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2013-12-20] (APN)

HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0

HKLM\...\Policies\Explorer: [HideSCAHealth] 0

HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0

HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}

SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}

SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=f0e6090c-d942-4ce4-94f4-095b9a73bb7a&searchtype=ds&q={searchTerms}&installDate=07/04/2013

SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E&q={searchTerms}

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=289500240103DCA8&affID=121963&tsp=4980

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)

BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File

BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File

BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.0.0\ViProtocol.dll No File

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566

FF user.js: detected! => C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js

FF NewTab: hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\\npsitesafety.dll No File

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml

FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]

FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]

FF HKLM\...\Firefox\Extensions: [{77BEC163-D389-42c1-91A4-C758846296A5}] - C:\Program Files\Video downloader\Firefox

FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\

FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]

CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]

CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]

CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]

CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]

CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKLM-x32\...\Chrome\Extension: [fmfnfnpmhcllokmkepffndflpnadjmma] - C:\Program Files (x86)\DealPly\DealPly.crx [2013-07-29]

CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Pc\AppData\Local\Wajam\Chrome\wajam.crx [2012-07-26]

CHR HKLM-x32\...\Chrome\Extension: [khialnikbocfgkohdegnebhmmaifoglp] - C:\Program Files (x86)\LyricsMonkey\Chrome.crx [2012-07-26]

CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx [2013-02-10]

CHR HKLM-x32\...\Chrome\Extension: [pcoohmdcpejoeggdnihdfhohjgdbllgm] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7C\CRX\ToolbarCR.crx [2013-12-20]

CHR HKLM-x32\...\Chrome\Extension: [pggagllhehfjjfgnfnfkjedjlmbchamf] - C:\Users\Pc\AppData\Roaming\SeeSimilar\SeeSimilar.crx [2013-06-20]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

S2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S4 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()

S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)

S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]

S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service

S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)

S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)

R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)

S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)

R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))

R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))

R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))

R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()

S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-13 14:50 - 2014-02-13 14:50 - 00022053 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-13 14:50 - 2014-02-13 14:50 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip

2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe

2014-02-13 14:30 - 2014-02-13 14:30 - 00043125 _____ () C:\Users\Pc\Desktop\ComboFix.txt.txt

2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt

2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe

2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\APN

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork

2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk

2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com

2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe

2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg

2014-02-12 21:18 - 2014-02-13 14:17 - 00109188 _____ () C:\Windows\PFRO.log

2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-12 21:00 - 2014-02-13 14:17 - 00003808 _____ () C:\Windows\setupact.log

2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls

2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls

2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll

2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll

2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe

2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll

2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll

2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll

2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox

2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt

2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite

2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe

2014-02-12 13:51 - 2014-02-12 19:01 - 00000436 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job

2014-02-12 13:51 - 2014-02-12 19:01 - 00000394 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job

2014-02-12 13:51 - 2014-02-12 19:01 - 00000376 _____ () C:\Windows\Tasks\PC Health Advisor.job

2014-02-12 13:51 - 2014-02-12 18:00 - 00000462 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job

2014-02-12 13:51 - 2014-02-12 13:51 - 00003284 _____ () C:\Windows\System32\Tasks\PC Health Advisor

2014-02-12 13:51 - 2014-02-12 13:51 - 00003264 _____ () C:\Windows\System32\Tasks\PC Health Advisor Defrag

2014-02-12 13:51 - 2014-02-12 13:51 - 00003246 _____ () C:\Windows\System32\Tasks\ParetoLogic Update Version3

2014-02-12 13:51 - 2014-02-12 13:51 - 00003120 _____ () C:\Windows\System32\Tasks\ParetoLogic Registration3

2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\ParetoLogic

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DriverCure

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\ProgramData\ParetoLogic

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Program Files (x86)\ParetoLogic

2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe

2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar

2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk

2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe

2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip

2014-02-11 22:27 - 2014-02-13 13:49 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-11 22:23 - 2014-02-13 14:50 - 00000000 ____D () C:\FRST

2014-02-11 22:22 - 2014-02-13 14:50 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable

2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites

2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites

2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj

2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll

2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-04 13:09 - 2014-02-04 13:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5

2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk

2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe

2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
 

==================== One Month Modified Files and Folders =======
 

2014-02-13 14:50 - 2014-02-13 14:50 - 00022053 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-13 14:50 - 2014-02-13 14:50 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-02-13 14:50 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST

2014-02-13 14:50 - 2014-02-11 22:22 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip

2014-02-13 14:30 - 2014-02-13 14:30 - 00043125 _____ () C:\Users\Pc\Desktop\ComboFix.txt.txt

2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox

2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt

2014-02-13 14:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-13 14:21 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2014-02-13 14:17 - 2014-02-12 21:18 - 00109188 _____ () C:\Windows\PFRO.log

2014-02-13 14:17 - 2014-02-12 21:00 - 00003808 _____ () C:\Windows\setupact.log

2014-02-13 14:17 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-13 14:17 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt

2014-02-13 14:16 - 2011-05-10 01:27 - 01970707 _____ () C:\Windows\WindowsUpdate.log

2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-02-13 13:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe

2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe

2014-02-13 13:49 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\APN

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork

2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk

2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com

2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg

2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT

2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-02-12 21:07 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat

2014-02-12 21:07 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat

2014-02-12 21:07 - 2009-07-14 06:13 - 01625030 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe

2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-12 20:52 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0

2014-02-12 20:52 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps

2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump

2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar

2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton

2014-02-12 19:01 - 2014-02-12 13:51 - 00000436 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job

2014-02-12 19:01 - 2014-02-12 13:51 - 00000394 _____ () C:\Windows\Tasks\PC Health Advisor Defrag.job

2014-02-12 19:01 - 2014-02-12 13:51 - 00000376 _____ () C:\Windows\Tasks\PC Health Advisor.job

2014-02-12 18:00 - 2014-02-12 13:51 - 00000462 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job

2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames

2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite

2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe

2014-02-12 13:51 - 2014-02-12 13:51 - 00003284 _____ () C:\Windows\System32\Tasks\PC Health Advisor

2014-02-12 13:51 - 2014-02-12 13:51 - 00003264 _____ () C:\Windows\System32\Tasks\PC Health Advisor Defrag

2014-02-12 13:51 - 2014-02-12 13:51 - 00003246 _____ () C:\Windows\System32\Tasks\ParetoLogic Update Version3

2014-02-12 13:51 - 2014-02-12 13:51 - 00003120 _____ () C:\Windows\System32\Tasks\ParetoLogic Registration3

2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\ParetoLogic

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DriverCure

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\ProgramData\ParetoLogic

2014-02-12 13:51 - 2014-02-12 13:51 - 00000000 ____D () C:\Program Files (x86)\ParetoLogic

2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe

2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar

2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk

2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband

2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe

2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip

2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2

2014-02-12 08:37 - 2013-07-30 17:38 - 00000000 ____D () C:\Program Files (x86)\ExpressFiles

2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable

2014-02-11 22:21 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc

2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites

2014-02-11 21:23 - 2014-02-04 15:05 - 00000000 _RSHD () C:\Users\Pc\aoajz

2014-02-11 21:23 - 2014-02-04 12:08 - 00000000 _RSHD () C:\Users\Pc\xripb

2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls

2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\50Coeuupons

2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC

2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki

2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites

2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG

2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle

2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java

2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite

2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent

2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj

2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files

2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files

2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype

2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe

2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt

2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr

2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe

2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:12 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-04 13:11 - 2014-02-04 13:11 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-04 13:11 - 2012-10-28 14:16 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin

2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele

2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache

2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT

2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}

2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft

2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment

2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify

2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify

2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5

2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk

2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe

2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler

2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT
 

Some content of TEMP:

====================

C:\Users\Pc\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-02-11 14:00
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Redblood

13.02.2014 14:56

TDSS Killer

Code:

14:36:53.0573 0x0a60  TDSS rootkit removing tool 3.0.0.23 Feb 10 2014 23:32:41

14:36:59.0508 0x0a60  ============================================================

14:36:59.0508 0x0a60  Current date / time: 2014/02/13 14:36:59.0508

14:36:59.0508 0x0a60  SystemInfo:

14:36:59.0509 0x0a60  

14:36:59.0509 0x0a60  OS Version: 6.1.7601 ServicePack: 1.0

14:36:59.0509 0x0a60  Product type: Workstation

14:36:59.0509 0x0a60  ComputerName: PC-PC

14:36:59.0509 0x0a60  UserName: Pc

14:36:59.0509 0x0a60  Windows directory: C:\Windows

14:36:59.0509 0x0a60  System windows directory: C:\Windows

14:36:59.0509 0x0a60  Running under WOW64

14:36:59.0509 0x0a60  Processor architecture: Intel x64

14:36:59.0509 0x0a60  Number of processors: 6

14:36:59.0509 0x0a60  Page size: 0x1000

14:36:59.0509 0x0a60  Boot type: Normal boot

14:36:59.0509 0x0a60  ============================================================

14:37:01.0406 0x0a60  KLMD registered as C:\Windows\system32\drivers\51328195.sys

14:37:01.0680 0x0a60  System UUID: {DEC507E8-EDE3-9F56-1156-8E1600A46CA9}

14:37:02.0858 0x0a60  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

14:37:02.0873 0x0a60  ============================================================

14:37:02.0873 0x0a60  \Device\Harddisk0\DR0:

14:37:02.0874 0x0a60  MBR partitions:

14:37:02.0874 0x0a60  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

14:37:02.0874 0x0a60  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D4000

14:37:02.0874 0x0a60  ============================================================

14:37:02.0898 0x0a60  C: <-> \Device\Harddisk0\DR0\Partition2

14:37:02.0899 0x0a60  ============================================================

14:37:02.0899 0x0a60  Initialize success

14:37:02.0899 0x0a60  ============================================================

14:38:06.0932 0x09b4  ============================================================

14:38:06.0932 0x09b4  Scan started

14:38:06.0932 0x09b4  Mode: Manual; SigCheck; TDLFS; 

14:38:06.0932 0x09b4  ============================================================

14:38:06.0932 0x09b4  KSN ping started

14:38:20.0801 0x09b4  KSN ping finished: true

14:38:21.0705 0x09b4  ================ Scan system memory ========================

14:38:21.0705 0x09b4  System memory - ok

14:38:21.0705 0x09b4  ================ Scan services =============================

14:38:21.0893 0x09b4  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys

14:38:22.0064 0x09b4  1394ohci - ok

14:38:22.0142 0x09b4  [ A3769020F7E8A70FD3E824C050F33306, BAAB18DD28C753EC90E9552BD5FFC316AD8815505A7998BCE51D21448B373D86 ] acedrv11        C:\Windows\system32\drivers\acedrv11.sys

14:38:22.0220 0x09b4  acedrv11 - ok

14:38:22.0267 0x09b4  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

14:38:22.0314 0x09b4  ACPI - ok

14:38:22.0345 0x09b4  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

14:38:22.0407 0x09b4  AcpiPmi - ok

14:38:22.0532 0x09b4  [ ADDA5E1951B90D3D23C56D3CF0622ADC, E85E7BFD29F00ED34BF5BE8BD4DA93CBB14278E16809BB55406875F0DA88551E ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

14:38:22.0563 0x09b4  AdobeARMservice - ok

14:38:22.0735 0x09b4  [ C8C6C0D659734FDBF63F6F421A5416BC, 11C452D77D0A8A5E430D0D0C9949797FFC03D2E3DADB8FBB9B63EDA868AFF83C ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

14:38:22.0766 0x09b4  AdobeFlashPlayerUpdateSvc - ok

14:38:22.0813 0x09b4  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys

14:38:22.0891 0x09b4  adp94xx - ok

14:38:22.0938 0x09b4  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys

14:38:22.0985 0x09b4  adpahci - ok

14:38:23.0031 0x09b4  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys

14:38:23.0063 0x09b4  adpu320 - ok

14:38:23.0109 0x09b4  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

14:38:23.0203 0x09b4  AeLookupSvc - ok

14:38:23.0265 0x09b4  [ 79059559E89D06E8B80CE2944BE20228, 6E041D2FED2D0C3D8E16E56CB61D3245F9144EA92F5BDC9A4AA30598D1C8E6EE ] AFD             C:\Windows\system32\drivers\afd.sys

14:38:23.0375 0x09b4  AFD - ok

14:38:23.0406 0x09b4  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys

14:38:23.0437 0x09b4  agp440 - ok

14:38:23.0765 0x09b4  [ BBE9054FDADC8D49D29C5DA4FB84A803, 4315C1D7DBD35A80E25F15B45587AA76F6E9FCDC617B5ABF62301570771066AF ] Akamai          c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll

14:38:23.0765 0x09b4  Suspicious file ( Hidden ): c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll. md5: BBE9054FDADC8D49D29C5DA4FB84A803, sha256: 4315C1D7DBD35A80E25F15B45587AA76F6E9FCDC617B5ABF62301570771066AF

14:38:23.0780 0x09b4  Akamai - detected HiddenFile.Multi.Generic ( 1 )

14:38:24.0014 0x09b4  Akamai ( HiddenFile.Multi.Generic ) - warning

14:38:26.0853 0x09b4  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe

14:38:26.0931 0x09b4  ALG - ok

14:38:26.0963 0x09b4  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys

14:38:26.0994 0x09b4  aliide - ok

14:38:27.0087 0x09b4  [ 66B54471B5856E314947881E28263A6D, 2D60706B52A2CE98FF806337D62CD010C1DEB2AEDDF899C7B67173928B2D7C4C ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe

14:38:27.0165 0x09b4  AMD External Events Utility - ok

14:38:27.0259 0x09b4  AMD FUEL Service - ok

14:38:27.0306 0x09b4  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys

14:38:27.0337 0x09b4  amdide - ok

14:38:27.0384 0x09b4  [ 6A2EEB0C4133B20773BB3DD0B7B377B4, E4CB35C6937C70A145A13E5AE5B34A271B49101DA623171ACBFDA8601E5A70EA ] amdiox64        C:\Windows\system32\DRIVERS\amdiox64.sys

14:38:27.0415 0x09b4  amdiox64 - ok

14:38:27.0446 0x09b4  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys

14:38:27.0509 0x09b4  AmdK8 - ok

14:38:28.0320 0x09b4  [ FBB35875FEFE53D4280259842069ED72, B1A1B5799A6C50C244182CD201A1E9FCB7BE3B5ED4BB2E2E6BCF8E1BF53B75DB ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys

14:38:29.0287 0x09b4  amdkmdag - ok

14:38:29.0427 0x09b4  [ A32BCAD9377E3B75D034CAFBA463A0AE, F504895D9C9CD1B4607806BCAF15A1CBFBAC2E5824903277A1350C9F35045602 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys

14:38:29.0521 0x09b4  amdkmdap - ok

14:38:29.0552 0x09b4  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys

14:38:29.0599 0x09b4  AmdPPM - ok

14:38:29.0646 0x09b4  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

14:38:29.0693 0x09b4  amdsata - ok

14:38:29.0724 0x09b4  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys

14:38:29.0771 0x09b4  amdsbs - ok

14:38:29.0802 0x09b4  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys

14:38:29.0817 0x09b4  amdxata - ok

14:38:29.0895 0x09b4  [ B9C95291F5EA1072CEC2BA690E07F29F, 1FC75E20B31680667A5FE4E0AB5ADD6CFE7016A3B9E975E92EAA192689684E54 ] AMD_RAIDXpert   C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

14:38:29.0942 0x09b4  AMD_RAIDXpert - detected UnsignedFile.Multi.Generic ( 1 )

14:38:29.0942 0x09b4  AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - warning

14:38:32.0781 0x09b4  [ 4DE0D5D747A73797C95A97DCCE5018B5, 17EC669675C2E43515EFE2D8BCC9DDFFBE64F99EBFB9A6DAB429F65A2B504560 ] androidusb      C:\Windows\system32\Drivers\ssadadb.sys

14:38:32.0828 0x09b4  androidusb - ok

14:38:33.0047 0x09b4  [ 67402A0D0554DAF40E421DE34F5E295A, FDCE8B04DFABAC428636533F5A446C47607DC8F8DC04E3156450FBF0696B85AB ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe

14:38:33.0109 0x09b4  AntiVirMailService - ok

14:38:33.0187 0x09b4  [ FE79366FECD444A16CCA9979134DBEA8, 91D2301E35C89B9FAD5680124EA51DC346159DC78556ACCD935F9B236B9FDCBC ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

14:38:33.0234 0x09b4  AntiVirSchedulerService - ok

14:38:33.0281 0x09b4  [ FDE9C7030FB1E9E2715E113EE6A10F90, 541F278D743C34C6D9940FC1250B90674EB88EC429D481012F27817DAB1B557A ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

14:38:33.0327 0x09b4  AntiVirService - ok

14:38:33.0405 0x09b4  [ 8D69B1551F51E18AE12E01DE6A2050EA, E1BF3E1AB82E90DC32811C934933D761340DAE44B7ACDF3B9C19725465BE3590 ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

14:38:33.0483 0x09b4  AntiVirWebService - ok

14:38:33.0546 0x09b4  [ E8CCB797DAF80779C768BD3A9FC8FCAF, 781BD878CA34D8B6D2FE238439CD173E95449260428859BEA92866D41B1284F4 ] AODDriver4.2.0  C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys

14:38:33.0577 0x09b4  AODDriver4.2.0 - ok

14:38:33.0655 0x09b4  [ B342CD9AA44E4AE99E2368EBDBC2E17A, C3081358313A982F53CAD54C214AFECAD9660A59FB4A3DDFE068724E83041AF8 ] APNMCP          C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

14:38:33.0686 0x09b4  APNMCP - ok

14:38:33.0733 0x09b4  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys

14:38:33.0842 0x09b4  AppID - ok

14:38:33.0873 0x09b4  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

14:38:33.0983 0x09b4  AppIDSvc - ok

14:38:34.0014 0x09b4  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll

14:38:34.0061 0x09b4  Appinfo - ok

14:38:34.0107 0x09b4  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll

14:38:34.0170 0x09b4  AppMgmt - ok

14:38:34.0201 0x09b4  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys

14:38:34.0248 0x09b4  arc - ok

14:38:34.0263 0x09b4  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys

14:38:34.0310 0x09b4  arcsas - ok

14:38:34.0373 0x09b4  ArcService - ok

14:38:34.0482 0x09b4  [ FEF9DD9EA587F8886ADE43C1BEFBDAFE, DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8 ] AsIO            C:\Windows\syswow64\drivers\AsIO.sys

14:38:34.0513 0x09b4  AsIO - ok

14:38:34.0575 0x09b4  [ 718692FFF22D6AF47EBA0A741A924921, 01E462C868B9DB635F8D0D6FCA1B312FF4C3BE8EE9E4103B4B0406329767D02D ] asmthub3        C:\Windows\system32\DRIVERS\asmthub3.sys

14:38:34.0653 0x09b4  asmthub3 - ok

14:38:34.0716 0x09b4  [ BAD70A5AC534C108F680A33C654BC626, 994FC917A2C737EAAD5A5F98056D56800AD8C0F3B43C7227B9888DE4DC3428CE ] asmtxhci        C:\Windows\system32\DRIVERS\asmtxhci.sys

14:38:34.0778 0x09b4  asmtxhci - ok

14:38:34.0919 0x09b4  [ 108FB6DDB69E537A2EA53F425363FAE5, B12A9F5338D39805E08A44A335FF7AA77F2266F535A2F5C8412CC746C75E5B1D ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

14:38:34.0965 0x09b4  aspnet_state - ok

14:38:35.0043 0x09b4  [ 954FFBFF05B0B60EB63B52AF561436C4, 40228A2B688E827815B5A567584FCF99BF661696DB8CC8BB455393B3CEE35094 ] AsSysCtrlService C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

14:38:35.0075 0x09b4  AsSysCtrlService - ok

14:38:35.0090 0x09b4  [ 26D66E32E78D3059715B3A17BC679CD9, 5039CB81CE0829C5F3DED16A4005FEB10141C6C9B473CC319E81BAF6D1DA33E3 ] AsUpIO          C:\Windows\syswow64\drivers\AsUpIO.sys

14:38:35.0121 0x09b4  AsUpIO - ok

14:38:35.0153 0x09b4  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

14:38:35.0246 0x09b4  AsyncMac - ok

14:38:35.0277 0x09b4  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys

14:38:35.0309 0x09b4  atapi - ok

14:38:35.0355 0x09b4  [ 770A3B0D78232B0C1054495392A1FBA3, 733BB08BAFE42E848F3A3CDFD80A2C37DB829CAD2E18B3D6299FDEE6EF30C9CD ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys

14:38:35.0418 0x09b4  AtiHDAudioService - ok

14:38:35.0449 0x09b4  [ C07A040D6B5A42DD41EE386CF90974C8, 8D47815F99C79B795504C3172B5FBBDBA6AFACC004B17AA3954A06BE713FACAE ] AtiPcie         C:\Windows\system32\DRIVERS\AtiPcie.sys

14:38:35.0465 0x09b4  AtiPcie - ok

14:38:35.0543 0x09b4  [ 4AEF9EC86818375495FB78CA58DF4E18, 0565888F798FAB86091E7A7D8E1D583DF3CC5756A12ACF04987C67C14E360DFB ] atksgt          C:\Windows\system32\DRIVERS\atksgt.sys

14:38:35.0589 0x09b4  atksgt - detected UnsignedFile.Multi.Generic ( 1 )

14:38:35.0589 0x09b4  atksgt ( UnsignedFile.Multi.Generic ) - warning

14:38:38.0725 0x09b4  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

14:38:38.0850 0x09b4  AudioEndpointBuilder - ok

14:38:38.0881 0x09b4  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv        C:\Windows\System32\Audiosrv.dll

14:38:39.0006 0x09b4  AudioSrv - ok

14:38:39.0084 0x09b4  [ 7806BFCD1D7FA5EC23F7324D4EAFD25B, 4EDFD9DE520728AF6578BED0054ED6A4976A7F020F3329EA6681D6E361D9DB2D ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys

14:38:39.0115 0x09b4  avgntflt - ok

14:38:39.0162 0x09b4  [ 4A175D2D30D31F7DF46F09B9A108E089, 6167D4E319B47C9759231EDEDF7F4199196CCDD332E8DB2137872FB15699B9F8 ] avgtp           C:\Windows\system32\drivers\avgtpx64.sys

14:38:39.0193 0x09b4  avgtp - ok

14:38:39.0240 0x09b4  [ C3A58DBD18786C338126D30BF8C33D72, 4DF4D37AB5139548C2DA4B4C8D6B933A7F4ED001BCA089EFBC8C57EEDE8785A6 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys

14:38:39.0271 0x09b4  avipbb - ok

14:38:39.0302 0x09b4  [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys

14:38:39.0318 0x09b4  avkmgr - ok

14:38:39.0349 0x09b4  [ 3DE0EBA0BF4771C897F544CBF7CB8973, 6A032503561414EDCE0D123947AECACBAFE4BBF7D9849BA2DF010E28235973AB ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys

14:38:39.0380 0x09b4  avnetflt - ok

14:38:39.0427 0x09b4  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll

14:38:39.0521 0x09b4  AxInstSV - ok

14:38:39.0567 0x09b4  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys

14:38:39.0661 0x09b4  b06bdrv - ok

14:38:39.0692 0x09b4  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

14:38:39.0770 0x09b4  b57nd60a - ok

14:38:39.0817 0x09b4  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll

14:38:39.0879 0x09b4  BDESVC - ok

14:38:39.0895 0x09b4  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys

14:38:39.0989 0x09b4  Beep - ok

14:38:40.0082 0x09b4  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll

14:38:40.0160 0x09b4  BFE - ok

14:38:40.0238 0x09b4  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\system32\qmgr.dll

14:38:40.0379 0x09b4  BITS - ok

14:38:40.0410 0x09b4  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys

14:38:40.0472 0x09b4  blbdrive - ok

14:38:40.0488 0x09b4  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

14:38:40.0535 0x09b4  bowser - ok

14:38:40.0566 0x09b4  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys

14:38:40.0628 0x09b4  BrFiltLo - ok

14:38:40.0659 0x09b4  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys

14:38:40.0691 0x09b4  BrFiltUp - ok

14:38:40.0722 0x09b4  [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys

14:38:40.0815 0x09b4  BridgeMP - ok

14:38:40.0847 0x09b4  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll

14:38:40.0878 0x09b4  Browser - ok

14:38:40.0909 0x09b4  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

14:38:40.0987 0x09b4  Brserid - ok

14:38:41.0018 0x09b4  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

14:38:41.0081 0x09b4  BrSerWdm - ok

14:38:41.0096 0x09b4  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

14:38:41.0143 0x09b4  BrUsbMdm - ok

14:38:41.0174 0x09b4  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

14:38:41.0205 0x09b4  BrUsbSer - ok

14:38:41.0252 0x09b4  [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum         C:\Windows\system32\DRIVERS\BthEnum.sys

14:38:41.0315 0x09b4  BthEnum - ok

14:38:41.0330 0x09b4  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys

14:38:41.0393 0x09b4  BTHMODEM - ok

14:38:41.0439 0x09b4  [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys

14:38:41.0486 0x09b4  BthPan - ok

14:38:41.0549 0x09b4  [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT         C:\Windows\system32\Drivers\BTHport.sys

14:38:41.0642 0x09b4  BTHPORT - ok

14:38:41.0689 0x09b4  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll

14:38:41.0798 0x09b4  bthserv - ok

14:38:41.0829 0x09b4  [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB          C:\Windows\system32\Drivers\BTHUSB.sys

14:38:41.0876 0x09b4  BTHUSB - ok

14:38:41.0892 0x09b4  catchme - ok

14:38:41.0923 0x09b4  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

14:38:42.0017 0x09b4  cdfs - ok

14:38:42.0079 0x09b4  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

14:38:42.0141 0x09b4  cdrom - ok

14:38:42.0188 0x09b4  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll

14:38:42.0282 0x09b4  CertPropSvc - ok

14:38:42.0407 0x09b4  [ 7B4AA3F4435950130BC0D9AC6F32DF36, 72EA4DC369145F00F45CC3D0BD3821DBBF0B46E59CDC7FE5C0E2C829C603BB8F ] CGVPNCliService C:\Program Files\CyberGhost 5\Service.exe

14:38:42.0422 0x09b4  CGVPNCliService - ok

14:38:42.0469 0x09b4  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys

14:38:42.0516 0x09b4  circlass - ok

14:38:42.0563 0x09b4  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys

14:38:42.0609 0x09b4  CLFS - ok

14:38:42.0656 0x09b4  [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

14:38:42.0687 0x09b4  clr_optimization_v2.0.50727_32 - ok

14:38:42.0719 0x09b4  [ D1CEEA2B47CB998321C579651CE3E4F8, 654013B8FD229A50017B08DEC6CA19C7DDA8CE0771260E057A92625201D539B1 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

14:38:42.0765 0x09b4  clr_optimization_v2.0.50727_64 - ok

14:38:42.0843 0x09b4  [ 6D7C8A951AF6AD6835C029B3CB88D333, 66F3D79887B2449B4C6912D1A258D1A96056888F51A8AA24FEDF37942AD5BDBB ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

14:38:42.0875 0x09b4  clr_optimization_v4.0.30319_32 - ok

14:38:42.0937 0x09b4  [ 86329C35FF23CFEF0FB6C0023BA06BCE, D915CE7AD564F97A1C3B047D5248B7EF67ADDC59687FBC90F1776C21DAA0D3FD ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

14:38:42.0984 0x09b4  clr_optimization_v4.0.30319_64 - ok

14:38:43.0015 0x09b4  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys

14:38:43.0062 0x09b4  CmBatt - ok

14:38:43.0109 0x09b4  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys

14:38:43.0140 0x09b4  cmdide - ok

14:38:43.0218 0x09b4  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\Windows\system32\Drivers\cng.sys

14:38:43.0280 0x09b4  CNG - ok

14:38:43.0296 0x09b4  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys

14:38:43.0327 0x09b4  Compbatt - ok

14:38:43.0374 0x09b4  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

14:38:43.0436 0x09b4  CompositeBus - ok

14:38:43.0452 0x09b4  COMSysApp - ok

14:38:43.0577 0x09b4  [ 3CA734CE373E5675FBC15CA2C45228E5, A6C6E9FABDE5EA18D266DB71C0CC6B51D682116D1898CCB4E9BA730F15C44B32 ] cpudrv64        C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys

14:38:43.0608 0x09b4  cpudrv64 - ok

14:38:43.0639 0x09b4  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys

14:38:43.0670 0x09b4  crcdisk - ok

14:38:43.0717 0x09b4  [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc        C:\Windows\system32\cryptsvc.dll

14:38:43.0764 0x09b4  CryptSvc - ok

14:38:43.0826 0x09b4  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys

14:38:43.0904 0x09b4  CSC - ok

14:38:43.0982 0x09b4  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll

14:38:44.0076 0x09b4  CscService - ok

14:38:44.0154 0x09b4  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll

14:38:44.0279 0x09b4  DcomLaunch - ok

14:38:44.0310 0x09b4  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll

14:38:44.0435 0x09b4  defragsvc - ok

14:38:44.0497 0x09b4  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

14:38:44.0575 0x09b4  DfsC - ok

14:38:44.0622 0x09b4  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll

14:38:44.0684 0x09b4  Dhcp - ok

14:38:44.0700 0x09b4  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys

14:38:44.0840 0x09b4  discache - ok

14:38:44.0934 0x09b4  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys

14:38:44.0965 0x09b4  Disk - ok

14:38:45.0012 0x09b4  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

14:38:45.0059 0x09b4  Dnscache - ok

14:38:45.0105 0x09b4  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll

14:38:45.0230 0x09b4  dot3svc - ok

14:38:45.0293 0x09b4  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll

14:38:45.0386 0x09b4  DPS - ok

14:38:45.0433 0x09b4  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

14:38:45.0480 0x09b4  drmkaud - ok

14:38:45.0542 0x09b4  [ 6A0E850DDCB136AA3D2FB7234382DF12, C01863E95F45E1B74AC65C9CD12C8DC769299218255B3C94E3EBF58C4D79FEF3 ] dtsoftbus01     C:\Windows\system32\DRIVERS\dtsoftbus01.sys

14:38:45.0573 0x09b4  dtsoftbus01 - ok

14:38:45.0683 0x09b4  [ 88612F1CE3BF42256913BF6E61C70D52, 7CF190F83FA8F15C33008EB381D3E345CEF37CBC046227DED26B36799EF4D9A7 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

14:38:45.0776 0x09b4  DXGKrnl - ok

14:38:45.0807 0x09b4  [ DD81D91FF3B0763C392422865C9AC12E, F5691B8F200E3196E6808E932630E862F8F26F31CD949981373F23C9D87DB8B9 ] e81a9dc1        C:\Windows\system32\rundll32.exe

14:38:45.0854 0x09b4  e81a9dc1 - ok

14:38:45.0885 0x09b4  EagleX64 - ok

14:38:45.0932 0x09b4  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll

14:38:46.0026 0x09b4  EapHost - ok

14:38:46.0244 0x09b4  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys

14:38:46.0541 0x09b4  ebdrv - ok

14:38:46.0572 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] EFS             C:\Windows\System32\lsass.exe

14:38:46.0619 0x09b4  EFS - ok

14:38:46.0681 0x09b4  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

14:38:46.0790 0x09b4  ehRecvr - ok

14:38:46.0821 0x09b4  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe

14:38:46.0884 0x09b4  ehSched - ok

14:38:46.0931 0x09b4  [ A05FC7ECA0966EBB70E4D17B855A853B, 16A0C8138A3BBD8BE2658261131F9777940CFB1431018A10710E5C1A88AB70EA ] ElbyCDIO        C:\Windows\system32\Drivers\ElbyCDIO.sys

14:38:46.0962 0x09b4  ElbyCDIO - ok

14:38:47.0024 0x09b4  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys

14:38:47.0102 0x09b4  elxstor - ok

14:38:47.0133 0x09b4  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys

14:38:47.0180 0x09b4  ErrDev - ok

14:38:47.0243 0x09b4  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll

14:38:47.0352 0x09b4  EventSystem - ok

14:38:47.0383 0x09b4  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys

14:38:47.0492 0x09b4  exfat - ok

14:38:47.0523 0x09b4  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys

14:38:47.0633 0x09b4  fastfat - ok

14:38:47.0711 0x09b4  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe

14:38:47.0804 0x09b4  Fax - ok

14:38:47.0835 0x09b4  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys

14:38:47.0867 0x09b4  fdc - ok

14:38:47.0882 0x09b4  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll

14:38:47.0991 0x09b4  fdPHost - ok

14:38:48.0007 0x09b4  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll

14:38:48.0101 0x09b4  FDResPub - ok

14:38:48.0132 0x09b4  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

14:38:48.0163 0x09b4  FileInfo - ok

14:38:48.0179 0x09b4  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

14:38:48.0272 0x09b4  Filetrace - ok

14:38:48.0272 0x09b4  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys

14:38:48.0319 0x09b4  flpydisk - ok

14:38:48.0335 0x09b4  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

14:38:48.0381 0x09b4  FltMgr - ok

14:38:48.0491 0x09b4  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll

14:38:48.0615 0x09b4  FontCache - ok

14:38:48.0662 0x09b4  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

14:38:48.0693 0x09b4  FontCache3.0.0.0 - ok

14:38:48.0787 0x09b4  [ 76FCBFD0C78DE110468B356F85EC6DB3, 38C71EF8C194982CA352D5B30F78F6FE6C2BC4CD3B8C318A90139332AEBEE073 ] ForceWare Intelligent Application Manager (IAM) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

14:38:48.0834 0x09b4  ForceWare Intelligent Application Manager (IAM) - ok

14:38:48.0849 0x09b4  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

14:38:48.0896 0x09b4  FsDepends - ok

14:38:48.0927 0x09b4  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

14:38:48.0943 0x09b4  Fs_Rec - ok

14:38:49.0005 0x09b4  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

14:38:49.0037 0x09b4  fvevol - ok

14:38:49.0068 0x09b4  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys

14:38:49.0115 0x09b4  gagp30kx - ok

14:38:49.0161 0x09b4  [ 16C2A6BCDDA8952C2035DEC861492A19, 9023CD3A2C1009786A48EF7FBCC97ED1724C836279424A4D465CCE1AFA2DBDDA ] ggflt           C:\Windows\system32\DRIVERS\ggflt.sys

14:38:49.0193 0x09b4  ggflt - ok

14:38:49.0208 0x09b4  [ 6B503DF845EABF3457E49FBBDA26C10E, A1553E3822EDEA26D8E67FCC7F9EA40DFBED49EC92FD5674AAF938F2D58CF964 ] ggsemc          C:\Windows\system32\DRIVERS\ggsemc.sys

14:38:49.0239 0x09b4  ggsemc - ok

14:38:49.0317 0x09b4  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll

14:38:49.0473 0x09b4  gpsvc - ok

14:38:49.0583 0x09b4  [ F02A533F517EB38333CB12A9E8963773, 1F72CD1CF660766FA8F912E40B7323A0192A300B376186C10F6803DC5EFE28DF ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

14:38:49.0614 0x09b4  gupdate - ok

14:38:49.0629 0x09b4  [ F02A533F517EB38333CB12A9E8963773, 1F72CD1CF660766FA8F912E40B7323A0192A300B376186C10F6803DC5EFE28DF ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

14:38:49.0661 0x09b4  gupdatem - ok

14:38:49.0707 0x09b4  [ 5D4BC124FAAE6730AC002CDB67BF1A1C, 00294F4DC7D17F6DD2A22B9C3299BED40146BA45C972367154D20DB502472551 ] gusvc           C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

14:38:49.0754 0x09b4  gusvc - ok

14:38:49.0785 0x09b4  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

14:38:49.0832 0x09b4  hcw85cir - ok

14:38:49.0895 0x09b4  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

14:38:49.0973 0x09b4  HdAudAddService - ok

14:38:50.0035 0x09b4  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys

14:38:50.0082 0x09b4  HDAudBus - ok

14:38:50.0113 0x09b4  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys

14:38:50.0144 0x09b4  HidBatt - ok

14:38:50.0160 0x09b4  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys

14:38:50.0222 0x09b4  HidBth - ok

14:38:50.0238 0x09b4  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys

14:38:50.0285 0x09b4  HidIr - ok

14:38:50.0331 0x09b4  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\System32\hidserv.dll

14:38:50.0409 0x09b4  hidserv - ok

14:38:50.0456 0x09b4  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\drivers\hidusb.sys

14:38:50.0487 0x09b4  HidUsb - ok

14:38:50.0565 0x09b4  [ B30B655AF441263BF2F4FE9B623EFD1E, 46C412F4066FAD8500A9184CA30401366A360A0C0A4AAFAAC1645EA74DD21E98 ] HiPatchService  C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

14:38:50.0581 0x09b4  HiPatchService - detected UnsignedFile.Multi.Generic ( 1 )

14:38:50.0581 0x09b4  HiPatchService ( UnsignedFile.Multi.Generic ) - warning

14:38:53.0483 0x09b4  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll

14:38:53.0576 0x09b4  hkmsvc - ok

14:38:53.0623 0x09b4  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll

14:38:53.0685 0x09b4  HomeGroupListener - ok

14:38:53.0748 0x09b4  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

14:38:53.0795 0x09b4  HomeGroupProvider - ok

14:38:53.0841 0x09b4  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

14:38:53.0873 0x09b4  HpSAMD - ok

14:38:53.0982 0x09b4  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

14:38:54.0153 0x09b4  HTTP - ok

14:38:54.0185 0x09b4  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

14:38:54.0200 0x09b4  hwpolicy - ok

14:38:54.0263 0x09b4  [ 4B7423FCC37664954460AC3E71752B62, D334D1C72691C1BF24A4D8133F61AD51B058A080F4501F05F12C673DCFE081F9 ] hxctlflt        C:\Windows\system32\Drivers\hxctlflt.sys

14:38:54.0309 0x09b4  hxctlflt - ok

14:38:54.0372 0x09b4  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys

14:38:54.0403 0x09b4  i8042prt - ok

14:38:54.0465 0x09b4  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

14:38:54.0528 0x09b4  iaStorV - ok

14:38:54.0637 0x09b4  [ 1CF03C69B49ACB70C722DF92755C0C8C, C227850C133F29BB9DED91A26A22AE077FD69629CEF35B67D305F016C4BDAA81 ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

14:38:54.0653 0x09b4  IDriverT - detected UnsignedFile.Multi.Generic ( 1 )

14:38:54.0653 0x09b4  IDriverT ( UnsignedFile.Multi.Generic ) - warning

14:38:57.0585 0x09b4  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD, 2B9512324DBA4A97F6AC34E8067EE08E3B6874CD60F6CB4209AFC22A34D2BE99 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

14:38:57.0695 0x09b4  idsvc - ok

14:38:57.0726 0x09b4  IEEtwCollectorService - ok

14:38:58.0490 0x09b4  [ 8CB8667F5A3B5515F2585F3254F3AAF7, 068E3E513AFF0ADAAB5EB5C019F13DD6D0BF4E8D69B98CFFCBA0368E04674CA8 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys

14:38:59.0457 0x09b4  igfx - ok

14:38:59.0504 0x09b4  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys

14:38:59.0535 0x09b4  iirsp - ok

14:38:59.0629 0x09b4  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll

14:38:59.0738 0x09b4  IKEEXT - ok

14:39:00.0081 0x09b4  [ 150AC23F21DBDBF8488408BA944B0D65, 77A3A0FB5208AA061224CFACC4D136A260132CC4BA01D105AE1532B749968708 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys

14:39:00.0393 0x09b4  IntcAzAudAddService - ok

14:39:00.0440 0x09b4  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys

14:39:00.0456 0x09b4  intelide - ok

14:39:00.0471 0x09b4  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

14:39:00.0534 0x09b4  intelppm - ok

14:39:00.0565 0x09b4  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

14:39:00.0674 0x09b4  IPBusEnum - ok

14:39:00.0721 0x09b4  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

14:39:00.0815 0x09b4  IpFilterDriver - ok

14:39:00.0877 0x09b4  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

14:39:00.0939 0x09b4  iphlpsvc - ok

14:39:00.0986 0x09b4  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

14:39:01.0017 0x09b4  IPMIDRV - ok

14:39:01.0049 0x09b4  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

14:39:01.0142 0x09b4  IPNAT - ok

14:39:01.0189 0x09b4  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys

14:39:01.0236 0x09b4  IRENUM - ok

14:39:01.0283 0x09b4  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

14:39:01.0314 0x09b4  isapnp - ok

14:39:01.0361 0x09b4  [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

14:39:01.0423 0x09b4  iScsiPrt - ok

14:39:01.0454 0x09b4  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys

14:39:01.0485 0x09b4  kbdclass - ok

14:39:01.0532 0x09b4  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys

14:39:01.0579 0x09b4  kbdhid - ok

14:39:01.0610 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] KeyIso          C:\Windows\system32\lsass.exe

14:39:01.0641 0x09b4  KeyIso - ok

14:39:01.0673 0x09b4  [ 8F489706472F7E9A06BAAA198703FA64, F020406690FB38EABD82D63B91D33039CC93ED52A5497AE12BAF475F22D0B08A ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

14:39:01.0704 0x09b4  KSecDD - ok

14:39:01.0719 0x09b4  [ 868A2CAAB12EFC7A021682BCA0EEC54C, 12C4925B5B3D6EA7B6410C01F33158C6EAB50CBD6AF445F8B04ED9899720C2DD ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

14:39:01.0751 0x09b4  KSecPkg - ok

14:39:01.0766 0x09b4  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

14:39:01.0860 0x09b4  ksthunk - ok

14:39:01.0922 0x09b4  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll

14:39:02.0047 0x09b4  KtmRm - ok

14:39:02.0078 0x09b4  [ 2AC603C3188C704CFCE353659AA7AD71, 0DAC2E8858221145FA35883BAE0D6484E60EB624158DE9F063FF209951CD1CDF ] L1E             C:\Windows\system32\DRIVERS\L1E62x64.sys

14:39:02.0125 0x09b4  L1E - ok

14:39:02.0187 0x09b4  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\System32\srvsvc.dll

14:39:02.0297 0x09b4  LanmanServer - ok

14:39:02.0343 0x09b4  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

14:39:02.0421 0x09b4  LanmanWorkstation - ok

14:39:02.0468 0x09b4  [ B658B7076B1ACAA5876524595630F183, 3B800B81D0966C2B988857847F35FCA5BB446B368063B10094FB4483A1508B8E ] lirsgt          C:\Windows\system32\DRIVERS\lirsgt.sys

14:39:02.0499 0x09b4  lirsgt - detected UnsignedFile.Multi.Generic ( 1 )

14:39:02.0499 0x09b4  lirsgt ( UnsignedFile.Multi.Generic ) - warning

14:39:05.0339 0x09b4  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

14:39:05.0432 0x09b4  lltdio - ok

14:39:05.0463 0x09b4  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll

14:39:05.0588 0x09b4  lltdsvc - ok

14:39:05.0619 0x09b4  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll

14:39:05.0697 0x09b4  lmhosts - ok

14:39:05.0760 0x09b4  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys

14:39:05.0807 0x09b4  LSI_FC - ok

14:39:05.0822 0x09b4  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys

14:39:05.0869 0x09b4  LSI_SAS - ok

14:39:05.0885 0x09b4  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys

14:39:05.0916 0x09b4  LSI_SAS2 - ok

14:39:05.0947 0x09b4  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys

14:39:05.0978 0x09b4  LSI_SCSI - ok

14:39:06.0009 0x09b4  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys

14:39:06.0103 0x09b4  luafv - ok

14:39:06.0150 0x09b4  [ 0BB97D43299910CBFBA59C461B99B910, 27C22D9D9EE8A410D7396960DA93E9E260D4DCDD38DCE06E85E45C5E24C067DE ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys

14:39:06.0181 0x09b4  MBAMProtector - ok

14:39:06.0243 0x09b4  [ 65085456FD9A74D7F1A999520C299ECB, EA564BC913EF1B8A4CAA9242FC70F525B68CF1F3CA462F63B0B7215B93FE8530 ] MBAMScheduler   C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

14:39:06.0290 0x09b4  MBAMScheduler - ok

14:39:06.0353 0x09b4  [ E0D7732F2D2E24B2DB3F67B6750295B8, AA5CA86AF1ACEC900F60339016B3DC55472DB40ADB99186005A7ABE67B7D66FC ] MBAMService     C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

14:39:06.0415 0x09b4  MBAMService - ok

14:39:06.0540 0x09b4  [ 968BFF74AEB683C962960ECE0CAE4135, 3E08B39DE27FE27A27BD3E81486F0FCA1947D4B50BFE0167A0C27CE48DD56793 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe

14:39:06.0587 0x09b4  McComponentHostService - ok

14:39:06.0633 0x09b4  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

14:39:06.0696 0x09b4  Mcx2Svc - ok

14:39:06.0727 0x09b4  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys

14:39:06.0758 0x09b4  megasas - ok

14:39:06.0789 0x09b4  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys

14:39:06.0836 0x09b4  MegaSR - ok

14:39:06.0883 0x09b4  [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys

14:39:06.0914 0x09b4  MEIx64 - ok

14:39:06.0945 0x09b4  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll

14:39:07.0039 0x09b4  MMCSS - ok

14:39:07.0070 0x09b4  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys

14:39:07.0148 0x09b4  Modem - ok

14:39:07.0195 0x09b4  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

14:39:07.0242 0x09b4  monitor - ok

14:39:07.0289 0x09b4  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\drivers\mouclass.sys

14:39:07.0335 0x09b4  mouclass - ok

14:39:07.0367 0x09b4  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

14:39:07.0413 0x09b4  mouhid - ok

14:39:07.0476 0x09b4  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

14:39:07.0507 0x09b4  mountmgr - ok

14:39:07.0585 0x09b4  [ 3B9398E0146855B1DC0E3D9769C80F01, DF69DB5CA30A5577648635C27DD468AF98515D07DF379B3FFDCC6B40744EDE66 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

14:39:07.0632 0x09b4  MozillaMaintenance - ok

14:39:07.0663 0x09b4  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys

14:39:07.0710 0x09b4  mpio - ok

14:39:07.0757 0x09b4  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

14:39:07.0850 0x09b4  mpsdrv - ok

14:39:07.0959 0x09b4  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll

14:39:08.0100 0x09b4  MpsSvc - ok

14:39:08.0147 0x09b4  [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

14:39:08.0193 0x09b4  MRxDAV - ok

14:39:08.0240 0x09b4  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

14:39:08.0287 0x09b4  mrxsmb - ok

14:39:08.0334 0x09b4  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

14:39:08.0412 0x09b4  mrxsmb10 - ok

14:39:08.0443 0x09b4  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

14:39:08.0474 0x09b4  mrxsmb20 - ok

14:39:08.0521 0x09b4  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys

14:39:08.0552 0x09b4  msahci - ok

14:39:08.0568 0x09b4  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

14:39:08.0615 0x09b4  msdsm - ok

14:39:08.0646 0x09b4  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe

14:39:08.0693 0x09b4  MSDTC - ok

14:39:08.0724 0x09b4  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

14:39:08.0802 0x09b4  Msfs - ok

14:39:08.0817 0x09b4  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

14:39:08.0911 0x09b4  mshidkmdf - ok

14:39:08.0942 0x09b4  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

14:39:08.0973 0x09b4  msisadrv - ok

14:39:09.0020 0x09b4  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

14:39:09.0129 0x09b4  MSiSCSI - ok

14:39:09.0145 0x09b4  msiserver - ok

14:39:09.0176 0x09b4  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

14:39:09.0270 0x09b4  MSKSSRV - ok

14:39:09.0301 0x09b4  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

14:39:09.0379 0x09b4  MSPCLOCK - ok

14:39:09.0395 0x09b4  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

14:39:09.0488 0x09b4  MSPQM - ok

14:39:09.0535 0x09b4  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

14:39:09.0582 0x09b4  MsRPC - ok

14:39:09.0613 0x09b4  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

14:39:09.0629 0x09b4  mssmbios - ok

14:39:09.0644 0x09b4  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

14:39:09.0738 0x09b4  MSTEE - ok

14:39:09.0753 0x09b4  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys

14:39:09.0800 0x09b4  MTConfig - ok

14:39:09.0847 0x09b4  [ 19B006B181E3875FD254F7B67ACF1E7C, 1D68D19522E71F16B8B50F8CCFBC9D884CF2DAC40CC409BD5A40A4D4223ABC61 ] MTsensor        C:\Windows\system32\DRIVERS\ASACPI.sys

14:39:09.0863 0x09b4  MTsensor - ok

14:39:09.0894 0x09b4  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys

14:39:09.0909 0x09b4  Mup - ok

14:39:09.0987 0x09b4  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll

14:39:10.0097 0x09b4  napagent - ok

14:39:10.0159 0x09b4  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

14:39:10.0284 0x09b4  NativeWifiP - ok

14:39:10.0455 0x09b4  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys

14:39:10.0533 0x09b4  NDIS - ok

14:39:10.0565 0x09b4  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

14:39:10.0658 0x09b4  NdisCap - ok

14:39:10.0689 0x09b4  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

14:39:10.0783 0x09b4  NdisTapi - ok

14:39:10.0830 0x09b4  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

14:39:10.0908 0x09b4  Ndisuio - ok

14:39:10.0955 0x09b4  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

14:39:11.0064 0x09b4  NdisWan - ok

14:39:11.0095 0x09b4  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

14:39:11.0204 0x09b4  NDProxy - ok

14:39:11.0329 0x09b4  [ B90E093E7A7250906F1054418B5339C0, F9A0BAC5B4B29F14B5CACA1047F8928A495EFD56E485492BF71C856B296476D6 ] Nero BackItUp Scheduler 4.0 C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

14:39:11.0438 0x09b4  Nero BackItUp Scheduler 4.0 - ok

14:39:11.0454 0x09b4  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

14:39:11.0547 0x09b4  NetBIOS - ok

14:39:11.0579 0x09b4  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

14:39:11.0688 0x09b4  NetBT - ok

14:39:11.0703 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] Netlogon        C:\Windows\system32\lsass.exe

14:39:11.0735 0x09b4  Netlogon - ok

14:39:11.0766 0x09b4  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll

14:39:11.0875 0x09b4  Netman - ok

14:39:11.0937 0x09b4  [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:39:12.0000 0x09b4  NetMsmqActivator - ok

14:39:12.0031 0x09b4  [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:39:12.0078 0x09b4  NetPipeActivator - ok

14:39:12.0109 0x09b4  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll

14:39:12.0234 0x09b4  netprofm - ok

14:39:12.0327 0x09b4  [ F3A1D8B7317939813568992D1BFDDE37, 816829E4B8DF5C6A2B09685ED45E844D8DE2C2721C90490A2957227025D057A0 ] netr7364        C:\Windows\system32\DRIVERS\netr7364.sys

14:39:12.0390 0x09b4  netr7364 - ok

14:39:12.0421 0x09b4  [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:39:12.0452 0x09b4  NetTcpActivator - ok

14:39:12.0468 0x09b4  [ 5243CFC2E7161C91C2B355240035B9E4, CFD77485A9D7BC47F3A9C53D73B2AE2D5D04B90ED38628F3124EA569F4DE969E ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

14:39:12.0499 0x09b4  NetTcpPortSharing - ok

14:39:12.0546 0x09b4  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys

14:39:12.0577 0x09b4  nfrd960 - ok

14:39:12.0639 0x09b4  [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc          C:\Windows\System32\nlasvc.dll

14:39:12.0702 0x09b4  NlaSvc - ok

14:39:12.0733 0x09b4  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys

14:39:12.0827 0x09b4  Npfs - ok

14:39:12.0842 0x09b4  npggsvc - ok

14:39:12.0873 0x09b4  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll

14:39:12.0967 0x09b4  nsi - ok

14:39:12.0983 0x09b4  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

14:39:13.0076 0x09b4  nsiproxy - ok

14:39:13.0139 0x09b4  [ 13C0D9CBA38FFA6D0C9E721B5E7212A0, 41F38AA6111FCE5D0CF63E7CC289645C7B51BCD353690700B8ECBFC03CF51FA9 ] nSvcIp          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

14:39:13.0170 0x09b4  nSvcIp - ok

14:39:13.0295 0x09b4  [ B98F8C6E31CD07B2E6F71F7F648E38C0, 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

14:39:13.0419 0x09b4  Ntfs - ok

14:39:13.0435 0x09b4  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys

14:39:13.0513 0x09b4  Null - ok

14:39:13.0560 0x09b4  [ 0EBC9D13CD96C15B1B18D8678A609E4B, B10896DE16B0C102DFB3E73A6C11A1982C5B428015DAE1F8776BCEF94A0F75C6 ] nusb3hub        C:\Windows\system32\DRIVERS\nusb3hub.sys

14:39:13.0591 0x09b4  nusb3hub - ok

14:39:13.0622 0x09b4  [ 7BDEC000D56D485021D9C1E63C2F81CA, 7F1303FD0371AF8715BFC38433B730C797170AEF10C7DB845B7B547DA8DBB5D5 ] nusb3xhc        C:\Windows\system32\DRIVERS\nusb3xhc.sys

14:39:13.0669 0x09b4  nusb3xhc - ok

14:39:13.0731 0x09b4  [ A85B4F2EF3A7304A5399EF0526423040, E45854691BA6AE36E53C2922CC93FF13DC2D84CBE7FE13A2F0B1CE1C16D1D158 ] NVENETFD        C:\Windows\system32\DRIVERS\nvm62x64.sys

14:39:13.0809 0x09b4  NVENETFD - ok

14:39:13.0856 0x09b4  [ F2662FDC20518EE8A8EED4F61BA42349, 4E8810345AA7D878DC21AE0A2E6ED201FC90EE112D6D13961A8D697A98716B3F ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys

14:39:13.0887 0x09b4  NVHDA - ok

14:39:14.0714 0x09b4  [ A963C2C276A97B088DED5D7A83BE8052, 1D3A238380C33D0668970C72B0AF842050AE9A12865D117FEDA1E2F6F7BFC715 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys

14:39:15.0603 0x09b4  nvlddmkm - ok

14:39:15.0681 0x09b4  [ BD25E03EAD63AC3365F25175B4DBD56A, 503AB5D064672E1F1A56BBF1339909BDE641ADAA05C6FA6794ED7E045C557062 ] NVNET           C:\Windows\system32\DRIVERS\nvmf6264.sys

14:39:15.0744 0x09b4  NVNET - ok

14:39:15.0791 0x09b4  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys

14:39:15.0837 0x09b4  nvraid - ok

14:39:15.0869 0x09b4  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys

14:39:15.0900 0x09b4  nvstor - ok

14:39:15.0931 0x09b4  [ 71B6ECD3C56FBF12FB1968DA3953B703, 47E39FBC336C9BFC159AA0FF9D8DEE950724ABB782102858E397A7EF87112584 ] nvstor64        C:\Windows\system32\DRIVERS\nvstor64.sys

14:39:15.0978 0x09b4  nvstor64 - ok

14:39:16.0087 0x09b4  [ DD9D86051B8F7669AABF693530F380FE, 22AE65C82F29330DAD1856857AC0458347CACE445E2088D6ABEB74BA24C1F528 ] NVSvc           C:\Windows\system32\nvvsvc.exe

14:39:16.0165 0x09b4  NVSvc - ok

14:39:16.0196 0x09b4  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

14:39:16.0227 0x09b4  nv_agp - ok

14:39:16.0274 0x09b4  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

14:39:16.0337 0x09b4  ohci1394 - ok

14:39:16.0383 0x09b4  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

14:39:16.0446 0x09b4  p2pimsvc - ok

14:39:16.0493 0x09b4  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll

14:39:16.0571 0x09b4  p2psvc - ok

14:39:16.0617 0x09b4  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys

14:39:16.0664 0x09b4  Parport - ok

14:39:16.0711 0x09b4  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys

14:39:16.0742 0x09b4  partmgr - ok

14:39:16.0773 0x09b4  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll

14:39:16.0836 0x09b4  PcaSvc - ok

14:39:16.0867 0x09b4  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys

14:39:16.0898 0x09b4  pci - ok

14:39:16.0929 0x09b4  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys

14:39:16.0961 0x09b4  pciide - ok

14:39:16.0992 0x09b4  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys

14:39:17.0039 0x09b4  pcmcia - ok

14:39:17.0054 0x09b4  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys

14:39:17.0085 0x09b4  pcw - ok

14:39:17.0132 0x09b4  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

14:39:17.0288 0x09b4  PEAUTH - ok

14:39:17.0382 0x09b4  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll

14:39:17.0522 0x09b4  PeerDistSvc - ok

14:39:17.0600 0x09b4  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe

14:39:17.0647 0x09b4  PerfHost - ok

14:39:17.0772 0x09b4  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll

14:39:17.0990 0x09b4  pla - ok

14:39:18.0037 0x09b4  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

14:39:18.0115 0x09b4  PlugPlay - ok

14:39:18.0146 0x09b4  PnkBstrA - ok

14:39:18.0162 0x09b4  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

14:39:18.0224 0x09b4  PNRPAutoReg - ok

14:39:18.0255 0x09b4  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

14:39:18.0302 0x09b4  PNRPsvc - ok

14:39:18.0349 0x09b4  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

14:39:18.0474 0x09b4  PolicyAgent - ok

14:39:18.0521 0x09b4  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll

14:39:18.0614 0x09b4  Power - ok

14:39:18.0677 0x09b4  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

14:39:18.0786 0x09b4  PptpMiniport - ok

14:39:18.0801 0x09b4  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys

14:39:18.0848 0x09b4  Processor - ok

14:39:18.0895 0x09b4  [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc         C:\Windows\system32\profsvc.dll

14:39:18.0942 0x09b4  ProfSvc - ok

14:39:18.0973 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] ProtectedStorage C:\Windows\system32\lsass.exe

14:39:19.0004 0x09b4  ProtectedStorage - ok

14:39:19.0051 0x09b4  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

14:39:19.0145 0x09b4  Psched - ok

14:39:19.0285 0x09b4  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys

14:39:19.0410 0x09b4  ql2300 - ok

14:39:19.0425 0x09b4  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys

14:39:19.0472 0x09b4  ql40xx - ok

14:39:19.0503 0x09b4  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll

14:39:19.0566 0x09b4  QWAVE - ok

14:39:19.0597 0x09b4  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

14:39:19.0644 0x09b4  QWAVEdrv - ok

14:39:19.0659 0x09b4  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

14:39:19.0737 0x09b4  RasAcd - ok

14:39:19.0769 0x09b4  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

14:39:19.0862 0x09b4  RasAgileVpn - ok

14:39:19.0878 0x09b4  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll

14:39:19.0987 0x09b4  RasAuto - ok

14:39:20.0049 0x09b4  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

14:39:20.0143 0x09b4  Rasl2tp - ok

14:39:20.0205 0x09b4  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll

14:39:20.0315 0x09b4  RasMan - ok

14:39:20.0346 0x09b4  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

14:39:20.0455 0x09b4  RasPppoe - ok

14:39:20.0549 0x09b4  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

14:39:20.0658 0x09b4  RasSstp - ok

14:39:20.0689 0x09b4  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

14:39:20.0798 0x09b4  rdbss - ok

14:39:20.0814 0x09b4  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys

14:39:20.0861 0x09b4  rdpbus - ok

14:39:20.0892 0x09b4  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

14:39:20.0970 0x09b4  RDPCDD - ok

14:39:21.0017 0x09b4  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys

14:39:21.0063 0x09b4  RDPDR - ok

14:39:21.0110 0x09b4  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

14:39:21.0204 0x09b4  RDPENCDD - ok

14:39:21.0219 0x09b4  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

14:39:21.0297 0x09b4  RDPREFMP - ok

14:39:21.0344 0x09b4  [ 70CBA1A0C98600A2AA1863479B35CB90, 91A133297921B4955817176251AFC5283DA3C7D2099700C4C92ECC94DBE9A99E ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys

14:39:21.0391 0x09b4  RdpVideoMiniport - ok

14:39:21.0422 0x09b4  [ E61608AA35E98999AF9AAEEEA6114B0A, F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

14:39:21.0469 0x09b4  RDPWD - ok

14:39:21.0516 0x09b4  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

14:39:21.0563 0x09b4  rdyboost - ok

14:39:21.0594 0x09b4  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll

14:39:21.0703 0x09b4  RemoteAccess - ok

14:39:21.0734 0x09b4  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

14:39:21.0843 0x09b4  RemoteRegistry - ok

14:39:21.0906 0x09b4  [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys

14:39:21.0968 0x09b4  RFCOMM - ok

14:39:21.0999 0x09b4  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

14:39:22.0093 0x09b4  RpcEptMapper - ok

14:39:22.0124 0x09b4  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe

14:39:22.0171 0x09b4  RpcLocator - ok

14:39:22.0233 0x09b4  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll

14:39:22.0343 0x09b4  RpcSs - ok

14:39:22.0389 0x09b4  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

14:39:22.0483 0x09b4  rspndr - ok

14:39:22.0561 0x09b4  [ 3B5809E9D3B8995FB65A82CB92745072, 6316AB7AD76B46AEF83E20FDF04BF2C592A7A9D43E9D618973D19CC2A9B81E8A ] RT73            C:\Windows\system32\DRIVERS\Dr71WU.sys

14:39:22.0639 0x09b4  RT73 - ok

14:39:22.0733 0x09b4  [ 8181B5E7BFC040E0B26349C73E719335, EBB244A7E8E2CDC51041B2C2A78DCB77324F9E3746942C84902FCD928ADED897 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys

14:39:22.0795 0x09b4  RTL8167 - ok

14:39:22.0873 0x09b4  [ 9269EF78A780A3161087DF1BEC117DC8, 4DABD74C2918213147B81FC5C26B2140D4FED0D8F741388A14393AD47D293632 ] RTL85n64        C:\Windows\system32\DRIVERS\RTL85n64.sys

14:39:22.0935 0x09b4  RTL85n64 - ok

14:39:22.0982 0x09b4  [ E16B7C030A05EF649B18FAB0A93D871F, 0F532D534A93D71650E2F7AF677419A6B38CE3142C98983565F1D759E544A4ED ] RtNdPt60        C:\Windows\system32\DRIVERS\RtNdPt60.sys

14:39:23.0013 0x09b4  RtNdPt60 - ok

14:39:23.0045 0x09b4  [ 1DE78F5008120CD79B34C12394DCD493, 58C59BEEE2F1C1C6CE810BA433C0D5789B4E6F218A074868137960663CB54802 ] RTTEAMPT        C:\Windows\system32\DRIVERS\RtTeam60.sys

14:39:23.0076 0x09b4  RTTEAMPT - ok

14:39:23.0107 0x09b4  [ ED0624ED83121E1BC141F49B1316CAA0, 322CA21FE679910827F39CFCD3511400CABDA1133F5E0B5031186C94741FAF1E ] RTVLANPT        C:\Windows\system32\DRIVERS\RtVlan620.sys

14:39:23.0138 0x09b4  RTVLANPT - ok

14:39:23.0185 0x09b4  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys

14:39:23.0232 0x09b4  s3cap - ok

14:39:23.0247 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] SamSs           C:\Windows\system32\lsass.exe

14:39:23.0279 0x09b4  SamSs - ok

14:39:23.0325 0x09b4  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

14:39:23.0357 0x09b4  sbp2port - ok

14:39:23.0403 0x09b4  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll

14:39:23.0513 0x09b4  SCardSvr - ok

14:39:23.0591 0x09b4  [ 3A09F31454DFEFBB124BAF378F90B636, ACDDD348CEE5147AD3A6EFE5A1C7576AC9CE699011F843BE93F800B1D2BD8F46 ] SCDEmu          C:\Windows\system32\drivers\SCDEmu.sys

14:39:23.0622 0x09b4  SCDEmu - ok

14:39:23.0669 0x09b4  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

14:39:23.0762 0x09b4  scfilter - ok

14:39:23.0856 0x09b4  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll

14:39:24.0027 0x09b4  Schedule - ok

14:39:24.0059 0x09b4  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll

14:39:24.0137 0x09b4  SCPolicySvc - ok

14:39:24.0183 0x09b4  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

14:39:24.0230 0x09b4  SDRSVC - ok

14:39:24.0261 0x09b4  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys

14:39:24.0371 0x09b4  secdrv - ok

14:39:24.0402 0x09b4  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll

14:39:24.0495 0x09b4  seclogon - ok

14:39:24.0527 0x09b4  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\system32\sens.dll

14:39:24.0605 0x09b4  SENS - ok

14:39:24.0620 0x09b4  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll

14:39:24.0683 0x09b4  SensrSvc - ok

14:39:24.0714 0x09b4  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys

14:39:24.0761 0x09b4  Serenum - ok

14:39:24.0776 0x09b4  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys

14:39:24.0839 0x09b4  Serial - ok

14:39:24.0885 0x09b4  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys

14:39:24.0917 0x09b4  sermouse - ok

14:39:24.0979 0x09b4  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll

14:39:25.0073 0x09b4  SessionEnv - ok

14:39:25.0119 0x09b4  [ 4FCACE92BB0345D58BB96ADBD69F5237, 958067CFE2DC0BE0BC407E1309EE8859652A293F0F914DC7511B2F391FE8DF7F ] sfdrv01         C:\Windows\system32\drivers\sfdrv01.sys

14:39:25.0151 0x09b4  sfdrv01 - ok

14:39:25.0182 0x09b4  [ ADDC96399ACDF3C4DD690C74B835082E, 4CB28EE2B507C0F519C5DD529DEE2AD24DB123DE8BAE589351A11A33543E2616 ] sfdrv01a        C:\Windows\system32\drivers\sfdrv01a.sys

14:39:25.0213 0x09b4  sfdrv01a - ok

14:39:25.0244 0x09b4  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

14:39:25.0291 0x09b4  sffdisk - ok

14:39:25.0322 0x09b4  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

14:39:25.0369 0x09b4  sffp_mmc - ok

14:39:25.0400 0x09b4  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

14:39:25.0447 0x09b4  sffp_sd - ok

14:39:25.0463 0x09b4  [ 17F6BD95BF04B924F4C05CE78BEF8AE6, 68D38DC04349DA476B62F853B165EE6B6F42054BCAF2B8F615A6E6BAACD35EB4 ] sfhlp02         C:\Windows\system32\drivers\sfhlp02.sys

14:39:25.0494 0x09b4  sfhlp02 - ok

14:39:25.0509 0x09b4  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys

14:39:25.0556 0x09b4  sfloppy - ok

14:39:25.0572 0x09b4  [ B02C284AAC97C61B707AD7400F36A067, 9235C5CD6BBC94A9CD516C523DDD5E34642198CF092C30914F6070C8B85BF45C ] sfsync04        C:\Windows\system32\drivers\sfsync04.sys

14:39:25.0603 0x09b4  sfsync04 - ok

14:39:25.0619 0x09b4  [ F3B72568A6FA36E5D63D30B8186D1C48, 8B6A7C8595182356F5B5B9F8DE4AC1F8926DBF0EEB68DA196FCF3512F1FD24FA ] sfvfs02         C:\Windows\system32\drivers\sfvfs02.sys

14:39:25.0650 0x09b4  sfvfs02 - ok

14:39:25.0712 0x09b4  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll

14:39:25.0821 0x09b4  SharedAccess - ok

14:39:25.0853 0x09b4  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll

14:39:25.0946 0x09b4  ShellHWDetection - ok

14:39:25.0977 0x09b4  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys

14:39:26.0009 0x09b4  SiSRaid2 - ok

14:39:26.0024 0x09b4  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys

14:39:26.0071 0x09b4  SiSRaid4 - ok

14:39:26.0149 0x09b4  [ F5BBEDF602C310B00036EB2DBF4348A5, AC2712E639F0C54BCF00EB4E90E805335871EA27AE8A45DFC53EDF28822318C4 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe

14:39:26.0180 0x09b4  SkypeUpdate - ok

14:39:26.0196 0x09b4  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

14:39:26.0305 0x09b4  Smb - ok

14:39:26.0352 0x09b4  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

14:39:26.0399 0x09b4  SNMPTRAP - ok

14:39:26.0664 0x09b4  [ BA2E864CDC01731A4F144019FB3BF598, BFBD8650C860C1F42DF4EFD610FF39773D2A30E30F4D26A88EC1797540B32A3B ] SNP2UVC         C:\Windows\system32\DRIVERS\snp2uvc.sys

14:39:26.0945 0x09b4  SNP2UVC - ok

14:39:27.0038 0x09b4  [ 3A4F2C0BB87A0895ABEBA341AA1E341B, 4DADEEF3C5D181502D6F4A00FBBF3B001FA626E49569FB330D7AE2955CC7DE08 ] Sony PC Companion C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe

14:39:27.0085 0x09b4  Sony PC Companion - ok

14:39:27.0101 0x09b4  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys

14:39:27.0132 0x09b4  spldr - ok

14:39:27.0194 0x09b4  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe

14:39:27.0272 0x09b4  Spooler - ok

14:39:27.0522 0x09b4  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe

14:39:27.0865 0x09b4  sppsvc - ok

14:39:27.0896 0x09b4  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

14:39:27.0990 0x09b4  sppuinotify - ok

14:39:28.0052 0x09b4  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys

14:39:28.0115 0x09b4  srv - ok

14:39:28.0161 0x09b4  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

14:39:28.0224 0x09b4  srv2 - ok

14:39:28.0255 0x09b4  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

14:39:28.0317 0x09b4  srvnet - ok

14:39:28.0364 0x09b4  [ 8F8324ED1DE63FFC7B1A02CD2D963C72, E58603F81DEAFF1D45CB83FB6E625E6A13868741B833B1C9E60D672179D18EE0 ] ssadbus         C:\Windows\system32\DRIVERS\ssadbus.sys

14:39:28.0427 0x09b4  ssadbus - ok

14:39:28.0473 0x09b4  [ 58221EFCB74167B73667F0024C661CE0, D9B67A8897B4DC3E4729187F17ABEB4710CF57440D718E17ED828439198D34DB ] ssadmdfl        C:\Windows\system32\DRIVERS\ssadmdfl.sys

14:39:28.0505 0x09b4  ssadmdfl - ok

14:39:28.0551 0x09b4  [ 4DA7C71BFAC5AD71255B7E4CAB980163, 4CC0F9C8E96ECEF36EEB021E448A9734B63512D030516DC38B1A2EEAA1043AEC ] ssadmdm         C:\Windows\system32\DRIVERS\ssadmdm.sys

14:39:28.0614 0x09b4  ssadmdm - ok

14:39:28.0661 0x09b4  [ D33D1BD3EC0E766211A234F56A12726D, 53EEAA94865554F8422D111D717B548DF553B5B8647D2A45F3718BF4AEEBEC27 ] ssadserd        C:\Windows\system32\DRIVERS\ssadserd.sys

14:39:28.0707 0x09b4  ssadserd - ok

14:39:28.0739 0x09b4  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

14:39:28.0832 0x09b4  SSDPSRV - ok

14:39:28.0848 0x09b4  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll

14:39:28.0941 0x09b4  SstpSvc - ok

14:39:29.0051 0x09b4  [ C3D855CC0A8E5E373FDFCF4F743C5C9D, 8DFDD2470DCCC63FCF1621B6B3A996285C75EE330BE8AC905B2176E5DE52C150 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe

14:39:29.0129 0x09b4  Steam Client Service - ok

14:39:29.0207 0x09b4  [ A2ABC52CD8A5B60262B220A17A92EB31, 357A1E5E6151B92F49FB6493D38DC0D1D25E53BDB097F0E2494916EDFA57AA9D ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

14:39:29.0253 0x09b4  Stereo Service - ok

14:39:29.0269 0x09b4  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys

14:39:29.0300 0x09b4  stexstor - ok

14:39:29.0394 0x09b4  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll

14:39:29.0487 0x09b4  stisvc - ok

14:39:29.0519 0x09b4  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys

14:39:29.0550 0x09b4  storflt - ok

14:39:29.0565 0x09b4  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll

14:39:29.0612 0x09b4  StorSvc - ok

14:39:29.0628 0x09b4  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys

14:39:29.0659 0x09b4  storvsc - ok

14:39:29.0675 0x09b4  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys

14:39:29.0706 0x09b4  swenum - ok

14:39:29.0753 0x09b4  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll

14:39:29.0893 0x09b4  swprv - ok

14:39:29.0924 0x09b4  Synth3dVsc - ok

14:39:30.0065 0x09b4  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll

14:39:30.0236 0x09b4  SysMain - ok

14:39:30.0283 0x09b4  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll

14:39:30.0345 0x09b4  TabletInputService - ok

14:39:30.0408 0x09b4  [ 3C32FF010F869BC184DF71290477384E, 55CFCEC7F026C6E2E96A2FBE846AB513BB12BB0348735274FE1B71AF019C837B ] tap0901         C:\Windows\system32\DRIVERS\tap0901.sys

14:39:30.0439 0x09b4  tap0901 - ok

14:39:30.0486 0x09b4  [ B08740047145B9BCE15BF75CA0F9718A, 3E2A8A5A2A4DC4D0F05E22EA2C0EBD85AA5C7C6854E873D53538D1F54B8F7C63 ] tap0901t        C:\Windows\system32\DRIVERS\tap0901t.sys

14:39:30.0517 0x09b4  tap0901t - detected UnsignedFile.Multi.Generic ( 1 )

14:39:30.0517 0x09b4  tap0901t ( UnsignedFile.Multi.Generic ) - warning

14:39:44.0385 0x09b4  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll

14:39:44.0495 0x09b4  TapiSrv - ok

14:39:44.0526 0x09b4  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll

14:39:44.0619 0x09b4  TBS - ok

14:39:44.0775 0x09b4  [ 40AF23633D197905F03AB5628C558C51, 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

14:39:44.0900 0x09b4  Tcpip - ok

14:39:45.0041 0x09b4  [ 40AF23633D197905F03AB5628C558C51, 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

14:39:45.0165 0x09b4  TCPIP6 - ok

14:39:45.0197 0x09b4  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

14:39:45.0243 0x09b4  tcpipreg - ok

14:39:45.0275 0x09b4  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

14:39:45.0321 0x09b4  TDPIPE - ok

14:39:45.0353 0x09b4  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

14:39:45.0399 0x09b4  TDTCP - ok

14:39:45.0431 0x09b4  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

14:39:45.0524 0x09b4  tdx - ok

14:39:45.0540 0x09b4  [ 1DE78F5008120CD79B34C12394DCD493, 58C59BEEE2F1C1C6CE810BA433C0D5789B4E6F218A074868137960663CB54802 ] TEAM            C:\Windows\system32\DRIVERS\RtTeam60.sys

14:39:45.0555 0x09b4  TEAM - ok

14:39:45.0602 0x09b4  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys

14:39:45.0633 0x09b4  TermDD - ok

14:39:45.0711 0x09b4  [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService     C:\Windows\System32\termsrv.dll

14:39:45.0852 0x09b4  TermService - ok

14:39:45.0883 0x09b4  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll

14:39:45.0930 0x09b4  Themes - ok

14:39:45.0961 0x09b4  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll

14:39:46.0039 0x09b4  THREADORDER - ok

14:39:46.0133 0x09b4  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll

14:39:46.0226 0x09b4  TrkWks - ok

14:39:46.0351 0x09b4  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

14:39:46.0445 0x09b4  TrustedInstaller - ok

14:39:46.0491 0x09b4  [ 4CE278FC9671BA81A138D70823FCAA09, CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

14:39:46.0523 0x09b4  tssecsrv - ok

14:39:46.0569 0x09b4  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

14:39:46.0616 0x09b4  TsUsbFlt - ok

14:39:46.0632 0x09b4  tsusbhub - ok

14:39:46.0694 0x09b4  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

14:39:46.0772 0x09b4  tunnel - ok

14:39:46.0866 0x09b4  [ 2FD0FE0A0C721C8E47C5A3AE16E519B1, C0DE61AF32F01CF9BDA3E325F5F15D249C0FA4BB5FF720ED1916214907B4AF55 ] TunngleService  C:\Program Files (x86)\Tunngle\TnglCtrl.exe

14:39:46.0975 0x09b4  TunngleService - detected UnsignedFile.Multi.Generic ( 1 )

14:39:46.0975 0x09b4  TunngleService ( UnsignedFile.Multi.Generic ) - warning

14:39:49.0814 0x09b4  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys

14:39:49.0861 0x09b4  uagp35 - ok

14:39:49.0924 0x09b4  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

14:39:50.0048 0x09b4  udfs - ok

14:39:50.0095 0x09b4  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe

14:39:50.0142 0x09b4  UI0Detect - ok

14:39:50.0189 0x09b4  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

14:39:50.0220 0x09b4  uliagpkx - ok

14:39:50.0267 0x09b4  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\drivers\umbus.sys

14:39:50.0329 0x09b4  umbus - ok

14:39:50.0345 0x09b4  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys

14:39:50.0376 0x09b4  UmPass - ok

14:39:50.0423 0x09b4  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll

14:39:50.0485 0x09b4  UmRdpService - ok

14:39:50.0532 0x09b4  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll

14:39:50.0657 0x09b4  upnphost - ok

14:39:50.0719 0x09b4  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys

14:39:50.0782 0x09b4  usbaudio - ok

14:39:50.0828 0x09b4  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

14:39:50.0860 0x09b4  usbccgp - ok

14:39:50.0891 0x09b4  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys

14:39:50.0938 0x09b4  usbcir - ok

14:39:50.0969 0x09b4  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys

14:39:51.0016 0x09b4  usbehci - ok

14:39:51.0078 0x09b4  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

14:39:51.0140 0x09b4  usbhub - ok

14:39:51.0187 0x09b4  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys

14:39:51.0218 0x09b4  usbohci - ok

14:39:51.0250 0x09b4  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

14:39:51.0296 0x09b4  usbprint - ok

14:39:51.0328 0x09b4  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

14:39:51.0406 0x09b4  USBSTOR - ok

14:39:51.0468 0x09b4  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys

14:39:51.0484 0x09b4  usbuhci - ok

14:39:51.0562 0x09b4  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys

14:39:51.0624 0x09b4  usbvideo - ok

14:39:51.0655 0x09b4  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll

14:39:51.0733 0x09b4  UxSms - ok

14:39:51.0749 0x09b4  [ 4D71227301DD8D09097B9E4CC6527E5A, 193D47ADCB722B581CC0F29B794AB3E455B6E9BEA367CE9A5216A09E055B7F1E ] VaultSvc        C:\Windows\system32\lsass.exe

14:39:51.0780 0x09b4  VaultSvc - ok

14:39:51.0811 0x09b4  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

14:39:51.0842 0x09b4  vdrvroot - ok

14:39:51.0920 0x09b4  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe

14:39:52.0061 0x09b4  vds - ok

14:39:52.0092 0x09b4  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

14:39:52.0123 0x09b4  vga - ok

14:39:52.0139 0x09b4  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys

14:39:52.0232 0x09b4  VgaSave - ok

14:39:52.0248 0x09b4  VGPU - ok

14:39:52.0295 0x09b4  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

14:39:52.0357 0x09b4  vhdmp - ok

14:39:52.0466 0x09b4  [ BA1DA5CD689E9473D99731A2E1FF2FB5, 10DC100D4723058E6DBB26679E9DA4E46C90367D11C221636236300C2BB45CCD ] VIAHdAudAddService C:\Windows\system32\drivers\viahduaa.sys

14:39:52.0638 0x09b4  VIAHdAudAddService - ok

14:39:52.0685 0x09b4  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys

14:39:52.0716 0x09b4  viaide - ok

14:39:52.0763 0x09b4  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys

14:39:52.0794 0x09b4  vmbus - ok

14:39:52.0810 0x09b4  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys

14:39:52.0856 0x09b4  VMBusHID - ok

14:39:52.0888 0x09b4  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

14:39:52.0919 0x09b4  volmgr - ok

14:39:52.0981 0x09b4  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

14:39:53.0028 0x09b4  volmgrx - ok

14:39:53.0059 0x09b4  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys

14:39:53.0090 0x09b4  volsnap - ok

14:39:53.0137 0x09b4  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys

14:39:53.0184 0x09b4  vsmraid - ok

14:39:53.0324 0x09b4  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe

14:39:53.0527 0x09b4  VSS - ok

14:39:53.0558 0x09b4  vToolbarUpdater15.0.0 - ok

14:39:53.0590 0x09b4  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys

14:39:53.0636 0x09b4  vwifibus - ok

14:39:53.0668 0x09b4  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys

14:39:53.0730 0x09b4  vwififlt - ok

14:39:53.0761 0x09b4  [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys

14:39:53.0824 0x09b4  vwifimp - ok

14:39:53.0917 0x09b4  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll

14:39:54.0026 0x09b4  W32Time - ok

14:39:54.0058 0x09b4  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys

14:39:54.0120 0x09b4  WacomPen - ok

14:39:54.0167 0x09b4  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

14:39:54.0260 0x09b4  WANARP - ok

14:39:54.0276 0x09b4  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

14:39:54.0354 0x09b4  Wanarpv6 - ok

14:39:54.0479 0x09b4  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe

14:39:54.0619 0x09b4  wbengine - ok

14:39:54.0697 0x09b4  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

14:39:54.0775 0x09b4  WbioSrvc - ok

14:39:54.0838 0x09b4  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll

14:39:54.0916 0x09b4  wcncsvc - ok

14:39:54.0931 0x09b4  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

14:39:54.0994 0x09b4  WcsPlugInService - ok

14:39:55.0025 0x09b4  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys

14:39:55.0056 0x09b4  Wd - ok

14:39:55.0134 0x09b4  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

14:39:55.0212 0x09b4  Wdf01000 - ok

14:39:55.0243 0x09b4  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll

14:39:55.0290 0x09b4  WdiServiceHost - ok

14:39:55.0306 0x09b4  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll

14:39:55.0352 0x09b4  WdiSystemHost - ok

14:39:55.0415 0x09b4  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll

14:39:55.0477 0x09b4  WebClient - ok

14:39:55.0508 0x09b4  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll

14:39:55.0633 0x09b4  Wecsvc - ok

14:39:55.0664 0x09b4  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

14:39:55.0742 0x09b4  wercplsupport - ok

14:39:55.0758 0x09b4  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll

14:39:55.0852 0x09b4  WerSvc - ok

14:39:55.0867 0x09b4  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

14:39:55.0945 0x09b4  WfpLwf - ok

14:39:55.0961 0x09b4  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

14:39:55.0992 0x09b4  WIMMount - ok

14:39:56.0023 0x09b4  WinDefend - ok

14:39:56.0039 0x09b4  WinHttpAutoProxySvc - ok

14:39:56.0117 0x09b4  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

14:39:56.0226 0x09b4  Winmgmt - ok

14:39:56.0382 0x09b4  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\Windows\system32\WsmSvc.dll

14:39:56.0632 0x09b4  WinRM - ok

14:39:56.0725 0x09b4  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys

14:39:56.0756 0x09b4  WinUsb - ok

14:39:56.0834 0x09b4  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll

14:39:56.0944 0x09b4  Wlansvc - ok

14:39:57.0193 0x09b4  [ 357CABBF155AFD1D3926E62539D2A3A7, C43CFF84E7D930B4999DC061AB0766B57AAD7540B3E6EE54605B10ECE90825F5 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

14:39:57.0365 0x09b4  wlidsvc - ok

14:39:57.0412 0x09b4  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

14:39:57.0458 0x09b4  WmiAcpi - ok

14:39:57.0490 0x09b4  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

14:39:57.0552 0x09b4  wmiApSrv - ok

14:39:57.0568 0x09b4  WMPNetworkSvc - ok

14:39:57.0677 0x09b4  [ 83B6CA03C846FCD47F9883D77D1EB27B, 1616DBBC95085B6618B7F884383507E2A54D561A41288E79FA6DC99218C02802 ] WMZuneComm      C:\Program Files\Zune\WMZuneComm.exe

14:39:57.0724 0x09b4  WMZuneComm - ok

14:39:57.0755 0x09b4  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll

14:39:57.0802 0x09b4  WPCSvc - ok

14:39:57.0848 0x09b4  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

14:39:57.0895 0x09b4  WPDBusEnum - ok

14:39:57.0911 0x09b4  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

14:39:58.0004 0x09b4  ws2ifsl - ok

14:39:58.0036 0x09b4  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\system32\wscsvc.dll

14:39:58.0082 0x09b4  wscsvc - ok

14:39:58.0098 0x09b4  WSearch - ok

14:39:58.0285 0x09b4  [ D9EF901DCA379CFE914E9FA13B73B4C4, 3BE9693B7B2AFEE23D72AF5DA211379724D752F0EC18ACB7D3DE3DDFC5AE0004 ] wuauserv        C:\Windows\system32\wuaueng.dll

14:39:58.0457 0x09b4  wuauserv - ok

14:39:58.0504 0x09b4  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

14:39:58.0566 0x09b4  WudfPf - ok

14:39:58.0613 0x09b4  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

14:39:58.0675 0x09b4  WUDFRd - ok

14:39:58.0706 0x09b4  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

14:39:58.0753 0x09b4  wudfsvc - ok

14:39:58.0800 0x09b4  [ FE90B750AB808FB9DD8FBB428B5FF83B, 3F8F592EC813BE292D305A87C5BA852F8BC3D7CE610612D9871F209A17326AA8 ] WwanSvc         C:\Windows\System32\wwansvc.dll

14:39:58.0878 0x09b4  WwanSvc - ok

14:39:58.0940 0x09b4  X6va011 - ok

14:39:58.0972 0x09b4  X6va012 - ok

14:39:58.0987 0x09b4  X6va013 - ok

14:39:59.0018 0x09b4  X6va015 - ok

14:39:59.0018 0x09b4  xhunter1 - ok

14:39:59.0580 0x09b4  [ 67B787C34FB2888D01B130AE007042D8, E44878E53F265C89F271B08B81C129105E42D1C78C14467B2D96E28A9A428B1A ] ZuneNetworkSvc  C:\Program Files\Zune\ZuneNss.exe

14:40:00.0173 0x09b4  ZuneNetworkSvc - ok

14:40:00.0220 0x09b4  [ 4D89FC1C20CF655739EFAC5DA81A67BC, 788D0A5B9972ED6D80242C0C5E80AB0FAB44A708B896D5F724AC1559A291C8DD ] ZuneWlanCfgSvc  C:\Program Files\Zune\ZuneWlanCfgSvc.exe

14:40:00.0298 0x09b4  ZuneWlanCfgSvc - ok

14:40:00.0422 0x09b4  ================ Scan global ===============================

14:40:00.0454 0x09b4  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll

14:40:00.0516 0x09b4  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll

14:40:00.0547 0x09b4  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll

14:40:00.0578 0x09b4  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll

14:40:00.0610 0x09b4  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe

14:40:00.0641 0x09b4  [ Global ] - ok

14:40:00.0641 0x09b4  ================ Scan MBR ==================================

14:40:00.0656 0x09b4  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

14:40:00.0859 0x09b4  \Device\Harddisk0\DR0 - ok

14:40:00.0859 0x09b4  ================ Scan VBR ==================================

14:40:00.0875 0x09b4  [ 2ED5F64087D874D22C41BF932B0F9078 ] \Device\Harddisk0\DR0\Partition1

14:40:00.0890 0x09b4  \Device\Harddisk0\DR0\Partition1 - ok

14:40:00.0906 0x09b4  [ DA5FBF969D3027178E6997B09776F9D0 ] \Device\Harddisk0\DR0\Partition2

14:40:00.0937 0x09b4  \Device\Harddisk0\DR0\Partition2 - ok

14:40:01.0249 0x09b4  AV detected via SS2: Avira Desktop, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 14.0.2.234 ), 0x40000 ( disabled : updated )

14:40:01.0327 0x09b4  Win FW state via NFP2: enabled

14:40:04.0135 0x09b4  ============================================================

14:40:04.0135 0x09b4  Scan finished

14:40:04.0135 0x09b4  ============================================================

14:40:04.0151 0x0b18  Detected object count: 8

14:40:04.0151 0x0b18  Actual detected object count: 8

14:40:20.0827 0x0b18  Akamai ( HiddenFile.Multi.Generic ) - skipped by user

14:40:20.0827 0x0b18  Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip 

14:40:20.0827 0x0b18  AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - skipped by user

14:40:20.0827 0x0b18  AMD_RAIDXpert ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:40:20.0843 0x0b18  atksgt ( UnsignedFile.Multi.Generic ) - skipped by user

14:40:20.0843 0x0b18  atksgt ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:40:20.0843 0x0b18  HiPatchService ( UnsignedFile.Multi.Generic ) - skipped by user

14:40:20.0843 0x0b18  HiPatchService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:40:20.0843 0x0b18  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

14:40:20.0843 0x0b18  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:40:20.0843 0x0b18  lirsgt ( UnsignedFile.Multi.Generic ) - skipped by user

14:40:20.0843 0x0b18  lirsgt ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:40:20.0843 0x0b18  tap0901t ( UnsignedFile.Multi.Generic ) - skipped by user

14:40:20.0843 0x0b18  tap0901t ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:40:20.0858 0x0b18  TunngleService ( UnsignedFile.Multi.Generic ) - skipped by user

14:40:20.0858 0x0b18  TunngleService ( UnsignedFile.Multi.Generic ) - User select action: Skip 

14:44:38.0551 0x1150  Deinitialize success

Redblood

13.02.2014 14:58

Combofix

Code:

ComboFix 14-02-12.01 - Pc 13.02.2014  14:00:53.2.6 - x64

Microsoft Windows 7 Enterprise   6.1.7601.1.1252.49.1031.18.8174.6283 [GMT 1:00]

ausgeführt von:: c:\users\Pc\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\Pc\Desktop\CFScript.txt

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk"

"c:\users\Pc\AppData\Roaming\vbc.exe"

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\END

c:\users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

c:\users\Pc\AppData\Roaming\pthreadGC2.dll

c:\users\Pc\AppData\Roaming\vbc.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-01-13 bis 2014-02-13  ))))))))))))))))))))))))))))))

.

.

2014-02-13 13:16 . 2014-02-13 13:16        --------        d-----w-        c:\users\HomeGroupUser$\AppData\Local\temp

2014-02-13 13:16 . 2014-02-13 13:16        --------        d-----w-        c:\users\hedev\AppData\Local\temp

2014-02-13 13:16 . 2014-02-13 13:16        --------        d-----w-        c:\users\Gast\AppData\Local\temp

2014-02-13 13:16 . 2014-02-13 13:16        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-02-13 13:16 . 2014-02-13 13:16        --------        d-----w-        c:\users\ASPNET\AppData\Local\temp

2014-02-13 13:16 . 2014-02-13 13:16        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2014-02-12 21:27 . 2014-02-12 21:27        --------        d-----w-        c:\users\Pc\AppData\Roaming\Avira

2014-02-12 21:27 . 2014-02-12 21:27        --------        d-----w-        c:\users\Pc\AppData\Local\VNT

2014-02-12 21:26 . 2014-02-12 21:26        --------        d-----w-        c:\programdata\AskPartnerNetwork

2014-02-12 21:26 . 2014-02-12 21:26        --------        d-----w-        c:\program files (x86)\VNT

2014-02-12 21:26 . 2014-02-12 21:26        --------        d-----w-        c:\program files (x86)\AskPartnerNetwork

2014-02-12 21:26 . 2014-02-12 21:26        --------        d-----w-        c:\programdata\APN

2014-02-12 21:23 . 2013-12-09 10:45        84720        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2014-02-12 21:23 . 2013-12-09 10:45        28600        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2014-02-12 21:23 . 2013-12-09 10:45        131576        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2014-02-12 21:23 . 2013-12-09 10:45        108440        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2014-02-12 21:23 . 2014-02-12 21:23        --------        d-----w-        c:\programdata\Avira

2014-02-12 21:23 . 2014-02-12 21:23        --------        d-----w-        c:\program files (x86)\Avira

2014-02-12 21:05 . 2014-02-12 21:05        --------        d-----w-        c:\program files (x86)\FileHippo.com

2014-02-12 20:04 . 2013-12-21 09:53        548864        ----a-w-        c:\windows\system32\vbscript.dll

2014-02-12 20:04 . 2013-12-21 08:56        454656        ----a-w-        c:\windows\SysWow64\vbscript.dll

2014-02-12 19:57 . 2013-12-04 02:16        658432        ----a-w-        c:\windows\system32\RMActivate_isv.exe

2014-02-12 13:12 . 2014-02-12 13:12        --------        d-----w-        c:\program files (x86)\DLLSuite

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\users\Pc\AppData\Roaming\DriverCure

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\users\Pc\AppData\Roaming\ParetoLogic

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\program files (x86)\Common Files\ParetoLogic

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\programdata\ParetoLogic

2014-02-12 12:51 . 2014-02-12 12:51        --------        d-----w-        c:\program files (x86)\ParetoLogic

2014-02-11 21:23 . 2014-02-12 17:54        --------        d-----w-        C:\FRST

2014-02-11 20:23 . 2014-02-11 21:00        --------        d-----w-        c:\programdata\SecTaskMan

2014-02-11 20:22 . 2014-02-11 20:23        --------        d-----w-        c:\program files (x86)\Security Task Manager

2014-02-11 20:03 . 2014-02-11 20:03        --------        d-----w-        c:\users\Pc\AppData\Roaming\TestApp

2014-02-11 16:50 . 2014-02-12 19:59        --------        d-----w-        c:\programdata\PC Tools

2014-02-11 15:54 . 2014-02-11 15:54        --------        d-----w-        c:\programdata\SMR410

2014-02-11 15:50 . 2014-02-11 16:34        --------        d-----w-        c:\users\Pc\AppData\Local\NPE

2014-02-11 15:35 . 2014-02-11 20:23        --------        d-----w-        c:\users\Pc\AppData\Roaming\DigitalSites

2014-02-11 15:34 . 2014-02-11 15:34        --------        d-s---w-        c:\windows\SysWow64\Microsoft

2014-02-11 15:30 . 2013-12-18 20:09        96168        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2014-02-11 14:59 . 2014-02-11 14:59        --------        d-----w-        c:\users\Pc\AppData\Roaming\Oxy

2014-02-11 14:34 . 2014-02-11 14:34        --------        d-sh--r-        c:\users\Pc\cc4j5zs76kd2kj

2014-02-04 15:14 . 2013-06-12 14:15        100864        ----a-w-        c:\users\Pc\AppData\Roaming\zlib1.dll

2014-02-04 14:05 . 2014-02-11 20:23        --------        d-sh--r-        c:\users\Pc\aoajz

2014-02-04 12:09 . 2014-02-04 12:12        --------        d-----w-        c:\users\Pc\AppData\Roaming\Riot Games

2014-02-04 11:08 . 2014-02-11 20:23        --------        d-sh--r-        c:\users\Pc\xripb

2014-01-21 09:23 . 2014-02-04 11:20        --------        d-----w-        c:\users\Pc\AppData\Local\CyberGhost

2014-01-21 09:22 . 2014-01-21 09:23        --------        d-----w-        c:\program files\TAP-Windows

2014-01-21 09:22 . 2014-01-21 09:27        --------        d-----w-        c:\program files\CyberGhost 5

2014-01-15 12:29 . 2013-11-27 01:41        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2014-01-15 12:29 . 2013-11-27 01:41        99840        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2014-01-15 12:29 . 2013-11-27 01:41        53248        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2014-01-15 12:29 . 2013-11-27 01:41        325120        ----a-w-        c:\windows\system32\drivers\usbport.sys

2014-01-15 12:29 . 2013-11-27 01:41        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2014-01-15 12:29 . 2013-11-27 01:41        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2014-01-15 12:29 . 2013-11-27 01:41        7808        ----a-w-        c:\windows\system32\drivers\usbd.sys

2014-01-15 12:29 . 2013-11-26 10:32        3156480        ----a-w-        c:\windows\system32\win32k.sys

2014-01-15 12:29 . 2013-11-26 11:40        376768        ----a-w-        c:\windows\system32\drivers\netio.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-02-12 20:10 . 2012-10-18 04:30        88567024        ----a-w-        c:\windows\system32\MRT.exe

2014-02-12 19:55 . 2012-12-10 17:25        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-02-12 19:55 . 2012-12-10 17:25        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-02-12 07:31 . 2012-10-19 16:25        419840        ----a-w-        c:\windows\system32\systemcpl.dll

2014-02-12 07:31 . 2012-10-19 16:25        14848        ----a-w-        c:\windows\system32\slwga.dll

2014-02-12 07:31 . 2012-10-19 16:25        13824        ----a-w-        c:\windows\SysWow64\slwga.dll

2014-02-12 07:31 . 2012-10-19 16:25        1008640        ----a-w-        c:\windows\system32\user32.dll

2014-02-12 07:31 . 2012-10-19 16:25        833024        ----a-w-        c:\windows\SysWow64\user32.dll

2014-02-05 11:36 . 2013-12-28 10:49        291128        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr

2014-02-05 11:36 . 2013-08-18 16:42        291128        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe

2014-02-04 14:46 . 2013-08-18 16:42        291128        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0

2014-01-24 21:17 . 2013-08-18 16:42        76888        ----a-w-        c:\windows\SysWow64\PnkBstrA.exe

2013-12-30 13:47 . 2013-12-30 13:47        283064        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys

2013-12-18 05:13 . 2012-11-06 16:48        270496        ------w-        c:\windows\system32\MpSigStub.exe

2013-12-06 22:07 . 2013-12-06 22:07        78432        ----a-w-        c:\windows\system32\atimpc64.dll

2013-12-06 22:07 . 2013-12-06 22:07        78432        ----a-w-        c:\windows\system32\amdpcom64.dll

2013-12-06 22:07 . 2013-12-06 22:07        71704        ----a-w-        c:\windows\SysWow64\atimpc32.dll

2013-12-06 22:07 . 2013-12-06 22:07        71704        ----a-w-        c:\windows\SysWow64\amdpcom32.dll

2013-12-06 22:04 . 2011-05-25 20:07        143304        ----a-w-        c:\windows\system32\atiuxp64.dll

2013-12-06 22:03 . 2013-12-06 22:03        126336        ----a-w-        c:\windows\SysWow64\atiuxpag.dll

2013-12-06 22:03 . 2011-07-08 02:46        115512        ----a-w-        c:\windows\system32\atiu9p64.dll

2013-12-06 22:02 . 2011-07-08 02:45        98496        ----a-w-        c:\windows\SysWow64\atiu9pag.dll

2013-12-06 22:01 . 2011-07-08 03:28        1318552        ----a-w-        c:\windows\system32\aticfx64.dll

2013-12-06 22:01 . 2011-07-08 03:29        1100216        ----a-w-        c:\windows\SysWow64\aticfx32.dll

2013-12-06 22:00 . 2011-07-08 03:10        9753752        ----a-w-        c:\windows\system32\atidxx64.dll

2013-12-06 21:59 . 2013-12-06 21:59        8406024        ----a-w-        c:\windows\SysWow64\atidxx32.dll

2013-12-06 21:59 . 2011-07-08 02:55        8287008        ----a-w-        c:\windows\SysWow64\atiumdva.dll

2013-12-06 21:58 . 2011-07-08 03:00        6630232        ----a-w-        c:\windows\SysWow64\atiumdag.dll

2013-12-06 21:57 . 2013-12-06 21:57        8927704        ----a-w-        c:\windows\system32\atiumd6a.dll

2013-12-06 21:56 . 2013-12-06 21:56        7751920        ----a-w-        c:\windows\system32\atiumd64.dll

2013-12-06 21:52 . 2013-12-06 21:52        13207552        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2013-12-06 21:38 . 2013-12-06 21:38        230912        ----a-w-        c:\windows\system32\clinfo.exe

2013-12-06 21:38 . 2013-12-06 21:38        1187342        ----a-w-        c:\windows\system32\amdocl_as64.exe

2013-12-06 21:38 . 2013-12-06 21:38        1061902        ----a-w-        c:\windows\system32\amdocl_ld64.exe

2013-12-06 21:38 . 2013-12-06 21:38        995342        ----a-w-        c:\windows\SysWow64\amdocl_as32.exe

2013-12-06 21:38 . 2013-12-06 21:38        798734        ----a-w-        c:\windows\SysWow64\amdocl_ld32.exe

2013-12-06 21:38 . 2013-12-06 21:38        99840        ----a-w-        c:\windows\system32\OpenVideo64.dll

2013-12-06 21:38 . 2013-12-06 21:38        83968        ----a-w-        c:\windows\SysWow64\OpenVideo.dll

2013-12-06 21:38 . 2013-12-06 21:38        86528        ----a-w-        c:\windows\system32\OVDecode64.dll

2013-12-06 21:38 . 2013-12-06 21:38        73728        ----a-w-        c:\windows\SysWow64\OVDecode.dll

2013-12-06 21:37 . 2013-12-06 21:37        29382144        ----a-w-        c:\windows\system32\amdocl64.dll

2013-12-06 21:35 . 2013-12-06 21:35        24860160        ----a-w-        c:\windows\SysWow64\amdocl.dll

2013-12-06 21:33 . 2013-12-06 21:33        63488        ----a-w-        c:\windows\system32\OpenCL.dll

2013-12-06 21:33 . 2013-12-06 21:33        57344        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2013-12-06 21:26 . 2013-12-06 21:26        129536        ----a-w-        c:\windows\system32\coinst_13.251.dll

2013-12-06 21:16 . 2013-12-06 21:16        26352128        ----a-w-        c:\windows\system32\atio6axx.dll

2013-12-06 21:13 . 2013-12-06 21:13        368640        ----a-w-        c:\windows\system32\atiapfxx.exe

2013-12-06 21:12 . 2013-12-06 21:12        62464        ----a-w-        c:\windows\system32\aticalrt64.dll

2013-12-06 21:12 . 2013-12-06 21:12        52224        ----a-w-        c:\windows\SysWow64\aticalrt.dll

2013-12-06 21:12 . 2013-12-06 21:12        55808        ----a-w-        c:\windows\system32\aticalcl64.dll

2013-12-06 21:12 . 2013-12-06 21:12        49152        ----a-w-        c:\windows\SysWow64\aticalcl.dll

2013-12-06 21:12 . 2013-12-06 21:12        15716352        ----a-w-        c:\windows\system32\aticaldd64.dll

2013-12-06 21:09 . 2013-12-06 21:09        14302208        ----a-w-        c:\windows\SysWow64\aticaldd.dll

2013-12-06 20:58 . 2013-12-06 20:58        22157824        ----a-w-        c:\windows\SysWow64\atioglxx.dll

2013-12-06 20:53 . 2013-12-06 20:53        442368        ----a-w-        c:\windows\system32\atidemgy.dll

2013-12-06 20:53 . 2013-12-06 20:53        31232        ----a-w-        c:\windows\system32\atimuixx.dll

2013-12-06 20:53 . 2013-12-06 20:53        588288        ----a-w-        c:\windows\system32\atieclxx.exe

2013-12-06 20:52 . 2013-12-06 20:52        239616        ----a-w-        c:\windows\system32\atiesrxx.exe

2013-12-06 20:50 . 2013-12-06 20:50        190976        ----a-w-        c:\windows\system32\atitmm64.dll

2013-12-06 20:22 . 2013-12-06 20:22        1144320        ----a-w-        c:\windows\system32\atiadlxx.dll

2013-12-06 20:22 . 2013-12-06 20:22        825344        ----a-w-        c:\windows\SysWow64\atiadlxy.dll

2013-12-06 20:22 . 2013-12-06 20:22        74752        ----a-w-        c:\windows\system32\atig6pxx.dll

2013-12-06 20:22 . 2013-12-06 20:22        69632        ----a-w-        c:\windows\SysWow64\atiglpxx.dll

2013-12-06 20:22 . 2013-12-06 20:22        69632        ----a-w-        c:\windows\system32\atiglpxx.dll

2013-12-06 20:22 . 2013-12-06 20:22        100352        ----a-w-        c:\windows\system32\atig6txx.dll

2013-12-06 20:21 . 2013-12-06 20:21        96768        ----a-w-        c:\windows\SysWow64\atigktxx.dll

2013-12-06 20:21 . 2013-12-06 20:21        626176        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2013-12-06 20:18 . 2013-12-06 20:18        43520        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2013-12-06 15:49 . 2013-12-06 15:49        51200        ----a-w-        c:\windows\system32\kdbsdk64.dll

2013-12-06 15:44 . 2013-12-06 15:44        38912        ----a-w-        c:\windows\SysWow64\kdbsdk32.dll

2013-12-04 03:28 . 2014-02-13 12:43        10315576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CF91F9F6-1A6E-48C6-BC8A-0B4769C5A378}\mpengine.dll

2013-11-23 18:26 . 2013-12-11 14:34        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll

2013-11-23 17:47 . 2013-12-11 14:34        465920        ----a-w-        c:\windows\system32\WMPhoto.dll

2013-11-19 21:07 . 2013-11-19 21:07        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-11-19 21:07 . 2013-11-19 21:07        194048        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-11-19 21:07 . 2013-11-19 21:07        942592        ----a-w-        c:\windows\system32\jsIntl.dll

2013-11-19 21:07 . 2013-11-19 21:07        86016        ----a-w-        c:\windows\SysWow64\iesysprep.dll

2013-11-19 21:07 . 2013-11-19 21:07        74240        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-11-19 21:07 . 2013-11-19 21:07        71680        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe

2013-11-19 21:07 . 2013-11-19 21:07        645120        ----a-w-        c:\windows\SysWow64\jsIntl.dll

2013-11-19 21:07 . 2013-11-19 21:07        62464        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-11-19 21:07 . 2013-11-19 21:07        61952        ----a-w-        c:\windows\SysWow64\MshtmlDac.dll

2013-11-19 21:07 . 2013-11-19 21:07        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-11-19 21:07 . 2013-11-19 21:07        36352        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-11-19 21:07 . 2013-11-19 21:07        34816        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll

2013-11-19 21:07 . 2013-11-19 21:07        337408        ----a-w-        c:\windows\SysWow64\html.iec

2013-11-19 21:07 . 2013-11-19 21:07        24576        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-11-19 21:07 . 2013-11-19 21:07        235008        ----a-w-        c:\windows\system32\elshyph.dll

2013-11-19 21:07 . 2013-11-19 21:07        182272        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-11-19 21:07 . 2013-11-19 21:07        151552        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-11-19 21:07 . 2013-11-19 21:07        139264        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-11-19 21:07 . 2013-11-19 21:07        13312        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-11-19 21:07 . 2013-11-19 21:07        111616        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-11-19 21:07 . 2013-11-19 21:07        1051136        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-11-19 21:07 . 2013-11-19 21:07        90112        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-11-19 21:07 . 2013-11-19 21:07        86016        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2013-11-19 21:07 . 2013-11-19 21:07        84992        ----a-w-        c:\windows\system32\mshtmled.dll

2013-11-19 21:07 . 2013-11-19 21:07        83968        ----a-w-        c:\windows\system32\MshtmlDac.dll

2013-11-19 21:07 . 2013-11-19 21:07        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-11-19 21:07 . 2013-11-19 21:07        774144        ----a-w-        c:\windows\system32\jscript.dll

2010-11-05 01:58        32768        --sh--w-        c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2014-02-12 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}]

2013-12-20 21:02        12240        ----a-w-        c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{41564952-412D-5637-4300-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll" [2013-12-20 12240]

.

[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-4300-7a786e7484d7}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HydraVisionMDEngine"="c:\program files (x86)\ATI Technologies\HydraVision\HydraMD.exe" [2011-07-07 569344]

"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-07-07 393216]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-12-28 887936]

"Turbo Key"="c:\program files\ASUS\Turbo Key\TurboKey.exe" [2009-11-24 1874432]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-09 684600]

"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-12-20 1778640]

"VNT"="c:\program files (x86)\VNT\vntldr.exe" [2013-12-20 202192]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLUA"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 0 (0x0)

"HideSCAHealth"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 0 (0x0)

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"TaskbarNoNotification"= 0 (0x0)

"HideSCAHealth"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

R2 CGVPNCliService;CyberGhost 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]

R2 e81a9dc1;GS-Supporter;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]

R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [x]

R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]

R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]

R3 ArcService;Arc Service;c:\users\Pc\Desktop\ArcService.exe;c:\users\Pc\Desktop\ArcService.exe [x]

R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]

R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]

R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]

R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 RTL85n64;Realtek 8180/8185 Extensible 802.11-Drahtlosgerätetreiber;c:\windows\system32\DRIVERS\RTL85n64.sys;c:\windows\SYSNATIVE\DRIVERS\RTL85n64.sys [x]

R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]

R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]

R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]

R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]

R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]

R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x]

R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]

R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]

R3 X6va015;X6va015;c:\windows\SysWOW64\Drivers\X6va015;c:\windows\SysWOW64\Drivers\X6va015 [x]

R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]

R4 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]

R4 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]

R4 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]

S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]

S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]

S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [x]

S2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]

S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]

S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]

S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [x]

S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

S3 hxctlflt;hxctlflt;c:\windows\system32\Drivers\hxctlflt.sys;c:\windows\SYSNATIVE\Drivers\hxctlflt.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Akamai        REG_MULTI_SZ           Akamai

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-12-05 15:20        1210320        ----a-w-        c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-02-13 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-05 19:55]

.

2014-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]

.

2014-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-17 23:39]

.

2014-02-12 c:\windows\Tasks\ParetoLogic Registration3.job

- c:\windows\system32\rundll32.exe [2009-07-13 01:14]

.

2014-02-12 c:\windows\Tasks\ParetoLogic Update Version3.job

- c:\program files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:51]

.

2014-02-12 c:\windows\Tasks\PC Health Advisor Defrag.job

- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]

.

2014-02-12 c:\windows\Tasks\PC Health Advisor.job

- c:\program files (x86)\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}]

2013-12-20 21:02        13776        ----a-w-        c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20}]

c:\programdata\FuNDeaulls\DD2qL.x64.dll [BU]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4}]

c:\programdata\50Coeuupons\gKoa.x64.dll [BU]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{41564952-412D-5637-4300-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" [2013-12-20 13776]

.

[HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-4300-7A786E7484D7}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2011-04-11 03:35        220160        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2011-04-11 03:35        220160        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2013-12-06 14:47        778704        ----a-w-        c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-20 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-20 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-20 418328]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>

uSearchAssistant = hxxp://www.google.com

IE: Mit Mipony herunterladen - file://c:\program files (x86)\MiPony\Browser\IEContext.htm

Trusted Zone: aeriagames.com

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.2.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - 

FF - ProfilePath - c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - ExtSQL: 2013-12-18 17:14; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF - user.js: extensions.ividi.tlbrSrchUrl - hxxp://search.ividi.org/?src=tbsp&id=2895594900000000000000240103dca8&affilt=3&q=

FF - user.js: extensions.ividi.id - 2895594900000000000000240103dca8

FF - user.js: extensions.ividi.appId - {685F23D9-FCFD-475C-B56A-362645945C5A}

FF - user.js: extensions.ividi.instlDay - 15989

FF - user.js: extensions.ividi.vrsn - 1.8.23.0

FF - user.js: extensions.ividi.vrsni - 1.8.23.0

FF - user.js: extensions.ividi.vrsnTs - 1.8.23.014:19

FF - user.js: extensions.ividi.prtnrId - ividi

FF - user.js: extensions.ividi.prdct - ividi

FF - user.js: extensions.ividi.aflt - 3

FF - user.js: extensions.ividi.smplGrp - none

FF - user.js: extensions.ividi.tlbrId - base

FF - user.js: extensions.ividi.instlRef - 

FF - user.js: extensions.ividi.dfltLng - 

FF - user.js: extensions.ividi.excTlbr - true

FF - user.js: extensions.ividi.ffxUnstlRst - false

FF - user.js: extensions.ividi.admin - false

FF - user.js: extensions.ividi.autoRvrt - false

FF - user.js: extensions.ividi.rvrt - false

FF - user.js: extensions.ividi.newTab - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKCU-Run-Load - c:\users\Pc\AppData\Roaming\vbc.exe

AddRemove-BabylonToolbar - c:\program files (x86)\BabylonToolbar\BabylonToolbar\1.8.3.8\uninstall.exe

AddRemove-BattleForGraxia - c:\users\Pc\Desktop\uninstall.exe

AddRemove-Roma Surrectum Deutsch 1.1.0.5 - c:\program files (x86)\Activision\Rome - Total War\Mods\Uninstall.exe

AddRemove-Roma Surrectum II - c:\program files (x86)\Activision\Rome - Total War\Mods\uninst.exe

AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe

AddRemove-Special Force 2 Beta_is1 - c:\program files (x86)\SpecialForce2Beta\unins000.exe

AddRemove-YTKaraoke@DacSoft.org - c:\program files (x86)\YTKaraoke\uninstall.exe

AddRemove-{478472F9-9E09-492A-BDAB-42EE595EF1AD} - c:\programdata\FuNDeaulls\DD2qL.exe

AddRemove-{4820778D-AB0D-6D18-C316-52A6A0E1D507} - c:\programdata\YoutubeAdblocker\TWJ1VQCit.exe

AddRemove-{5F189DF5-2D05-472B-9091-84D9848AE48B}{e81a9dc1} - c:\progra~2\GS-ENA~1\Browsafe.dll

AddRemove-{74A84478-70A5-4F7A-966C-FA2771FF91A5}_is1 - c:\users\Pc\Desktop\Downloads\Cracks\Die Gilde\Die Gilde 2 - King Edition\unins000.exe

AddRemove-{A35CA8FF-CB7D-8361-1CB9-83219CD11C78} - c:\programdata\surf aand kEEp\3Lwcvkkk.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va011]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va012]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va013]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va013"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va015]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va015"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\SecuROM\License information*]

"datasecu"=hex:43,48,2f,01,a8,3f,a0,25,9e,c0,d9,1e,5e,c3,db,5d,ba,eb,05,e2,2e,

   74,eb,bc,e8,2e,42,2e,69,b5,96,e7,8d,49,8b,bc,8b,14,15,6d,cb,54,62,ae,12,f4,\

"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb

.

[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID]

@DACL=(02 0000)

.

[HKEY_USERS\S-1-5-21-3424378060-3098743664-1317459497-1000_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}]

@DACL=(02 0000)

@="Pokki"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

c:\windows\SysWOW64\PnkBstrA.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-02-13  14:29:58 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-02-13 13:29

.

Vor Suchlauf: 25 Verzeichnis(se), 274.137.358.336 Bytes frei

Nach Suchlauf: 26 Verzeichnis(se), 273.541.971.968 Bytes frei

.

- - End Of File - - 19B7400F2714F0917436FB662D22E1B9

A36C5E4F47E84449FF07ED3517B43A31

Und das ist der Link: https://www.virustotal.com/de/file/b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e/analysis/1392299159/

sunjojo

13.02.2014 21:13

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj

2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz

2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb

C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll

C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll

C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Bitte deinstalliere folgende Programme:

Babylon Chrome Toolbar
Babylon toolbar
Bundled software uninstaller
GS-Supporter 1.80
McAfee Security Scan Plus
Open It!
QuickShare
Search Protect
SeeSimilar
surf aand kEEp
Yontoo 1.12.02
YoutubeAdblocker
Zip Opener Packages

Gehe dafür auf:

Windows XP: Start -> Systemsteuerung -> Kategorieansicht auswählen (falls nicht voreingestellt) -> Software
Windows Vista/7: Start -> Systemsteuerung -> Anzeige (oben-rechts) auf Kategorie stellen (falls nicht voreingestellt) -> Programme deinstallieren (Unterpunkt von Programme)
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> Programme deinstallieren (Unterpunkt von Programme)

und wähle die angegeben Programme aus. Drücke Entfernen (Windows XP) oder Deinstallieren (Windows Vista/7).

Schritt 3
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 4

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 5
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Poste folgende Logfiles in deiner nächsten Antwort:

FRST-Fix
AdwCleaner-Scan
JRT-Scan
FRST-Scan

Redblood

13.02.2014 22:44

Ich konnte nicht den GS-Supporter 1.80 und Quickshare löschen.
Ich habe gemerkt, das eine der svchost.exe Prozesse folgenden Pfad hat: C:\windows\sysWOW64\svchost.exe . Der Dienst ist Akamai NetSession Interface (Akamai)

Nun zu den Logs:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-02-2014 01

Ran by Pc at 2014-02-13 21:36:11 Run:2

Running from C:\Users\Pc\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

2014-02-11 15:34 - 2014-02-11 15:34 - 00000000 _RSHD () C:\Users\Pc\cc4j5zs76kd2kj

2014-02-04 15:05 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\aoajz

2014-02-04 12:08 - 2014-02-11 21:23 - 00000000 _RSHD () C:\Users\Pc\xripb

C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll

C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll

C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll

         

*****************
 

C:\Users\Pc\cc4j5zs76kd2kj => Moved successfully.

C:\Users\Pc\aoajz => Moved successfully.

C:\Users\Pc\xripb => Moved successfully.

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\miner.dll" => File/Directory not found.

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\usft_ext.dll" => File/Directory not found.

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\coinutil.dll" => File/Directory not found.

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MPIR.dll" => File/Directory not found.
 

==== End of Fixlog ====

Code:

# AdwCleaner v3.018 - Bericht erstellt am 13/02/2014 um 22:05:06

# Updated 28/01/2014 von Xplode

# Betriebssystem : Windows 7 Enterprise Service Pack 1 (64 bits)

# Benutzername : Pc - PC-PC

# Gestartet von : C:\Users\Pc\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\ProgramData\ParetoLogic

Ordner Gelöscht : C:\ProgramData\50Coeuupons

Ordner Gelöscht : C:\Program Files (x86)\BabylonToolbar

Ordner Gelöscht : C:\Program Files (x86)\Delta

Ordner Gelöscht : C:\Program Files (x86)\ExpressFiles

Ordner Gelöscht : C:\Program Files (x86)\Movie2KDownloader.com

Ordner Gelöscht : C:\Program Files (x86)\ParetoLogic

Ordner Gelöscht : C:\Program Files (x86)\Yontoo

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\Program Files (x86)\Common Files\ParetoLogic

Ordner Gelöscht : C:\Windows\SysWOW64\Searchprotect

Ordner Gelöscht : C:\Users\Pc\AppData\Local\AVG Secure Search

Ordner Gelöscht : C:\Users\Pc\AppData\Local\PutLockerDownloader

Ordner Gelöscht : C:\Users\Pc\AppData\Local\Searchprotect

Ordner Gelöscht : C:\Users\Pc\AppData\Local\SwvUpdater

Ordner Gelöscht : C:\Users\Pc\AppData\Local\torch

Ordner Gelöscht : C:\Users\Pc\AppData\Local\Wajam

Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\BabylonToolbar

Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Delta

Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Smartbar

Ordner Gelöscht : C:\Users\Pc\AppData\LocalLow\Toolbar4

Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\DriverCure

Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\DSite

Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\ExpressFiles

Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\ParetoLogic

Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\SeeSimilar

Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Movie2KDownloader.com

Ordner Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic

Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qtrax Player.lnk

Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\conduit-search.xml

Datei Gelöscht : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\user.js

Datei Gelöscht : C:\Windows\System32\Tasks\Dealply

Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyUpdate

Datei Gelöscht : C:\Windows\System32\Tasks\DSite

Datei Gelöscht : C:\Windows\System32\Tasks\EPUpdater

Datei Gelöscht : C:\Windows\Tasks\paretologic registration3.job

Datei Gelöscht : C:\Windows\System32\Tasks\paretologic registration3

Datei Gelöscht : C:\Windows\Tasks\paretologic update version3.job

Datei Gelöscht : C:\Windows\System32\Tasks\paretologic update version3

Datei Gelöscht : C:\Windows\Tasks\PC Health Advisor Defrag.job

Datei Gelöscht : C:\Windows\System32\Tasks\PC Health Advisor Defrag

Datei Gelöscht : C:\Windows\Tasks\PC Health Advisor.job

Datei Gelöscht : C:\Windows\System32\Tasks\PC Health Advisor
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{77BEC163-D389-42c1-91A4-C758846296A5}]

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fmfnfnpmhcllokmkepffndflpnadjmma

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\khialnikbocfgkohdegnebhmmaifoglp

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHost.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Movie2KDownloader

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Movie2KDownloader_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Movie2KDownloader_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater

Schlüssel Gelöscht : HKCU\Software\59ed7dcb135e848

Schlüssel Gelöscht : HKCU\Software\cefbaeacdccceac

Schlüssel Gelöscht : HKCU\Software\cefbaeacdccceasacfsfdsf

Schlüssel Gelöscht : HKLM\SOFTWARE\59ed7dcb135e848

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SMTTB2009.IEToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SMTTB2009.IEToolbar.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SMTTB2009

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SMTTB2009.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_instagram-downloader_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_instagram-downloader_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_per_yu-gi-oh-online-3_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_per_yu-gi-oh-online-3_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{8D5CFE57-B0FD-4396-97A2-DFD0B7DA935B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{338B4DFE-2E2C-4338-9E41-E176D497299E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{77BEC163-D389-42C1-91A4-C758846296A5}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E4A994B0-5550-4680-A4C6-B9470B888069}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKCU\Software\APN PIP

Schlüssel Gelöscht : HKCU\Software\BI

Schlüssel Gelöscht : HKCU\Software\Delta

Schlüssel Gelöscht : HKCU\Software\dsiteproducts

Schlüssel Gelöscht : HKCU\Software\ExpressFiles

Schlüssel Gelöscht : HKCU\Software\filescout

Schlüssel Gelöscht : HKCU\Software\ParetoLogic

Schlüssel Gelöscht : HKCU\Software\PIP

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\Somoto Toolbar

Schlüssel Gelöscht : HKCU\Software\StartSearch

Schlüssel Gelöscht : HKLM\Software\Babylon

Schlüssel Gelöscht : HKLM\Software\DataMngr

Schlüssel Gelöscht : HKLM\Software\Delta

Schlüssel Gelöscht : HKLM\Software\ExpressFiles

Schlüssel Gelöscht : HKLM\Software\ParetoLogic

Schlüssel Gelöscht : HKLM\Software\PIP

Schlüssel Gelöscht : HKLM\Software\SearchProtect

Schlüssel Gelöscht : HKLM\Software\Video downloader

Schlüssel Gelöscht : HKLM\Software\Vittalia

Schlüssel Gelöscht : HKLM\Software\Wajam

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3CBF3EBB-235D-4c29-A68B-2BB1F428586E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Video downloader

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77BEC163-D389-42c1-91A4-C758846296A5}_is1
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16518
 
 

-\\ Mozilla Firefox v26.0 (de)
 

[ Datei : C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\prefs.js ]
 

Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3312375&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=EB_SSPV&Lay=1&UM=2&UP=SP09C9C74C-9231-4E89-8648-D5B7D174D75E");

Zeile gelöscht : user_pref("extensions.b_20JjldW7E.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self.location.protocol.indexOf('hxxp')>-1 && window.self==window.t[...]

Zeile gelöscht : user_pref("extensions.p_8p2k.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);var d=[...]

Zeile gelöscht : user_pref("extensions.yaioi78idq.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self==window.top){var script=document.createElement('script');scrip[...]

Zeile gelöscht : user_pref("extensions.zfhkTz8.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);var d[...]
 

*************************
 

AdwCleaner[R0].txt - [40189 octets] - [13/02/2014 21:51:58]

AdwCleaner[R1].txt - [40309 octets] - [13/02/2014 22:03:14]

AdwCleaner[S0].txt - [335 octets] - [13/02/2014 21:53:21]

AdwCleaner[S1].txt - [38887 octets] - [13/02/2014 22:05:06]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [38948 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.1 (02.04.2014:1)

OS: Windows 7 Enterprise x64

Ran by Pc on 13.02.2014 at 22:16:46,04

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\\Default
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\qtrax

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricsmonkey

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\sweetim

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3424378060-3098743664-1317459497-1000\Software\video downloader

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsMonkeyUpdater_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsMonkeyUpdater_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsPal_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\LyricsPal_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_130001_1001_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_130001_1001_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsMonkeyUpdater_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsMonkeyUpdater_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsPal_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\LyricsPal_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_130001_1001_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_130001_1001_RASMANCS
 
 
 

~~~ Files
 

Successfully deleted: [File] "C:\Users\Pc\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\ProgramData\apn"

Successfully deleted: [Folder] "C:\ProgramData\youtubeadblocker"

Successfully deleted: [Folder] "C:\Users\Pc\AppData\Roaming\zip opener packages"

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

Successfully deleted: [Folder] "C:\Users\Pc\music\qtrax media library"
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\Pc\AppData\Roaming\mozilla\firefox\profiles\hxtwke4k.default-1377615578566\prefs.js
 

user_pref("extensions.yaioi78idq.url", "hxxp://getjpi77.info/sync2/?q=hfZ9ofV9CShEAen0rja4rihTB6lKDzt4okmxtNtVh7n0rjrFrTs5rjr9pdaEtMFHhd9FrHwGrHaFrHr9qjkMDMlGojUMAe4Uojr8rHUEq

Emptied folder: C:\Users\Pc\AppData\Roaming\mozilla\firefox\profiles\hxtwke4k.default-1377615578566\minidumps [104 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 13.02.2014 at 22:29:38,32

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-02-2014 01

Ran by Pc (administrator) on PC-PC on 13-02-2014 22:35:18

Running from C:\Users\Pc\Desktop

Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe

(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE

(Microsoft Corporation) C:\Windows\system32\msiexec.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0

HKLM\...\Policies\Explorer: [HideSCAHealth] 0

HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0

HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)

BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File

BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File

BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]

FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]

FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\

FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR Extension: (Coupons Malibu) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnofepcmbghfcimfbjicplikedjcnalm [2013-09-03]

CHR Extension: (BargainJoy) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\khongjfjjmklggionajlpjcpmnppdace [2013-09-09]

CHR Extension: (Google Wallet) - C:\Users\Pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]

CHR Extension: (50Coeuupons) - C:\ProgramData\cfcjpjohfcdpkpkiobmplajfgaafdgpb [2013-12-31]

CHR HKLM\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKLM\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKLM\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKCU\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKCU\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKCU\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Pc\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]

CHR HKLM-x32\...\Chrome\Extension: [bmobdmpfgfimbnmhhnkmmecdboblafdh] - C:\Users\Pc\AppData\Local\BazaarFriend.crx [2013-07-29]

CHR HKLM-x32\...\Chrome\Extension: [hnofepcmbghfcimfbjicplikedjcnalm] - C:\Users\Pc\AppData\Local\CouponsMalibu.crx [2013-09-03]

CHR HKLM-x32\...\Chrome\Extension: [khongjfjjmklggionajlpjcpmnppdace] - C:\Users\Pc\AppData\Local\BargainJoy.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [lgnhgbflngpggpmpfdkhmhmfdophhepe] - C:\Program Files (x86)\YTKaraoke\Chrome.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [pcoohmdcpejoeggdnihdfhohjgdbllgm] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7C\CRX\ToolbarCR.crx [2013-12-20]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()

S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)

S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]

S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service

S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)

S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)

R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)

S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))

R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))

R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))

R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()

S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-13 22:35 - 2014-02-13 22:35 - 00019443 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-13 22:29 - 2014-02-13 22:29 - 00003725 _____ () C:\Users\Pc\Desktop\JRT.txt

2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT

2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe

2014-02-13 22:09 - 2014-02-13 22:09 - 00039497 _____ () C:\Users\Pc\Desktop\AdwCleaner[S1].txt

2014-02-13 21:51 - 2014-02-13 22:05 - 00000000 ____D () C:\AdwCleaner

2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe

2014-02-13 21:35 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip

2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-13 16:40 - 2014-02-13 16:41 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe

2014-02-13 16:40 - 2014-02-13 16:41 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe

2014-02-13 15:18 - 2014-02-13 15:40 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar

2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar

2014-02-13 15:16 - 2014-02-13 15:19 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip

2014-02-13 15:11 - 2014-02-13 15:43 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar

2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip

2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe

2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt

2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe

2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork

2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk

2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com

2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe

2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg

2014-02-12 21:18 - 2014-02-13 21:59 - 00110882 _____ () C:\Windows\PFRO.log

2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-12 21:00 - 2014-02-13 22:07 - 00017808 _____ () C:\Windows\setupact.log

2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls

2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls

2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll

2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll

2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe

2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll

2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll

2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll

2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox

2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt

2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite

2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe

2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk

2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe

2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar

2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk

2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe

2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip

2014-02-11 22:27 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-11 22:23 - 2014-02-13 22:35 - 00000000 ____D () C:\FRST

2014-02-11 22:22 - 2014-02-13 21:35 - 02152960 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable

2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites

2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites

2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:09 - 2014-02-13 16:47 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5

2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk

2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe

2014-01-15 13:29 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-15 13:29 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-15 13:29 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-15 13:29 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
 

==================== One Month Modified Files and Folders =======
 

2014-02-13 22:35 - 2014-02-13 22:35 - 00019443 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-13 22:35 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST

2014-02-13 22:32 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0

2014-02-13 22:29 - 2014-02-13 22:29 - 00003725 _____ () C:\Users\Pc\Desktop\JRT.txt

2014-02-13 22:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT

2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe

2014-02-13 22:13 - 2011-05-10 01:27 - 01991375 _____ () C:\Windows\WindowsUpdate.log

2014-02-13 22:11 - 2013-05-21 18:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Codec Pack Packages

2014-02-13 22:09 - 2014-02-13 22:09 - 00039497 _____ () C:\Users\Pc\Desktop\AdwCleaner[S1].txt

2014-02-13 22:08 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-02-13 22:07 - 2014-02-12 21:00 - 00017808 _____ () C:\Windows\setupact.log

2014-02-13 22:07 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-13 22:07 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-13 22:05 - 2014-02-13 21:51 - 00000000 ____D () C:\AdwCleaner

2014-02-13 22:04 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files

2014-02-13 21:59 - 2014-02-12 21:18 - 00110882 _____ () C:\Windows\PFRO.log

2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe

2014-02-13 21:36 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc

2014-02-13 21:35 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-02-13 21:35 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-13 21:35 - 2014-02-11 22:22 - 02152960 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip

2014-02-13 20:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-13 19:45 - 2013-12-30 14:50 - 00000000 ____D () C:\Program Files (x86)\Wargame AirLand Battle

2014-02-13 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-02-13 16:47 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-13 16:41 - 2014-02-13 16:40 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe

2014-02-13 16:41 - 2014-02-13 16:40 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe

2014-02-13 15:43 - 2014-02-13 15:11 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar

2014-02-13 15:40 - 2014-02-13 15:18 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar

2014-02-13 15:19 - 2014-02-13 15:16 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip

2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar

2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip

2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox

2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt

2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt

2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe

2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe

2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork

2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk

2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com

2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg

2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT

2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-02-12 21:07 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat

2014-02-12 21:07 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat

2014-02-12 21:07 - 2009-07-14 06:13 - 01625030 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe

2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-12 20:52 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps

2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump

2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar

2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton

2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames

2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite

2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe

2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk

2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe

2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar

2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk

2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband

2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe

2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip

2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2

2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable

2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:23 - 2014-02-11 16:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites

2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls

2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC

2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 20:02 - 2012-12-07 23:10 - 00000000 ____D () C:\Users\Pc\AppData\Local\Pokki

2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites

2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG

2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle

2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java

2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite

2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent

2014-02-11 16:03 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-11 15:33 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files

2014-02-11 15:20 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype

2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe

2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt

2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr

2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe

2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele

2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache

2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT

2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}

2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft

2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment

2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify

2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify

2014-01-23 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5

2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk

2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe

2014-01-21 09:51 - 2013-12-28 14:48 - 00000000 ____D () C:\Program Files (x86)\GS-Enabler

2014-01-17 13:57 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT
 

Some content of TEMP:

====================

C:\Users\Pc\AppData\Local\Temp\avgnt.exe

C:\Users\Pc\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-02-11 14:00
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

sunjojo

15.02.2014 15:34

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)

C:\Program Files (x86)\AskPartnerNetwork

S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service

c:\progra~2\gs-ena~1

S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]

HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)

C:\Program Files (x86)\VNT

SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)

BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File

BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File

BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)

FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]

FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)

C:\Users\Pc\AppData\Local\Pokki

FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\

FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\

C:\Program Files (x86)\YTKaraoke

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork

2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar

2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk

2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe

2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites

2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites

2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls

2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp

C:\Windows\Tasks\Digital Sites.job

C:\Windows\Tasks\DSite.job

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

AlternateDataStreams: C:\ProgramData\TEMP:430C6D84

AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2

Reg: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Bitte deinstalliere Google Chrome vollständig und installiere ihn wieder (je nachdem, ob du diesen verwendest).

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Treten noch von dir genannte Probleme auf? Gibt es noch weitere Unstimmigkeiten mit deinem Rechner?

Poste folgende Logfiles in deiner nächsten Antwort:

FRST-Fix
ESET-Scan
FRST-Scan

Redblood

17.02.2014 16:56

Liste der Anhänge anzeigen (Anzahl: 2)

Ich habe Eset 8 Stunden lang laufen gelassen und es erreichte 95 %. Danach wurde es beendet und ich hatte um ehrlich zu sein, keine Lust mehr es erneut zu starten. Wenn es nötig ist, kann ich den Vorgang nochmal wiederholen.Es wurden zwar 5 Infektionen gefunden, aber ich hatte nicht die Möglichkeit diese zu entfernen. Außerdem bestehen die beschriebenen Probleme weiterhin (Siehe Anhang).

Logs:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-02-2014 01

Ran by Pc at 2014-02-15 20:32:43 Run:3

Running from C:\Users\Pc\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)

C:\Program Files (x86)\AskPartnerNetwork

S2 e81a9dc1; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs-ena~1\BrowsafeSvc.dll",service

c:\progra~2\gs-ena~1

S2 vToolbarUpdater15.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [X]

HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [202192 2013-12-20] (APN LLC.)

C:\Program Files (x86)\VNT

SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)

BHO: FuNDeaulls - {4CEECF2F-7433-3E1D-4954-FE2A3682FC20} - C:\ProgramData\FuNDeaulls\DD2qL.x64.dll No File

BHO: 50Coeuupons - {A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} - C:\ProgramData\50Coeuupons\gKoa.x64.dll No File

BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-4300-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)

FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi [2013-12-20]

FF Plugin HKCU: pokki.com/PokkiDownloadHelper - C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)

C:\Users\Pc\AppData\Local\Pokki

FF HKCU\...\Firefox\Extensions: [lyricsmonkey@mendoni.net] - C:\Program Files (x86)\LyricsMonkey\FF\

FF HKCU\...\Firefox\Extensions: [YTKaraoke@DacSoft.org] - C:\Program Files (x86)\YTKaraoke\FF\

C:\Program Files (x86)\YTKaraoke

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Local\VNT

2014-02-12 22:26 - 2014-02-12 22:26 - 00000000 ____D () C:\ProgramData\AskPartnerNetwork

2014-02-12 19:58 - 2013-04-04 22:02 - 00000000 ____D () C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar

2014-02-12 13:51 - 2014-02-12 13:51 - 00001109 _____ () C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk

2014-02-12 13:47 - 2014-02-12 13:47 - 05249448 _____ (ParetoLogic Inc.) C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe

2014-02-11 16:35 - 2014-02-11 21:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DigitalSites

2014-02-11 16:35 - 2014-02-11 16:35 - 00003208 _____ () C:\Windows\System32\Tasks\Digital Sites

2014-02-11 21:23 - 2013-12-31 15:25 - 00000000 ____D () C:\ProgramData\FuNDeaulls

2014-02-11 21:23 - 2013-10-11 13:19 - 00000000 ____D () C:\Program Files (x86)\Unitech LLC

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\ProgramData\surf aand kEEp

2014-02-04 15:25 - 2013-12-28 14:47 - 00000000 ____D () C:\Program Files (x86)\surf aand kEEp

C:\Windows\Tasks\Digital Sites.job

C:\Windows\Tasks\DSite.job

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

AlternateDataStreams: C:\ProgramData\TEMP:430C6D84

AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2

Reg: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f

         

*****************
 

APNMCP => Service deleted successfully.

C:\Program Files (x86)\AskPartnerNetwork => Moved successfully.

e81a9dc1 => Service deleted successfully.

c:\progra~2\gs-ena~1 => Moved successfully.

vToolbarUpdater15.0.0 => Service deleted successfully.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\VNT => Value deleted successfully.

C:\Program Files (x86)\VNT => Moved successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\ToolbarSearchProviderProgress => Value deleted successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully.

HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.

HKCR\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} => Key deleted successfully.

HKCR\CLSID\{4CEECF2F-7433-3E1D-4954-FE2A3682FC20} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} => Key deleted successfully.

HKCR\CLSID\{A257D1AE-C8F9-32E7-03CF-8F68563FB5A4} => Key deleted successfully.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-4300-7A786E7484D7} => Value deleted successfully.

HKCR\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-4300-7A786E7484D7} => Value deleted successfully.

HKCR\Wow6432Node\CLSID\{41564952-412D-5637-4300-7A786E7484D7} => Key not found.

C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\toolbar_AVIRA-V7C@apn.ask.com.xpi => Moved successfully.

HKCU\Software\MozillaPlugins\pokki.com/PokkiDownloadHelper => Key deleted successfully.

C:\Users\Pc\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll => Moved successfully.

C:\Users\Pc\AppData\Local\Pokki => Moved successfully.

HKCU\Software\Mozilla\Firefox\Extensions\\lyricsmonkey@mendoni.net => Value deleted successfully.

HKCU\Software\Mozilla\Firefox\Extensions\\YTKaraoke@DacSoft.org => Value deleted successfully.

"C:\Program Files (x86)\YTKaraoke" => File/Directory not found.

HKLM\SOFTWARE\Policies\Google => Key deleted successfully.

C:\Users\Pc\AppData\Local\VNT => Moved successfully.

C:\ProgramData\AskPartnerNetwork => Moved successfully.

C:\Program Files (x86)\VLC Media Player DB Toolbar Toolbar => Moved successfully.

C:\Users\Pc\Desktop\ParetoLogic PC Health Advisor.lnk => Moved successfully.

C:\Users\Pc\Downloads\ParetoLogic PC Health Advisor_de.exe => Moved successfully.

C:\Users\Pc\AppData\Roaming\DigitalSites => Moved successfully.

C:\Windows\System32\Tasks\Digital Sites => Moved successfully.

C:\ProgramData\FuNDeaulls => Moved successfully.

C:\Program Files (x86)\Unitech LLC => Moved successfully.

C:\ProgramData\surf aand kEEp => Moved successfully.

C:\Program Files (x86)\surf aand kEEp => Moved successfully.

"C:\Windows\Tasks\Digital Sites.job" => File/Directory not found.

"C:\Windows\Tasks\DSite.job" => File/Directory not found.

C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.

C:\ProgramData\TEMP => ":430C6D84" ADS removed successfully.

C:\ProgramData\TEMP => ":DFC5A2B2" ADS removed successfully.
 

========= reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 0x00000002 /f =========
 

Der Vorgang wurde erfolgreich beendet.
 
 
 

========= End of Reg: =========
 
 
 

The system needs a manual reboot. 
 

==== End of Fixlog ====

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc

# engine=17090

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-02-15 07:56:52

# local_time=2014-02-15 08:56:52 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=771 16777214 16 1 363676 363676 0 0

# compatibility_mode=5893 16776573 100 94 79912 144124062 0 0

# scanned=1696

# found=1

# cleaned=0

# scan_time=939

sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc

# engine=17090

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-02-15 08:00:27

# local_time=2014-02-15 09:00:27 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=771 16777214 16 1 360291 360291 0 0

# compatibility_mode=5893 16776573 100 94 76527 144124277 0 0

# scanned=1696

# found=1

# cleaned=0

# scan_time=135

sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=cb30d69d079cfd44a32d8722cb78ffdc

# engine=17093

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-02-16 08:37:01

# local_time=2014-02-16 09:37:01 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=771 16777214 16 1 452485 452485 0 0

# compatibility_mode=5893 16776573 100 94 88570 144212871 0 0

# scanned=411507

# found=5

# cleaned=0

# scan_time=29321

sh=B49F71236B95E6A0CC972FEB330C23952D19A3E2 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooLayers.crx.vir"

sh=F8027A71143DEF6FCDB04E88CF5B39BF8C08603E ft=0 fh=0000000000000000 vn="VBS/Runner.NBV trojan" ac=I fn="C:\FRST\Quarantine\cc4j5zs76kd2kj13-02-2014_21-36-11\92050.vbs"

sh=958E7DA26C2C86E093A1F40F64775539C61BFDC6 ft=1 fh=f49d817a11669fc4 vn="a variant of Generik.DAZLFYY trojan" ac=I fn="C:\Program Files (x86)\Microsoft Games\Age of Empires II\Age.dll"

sh=D540934F4129BF0469D99DB9A6BA42B17400BAFD ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Pc\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\a6fcaa2-468d1870"

sh=1A3446B261E6B70723619F3002476781BA728D25 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Pc\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\2219a3ae-784affda"

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-02-2014

Ran by Pc (administrator) on PC-PC on 17-02-2014 16:53:48

Running from C:\Users\Pc\Desktop

Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE

(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0

HKLM\...\Policies\Explorer: [HideSCAHealth] 0

HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0

HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
 

==================== Services (Whitelisted) =================
 

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [908856 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()

S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)

S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)

S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)

R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)

S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))

R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))

R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))

R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()

S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-17 16:53 - 2014-02-17 16:53 - 00015237 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-16 20:16 - 2014-02-16 20:45 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part4.rar

2014-02-16 18:33 - 2014-02-16 19:03 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part6.rar

2014-02-16 16:11 - 2014-02-16 18:32 - 03398085 _____ () C:\Users\Pc\Downloads\0utl4st.part7.rar

2014-02-16 16:11 - 2014-02-16 16:11 - 00000189 _____ () C:\Users\Pc\Downloads\0utl4st_checksums.sfv

2014-02-16 16:10 - 2014-02-16 16:10 - 03610608 _____ () C:\Users\Pc\Downloads\0utl4st.part2.rar.part

2014-02-15 20:38 - 2014-02-15 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-15 20:36 - 2014-02-15 20:36 - 02347384 _____ (ESET) C:\Users\Pc\Downloads\esetsmartinstaller_enu.exe

2014-02-14 14:24 - 2014-02-14 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT

2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe

2014-02-13 21:51 - 2014-02-13 22:05 - 00000000 ____D () C:\AdwCleaner

2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe

2014-02-13 21:35 - 2014-02-17 16:53 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip

2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-13 16:40 - 2014-02-13 16:41 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe

2014-02-13 16:40 - 2014-02-13 16:41 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe

2014-02-13 15:18 - 2014-02-13 15:40 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar

2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar

2014-02-13 15:16 - 2014-02-13 15:19 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip

2014-02-13 15:11 - 2014-02-13 15:43 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar

2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip

2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe

2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt

2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe

2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira

2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk

2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com

2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe

2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg

2014-02-12 21:18 - 2014-02-13 21:59 - 00110882 _____ () C:\Windows\PFRO.log

2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-12 21:00 - 2014-02-17 16:08 - 00060928 _____ () C:\Windows\setupact.log

2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls

2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls

2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll

2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll

2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe

2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll

2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll

2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll

2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-02-12 19:36 - 2014-02-13 14:30 - 00000000 ____D () C:\Qoobox

2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt

2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite

2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe

2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar

2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk

2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe

2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip

2014-02-11 22:27 - 2014-02-15 20:31 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-11 22:23 - 2014-02-17 16:53 - 00000000 ____D () C:\FRST

2014-02-11 22:22 - 2014-02-17 16:53 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable

2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:09 - 2014-02-13 16:47 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-01-21 10:23 - 2014-02-04 12:20 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-01-21 10:22 - 2014-01-21 10:27 - 00000000 ____D () C:\Program Files\CyberGhost 5

2014-01-21 10:22 - 2014-01-21 10:23 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk

2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
 

==================== One Month Modified Files and Folders =======
 

2014-02-17 16:54 - 2014-02-17 16:53 - 00015237 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-17 16:53 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-02-17 16:53 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST

2014-02-17 16:53 - 2014-02-11 22:22 - 02152448 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-17 16:21 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-17 16:08 - 2014-02-12 21:00 - 00060928 _____ () C:\Windows\setupact.log

2014-02-17 15:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-17 15:47 - 2011-05-10 01:27 - 01092669 _____ () C:\Windows\WindowsUpdate.log

2014-02-17 15:44 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-02-17 15:43 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-17 15:43 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-16 21:36 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype

2014-02-16 21:36 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files

2014-02-16 21:36 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files

2014-02-16 20:45 - 2014-02-16 20:16 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part4.rar

2014-02-16 19:03 - 2014-02-16 18:33 - 523239424 _____ () C:\Users\Pc\Downloads\0utl4st.part6.rar

2014-02-16 18:32 - 2014-02-16 16:11 - 03398085 _____ () C:\Users\Pc\Downloads\0utl4st.part7.rar

2014-02-16 18:30 - 2012-11-24 19:22 - 00000000 ____D () C:\Program Files (x86)\JDownloader

2014-02-16 17:01 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps

2014-02-16 16:11 - 2014-02-16 16:11 - 00000189 _____ () C:\Users\Pc\Downloads\0utl4st_checksums.sfv

2014-02-16 16:10 - 2014-02-16 16:10 - 03610608 _____ () C:\Users\Pc\Downloads\0utl4st.part2.rar.part

2014-02-16 13:27 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat

2014-02-16 13:27 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat

2014-02-16 13:27 - 2009-07-14 06:13 - 01651686 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-15 21:03 - 2012-10-28 12:40 - 00000000 ____D () C:\AeriaGames

2014-02-15 20:38 - 2014-02-15 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-15 20:36 - 2014-02-15 20:36 - 02347384 _____ (ESET) C:\Users\Pc\Downloads\esetsmartinstaller_enu.exe

2014-02-15 20:35 - 2012-10-18 00:39 - 00000000 ____D () C:\Users\Pc\AppData\Local\Google

2014-02-15 20:35 - 2012-10-18 00:39 - 00000000 ____D () C:\Program Files (x86)\Google

2014-02-15 20:31 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-15 14:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-02-15 14:14 - 2013-08-20 18:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-02-14 22:09 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client

2014-02-14 14:24 - 2014-02-14 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-02-13 22:32 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0

2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT

2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe

2014-02-13 22:11 - 2013-05-21 18:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Codec Pack Packages

2014-02-13 22:05 - 2014-02-13 21:51 - 00000000 ____D () C:\AdwCleaner

2014-02-13 21:59 - 2014-02-12 21:18 - 00110882 _____ () C:\Windows\PFRO.log

2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe

2014-02-13 21:36 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc

2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip

2014-02-13 19:45 - 2013-12-30 14:50 - 00000000 ____D () C:\Program Files (x86)\Wargame AirLand Battle

2014-02-13 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-02-13 16:47 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-13 16:41 - 2014-02-13 16:40 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe

2014-02-13 16:41 - 2014-02-13 16:40 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe

2014-02-13 15:43 - 2014-02-13 15:11 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar

2014-02-13 15:40 - 2014-02-13 15:18 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar

2014-02-13 15:19 - 2014-02-13 15:16 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip

2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar

2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip

2014-02-13 14:30 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox

2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt

2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt

2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\ComboFix.exe

2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe

2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-12 23:12 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira

2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk

2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com

2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg

2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT

2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-02-12 21:07 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-12 20:56 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe

2014-02-12 20:55 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-12 20:55 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-12 20:52 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump

2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton

2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames

2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite

2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe

2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar

2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk

2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband

2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe

2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip

2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2

2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:21 - 2014-02-11 22:21 - 00000000 _____ () C:\Users\Pc\defogger_reenable

2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG

2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle

2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java

2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite

2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe

2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt

2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr

2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe

2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele

2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache

2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT

2014-01-29 14:14 - 2014-01-29 14:14 - 00000631 _____ () C:\Windows\system32\InstallUtil.InstallLog

2014-01-25 14:59 - 2012-10-17 23:53 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9DE29845-AC8C-4418-B415-05000DEA2E9F}

2014-01-24 22:17 - 2013-08-18 17:42 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft

2014-01-24 22:12 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment

2014-01-23 21:18 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify

2014-01-23 21:01 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify

2014-01-21 10:27 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\CyberGhost 5

2014-01-21 10:23 - 2014-01-21 10:22 - 00000000 ____D () C:\Program Files\TAP-Windows

2014-01-21 10:22 - 2014-01-21 10:22 - 00001736 _____ () C:\Users\Pc\Desktop\CyberGhost 5.lnk

2014-01-21 10:21 - 2014-01-21 10:21 - 08566128 _____ (CyberGhost S.R.L. ) C:\Users\Pc\Downloads\CG_5.0.9.8chip.de.exe
 

Some content of TEMP:

====================

C:\Users\Pc\AppData\Local\Temp\avgnt.exe

C:\Users\Pc\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-02-11 14:00
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

sunjojo

18.02.2014 16:37

Zitat:

Ne, musst du nicht. Von den "Funden" waren die meisten schon in Quarantäne und gelöscht, bzw. ein Fehlalarm und was in den temporären Ordnern (also alles gut).

Zitat:

Außerdem bestehen die beschriebenen Probleme weiterhin (Siehe Anhang).

Welches Problem? Du hast mir keins beschrieben. Ist dein PC spürbar langsamer als vorher? Der von dir gezeigte Prozess ist völlig legitim und häufig auf Rechnern zu finden (wäre dieser schädlich, hätte ich den schon vorher gefixt ;)): http://www.akamai.de/html/solutions/client_faq.html. Auch das der svchost.exe Prozess mehrmals läuft ist normal. Kein Grund zur Sorge. Gibt es noch weitere Probleme, startet deine Firewall wieder?

Redblood

18.02.2014 20:03

Achso. Weitere Probleme gibt es nicht. Mein Pc läuft jetzt wieder schnell und die Probleme wurden behoben. Mir macht nur die Auslastung zu schaffen. Ich bin mir nicht sicher, ob es auch früher schon so war. Größere Programme wie Spiele, verbrauchen mehr als 1GB RAM. In diesen Fällen nimmt dann auch die Geschwindigkeit stark ab. Falls dies "normal" sein sollte, dann bedanke ich mich bei dir für die Hilfe :D.

Redblood

sunjojo

19.02.2014 16:06

Zitat:

Das größere Spiele mehr als 1GB RAM verbrauchen, ist auf jeden Fall nicht unnormal. Aufwendige Spiele verbrauchen viel RAM und können auch auf guten Rechnern nur in bestimmten Einstellungen gespielt werden (wie Crysis 3, ich spreche aus Erfahrung :D).

Updates
Adobe Reader 11.0.06

Deinstalliere bitte deine aktuelle Version von Adobe Reader.
Lade dir die neue Version hier herunter. Entferne den Haken für den McAfee SecurityScan bzw. Google Chrome.

Cleanup
Falls du Malwarebytes Anti-Malware und den ESET Online Scanner nicht mehr behalten möchtest, kannst du diese über die Systemsteuerung deinstallieren. Ich empfehle dir, mindestens ein Programm zu behalten (näheres in den Tipps).

Windows XP: Start --> Systemsteuerung --> Kategorieansicht auswählen (falls nicht voreingestellt) --> Software
Windows Vista/7: Start --> Systemsteuerung --> Anzeige (oben-rechts) auf Kategorie stellen (falls nicht voreingestellt) --> Programme deinstallieren (Unterpunkt von Programme)
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> Programme deinstallieren (Unterpunkt von Programme)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

In deinen Logfiles sehe ich keine schädlichen Einträge mehr, du bist in meinen Augen Clean. Für die Zukunft habe ich dir Tipps aufgeschrieben, damit du uns in nächster Zeit nicht mehr brauchst :).

Tipps - Frequently Asked Questions (FAQ)/Häufig gestellte Fragen

Welcher Antivirenscanner ist der Beste?

Die Antwort auf die Frage ist im Grunde einfach: keins. Es gibt keinen Antivirenscanner, der immer alle Schädlinge sofort erkennt und dich 100%ig schützt. Alles vom Menschen geschaffene ist fehlerhaft und es ist ratsam, sich nur begrenzt darauf zu verlassen. Das heißt nicht, dass die Verwendung eines Antivirenprogramms keinen Sinn macht, aber es sollte als zusätzliche Hilfe angesehen werden. Die Hauptverantwortung liegt bei dir und deinem Verhalten im Internet selbst.

Benutze nur einen Antivirenscanner/Hintergrundwächter, niemals zwei oder mehrere. Diese könnten sich gegenseitig blockieren und dir mehr schaden, als helfen. Es ist nicht unbedingt nötig, sich kostenpflichtige Antivirenprogramme für viel Geld zu kaufen. Achte darauf, dass immer die neuesten Updates heruntergeladen werden. Ein veralteter Antivirenscanner ist nutzlos!
- Ein gutes und kostenloses Antivirenprogramm ist avast! Free Antivirus.
- Wenn du bereit bist, dafür Geld auszugeben, empfehle ich dir Emsisoft Anti-Malware.

Außerdem kannst du dein Betriebssystem mit On-Demand Sannern überprüfen. Solche Scanner laufen nicht permanent im Hintergrund, sondern scannen nur "auf Knopfdruck" dein System. Damit holst du dir eine zweite Meinung ein. Gute On-Demand Scanner, die auch wir zur Kontrolle benutzen, sind Malwarebytes Anti Malware und der ESET Online Scanner.
- Malwarebytes Anti-Malware (Anleitung zur Verwendung) ist eines der besten und zuverlässigsten Programme in der Malwareentfernung. Scanne dein System einmal pro Woche oder einmal in zwei Wochen.
- Der ESET Online Scanner (Anleitnung zur Verwendung) ist kostenlos und scannt dein System und deine Dateien sehr gründlich. Deswegen kann der Scan bei vielen Dateien mehrere Stunden dauern. Scanne dein System nach deinem eigenem Ermessen. Falls schädliche Dateien gefunden werden, handle nicht eigenmächtig!

Aber Updates muss ich immer installieren, oder?

Die Aktualität von Software ist sehr wichtig und unbedingt notwendig. Veraltete Programme stellen Schwachstellen dar, die sich Angreifer gerne zur Nutze machen. Daher ist es wichtig, immer die neueste Version der jeweiligen Software installiert zu haben. Dies fängt beim Betriebssystem an. Du solltest das neueste Service Pack installiert und automatische Updates eingeschaltet haben.
Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren

Häufig werden Sicherheitslücken von älteren Java Versionen, dem Flash-Player und PDF-Reader ausgenutzt. Du kannst hier überprüfen, ob diese häufig missbrauchte Software aktuell ist: PluginCheck

Außerdem empfehle ich dir den http://www.trojaner-board.de/83959-s...tml#post510373. Dieser überprüft, ob du veraltete Software auf deinem Rechner verwendest und kann sie in manchen Fällen automatisch updaten.

Ok, muss ich auf etwas achten, wenn ich im Internet surfe?

Mit dem richtigen Verhalten im Internet fängt der Schutz vor Infektionen an. Es gibt inzwischen viele virtuelle Betrugsversuche oder Tricks zum Täuschen, sowie im echten Leben. Um sich dort zu schützen, hast du bestimmte Angewohnheiten. Diese können auf das Surfverhalten übertragen werden. Zur Verdeutlichung stelle ich dir einen kleinen Vergleich zum Leben her:

Verhalten im Leben	Verhalten im Internet
Du überprüfst vorher die Läden, in denen du einkaufst.	Klicke nicht auf alle Seiten/Werbungen/PopUps, weil diese bunt sind oder tolle Preise versprechen.
Du achtest auf die Qualität, wenn du Produkte kaufst.	Lade dir Programme nur von original Herstellerseiten herunter und nicht von Softonic oder ähnlichem. Diese birgen häufig die Gefahr, sich zusätzlich Adware herunterzuladen.
Du öffnest keine Briefe oder Pakete ohne zu gucken, von wem diese sind.	Öffne nur Anhänge von Emails, wenn der Absender bekannt ist. Überprüfe, ob zum Beispiel eine Rechnung im Anhang wirklich von der Firma versendet wurde. Häufig werden gefälschte Emails mit schädlichem Anhang verschickt!

Handle mit Bedacht und überlege zuerst, bevor du etwas anklickst, herunterlädst oder öffnest!

Vermeide das Besuchen von pornographischen, Pokerspiel oder weiteren dubiosen Webseiten. Diese birgen ein besonders großes Infektionsrisiko.

Welche Programme sollte ich nicht verwenden?

Wenn du neue Software installierst, besteht häufig die Auswahl, eine weitere Toolbar (oder ähnliches) zu installieren. Entferne generell den Haken bei optionalen Zusatzprogrammen. Diese verlangsamen in der Regel deinen Browser und können ein erhöhtes Infektionsrisiko bedeuten.

Registry Cleaner versprechen meist einen großen Performancegewinn, wenn verwaiste Einträge in der Regsitry entfernt werden. Dieser angebliche Gewinn ist kaum bis gar nicht bemerkbar. Außerdem wird häufig verschwiegen, dass falsche Änderungen der Registry zu schwerwiegenden Folgen führen können. Deswegen sollte so wenig wie möglich an der Registry verändert werden. Zerstörst du die Registry, zerstörst du Windows!

Filesharing oder Peer-to-Peer Programme ermöglichen es, Dateien mit anderen Nutzern auszutauschen. Es ist möglich, dass du dir eine infizierte Datei herunterlädst (auch versteckt in angeblich legalen Versionen von bekannten Programmen). Du kannst niemals wissen, woher diese stammen. Daher sollte diese Art von Software mit äußerster Vorsicht oder gar nicht benutzt werden.
- Lade dir vor allem keine Cracks (illegale Versione einer Software) herunter. Das ist rechtlich nicht erlaubt und du kannst dafür bestraft werden. Außerdem ist bei solcher Software das Infektionsrisiko am höchsten, da Cracks sehr häufig versteckte Malware enthalten.

Gibt es noch weitere Tipps, um mich zu schützen?

Achte auf die Endung von Dateien, die dir zugesendet wurden. Häufig versuchen Malwareschreiber mit Tricks wie Rechnung.pdf.exe dich zu täuschen. Wenn die Dateiendung ausgeblendet wird, bleibt Rechnung.pdf übrig, was den Anschein einer normalen PDF-Datei macht. Lass dir daher bekannte Dateiendung anzeigen (Anleitung: http://www.trojaner-board.de/59624-a...-sichtbar.html)

Surfe mit einem Konto mit eingeschränkten Rechten. Durch Administratorrechte kann Malware ohne Probleme zahlreiche Änderungen am System vornehmen, zum Beispiel Sicherheitseinstellungen verändern oder auf Systemdateien zugreifen.
Verwende nicht immer das gleiche Passwort. Falls dein Passwort durch entsprechende Malware herausgefunden wird, könnte auf alle Konten von dir zugegriffen werden.

Lege in regelmäßigen Abständen Backups (Was sind Backups?) von deinem System an. Dadurch ist ein Datenverlust durch Malware oder Hardwareschäden verkraftbar und es ist vergleichsweise einfach, den Rechner auf den Stand des letzten Backups zu bringen. Damit du deine Daten nicht manuell sichern musst, gibt es Backup-Programme wie Paragon Backup & Recovery.

Deaktiviere das Autorun-Feature von Windows. Dies ermöglicht, dass zum Beispiel CDs, DVDs oder Programme auf USB-Sticks alleine starten. Häufig nutzen Malwareschreiber genau diese Funktion aus. In solchen Fällen befindet sich Malware auf dem USB-Stick und wird automatisch beim Anschließen an den Computer ausgeführt. Um das zu verhinden, deaktiviere die Autorun-Funktion: http://www.trojaner-board.de/83238-a...sschalten.html.

Wenn du die Arbeit des Trojaner-Boards unterstützen möchtest, kannst du gerne spenden :).

Ich wünsche dir eine schöne und malwarefreie Zeit :daumenhoc.

sunjojo

22.02.2014 12:45

Hallo Redblood,

schön, dass wir dir helfen konnten :abklatsch:.

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht, damit erhalte ich keine Benachrichtungen über neue Antworten in diesem Thread. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder Andere bitte hier klicken und einen eigenen Thread erstellen.

Redblood

03.03.2014 13:41

Nach unserem Reinigunsvorgang vor ein paar Wochen, stürzt mein Pc ständig ab. Anfangs dachte ich das sei normal und könnte passieren, aber es passiert immer ca. 30 Minuten nach dem 1. Start, selbst wenn nur der Desktop geöffnet ist und ich afk bin. Die Abstürze passieren also sehr willkürlich und zufällig. Es erscheint KEIN Bluescreen, sondern der Bildschirm wird einfach schwarz und der Pc startet neu. Aber der Bericht beim Neustart sagt, das ein Bluescreen erschien.

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-03-2014

Ran by Pc (administrator) on PC-PC on 03-03-2014 13:39:44

Running from C:\Users\Pc\Desktop

Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Spotify Ltd) C:\Users\Pc\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe

(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0

HKLM\...\Policies\Explorer: [HideSCAHealth] 0

HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0

HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Spotify Web Helper] - C:\Users\Pc\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-23] (Spotify Ltd)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
 

==================== Services (Whitelisted) =================
 

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [910392 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()

S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)

S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)

S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)

R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)

S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))

R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))

R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))

R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()

S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

S3 X6va016; \??\C:\Windows\SysWOW64\Drivers\X6va016 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-03-02 12:31 - 2014-03-02 12:31 - 00262144 ____N () C:\Windows\Minidump\030214-23290-01.dmp

2014-03-02 01:24 - 2014-03-02 01:24 - 00262144 ____N () C:\Windows\Minidump\030214-22011-01.dmp

2014-03-02 01:21 - 2014-03-02 01:35 - 00000000 ____D () C:\Users\Pc\Desktop\Anwalt

2014-02-28 15:26 - 2014-02-28 15:26 - 00262144 ____N () C:\Windows\Minidump\022814-26005-01.dmp

2014-02-28 10:18 - 2014-02-28 10:18 - 00262144 ____N () C:\Windows\Minidump\022814-23665-01.dmp

2014-02-28 08:46 - 2014-02-28 08:46 - 00275704 _____ () C:\Windows\Minidump\022814-34226-01.dmp

2014-02-27 18:14 - 2014-02-27 18:14 - 00275704 _____ () C:\Windows\Minidump\022714-24070-01.dmp

2014-02-25 23:18 - 2014-02-25 23:19 - 00275704 _____ () C:\Windows\Minidump\022514-25162-01.dmp

2014-02-25 19:45 - 2014-02-25 19:45 - 01956366 _____ () C:\Users\Pc\Downloads\EasyRootingToolkit_XPERIA-Z_SO-02E_v101-ENGLISH_tkymgr.zip

2014-02-25 19:42 - 2014-02-25 19:43 - 15305933 _____ () C:\Users\Pc\Downloads\Flashtool-drivers.exe

2014-02-25 19:38 - 2014-02-25 19:44 - 00015636 _____ () C:\Windows\DPINST.LOG

2014-02-25 14:20 - 2014-02-25 14:20 - 00275704 _____ () C:\Windows\Minidump\022514-24382-01.dmp

2014-02-22 14:04 - 2014-02-22 14:04 - 00262144 ____N () C:\Windows\Minidump\022214-20467-01.dmp

2014-02-21 17:37 - 2014-02-21 17:37 - 00262144 ____N () C:\Windows\Minidump\022114-21996-01.dmp

2014-02-21 10:01 - 2014-03-03 10:26 - 681276793 _____ () C:\Windows\MEMORY.DMP

2014-02-21 10:01 - 2014-02-21 10:01 - 00275704 _____ () C:\Windows\Minidump\022114-22214-01.dmp

2014-02-20 15:05 - 2014-02-20 15:05 - 00262144 ____N () C:\Windows\Minidump\022014-19281-01.dmp

2014-02-19 18:32 - 2014-02-19 18:32 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-02-19 18:25 - 2014-03-03 13:28 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype

2014-02-19 18:20 - 2014-02-19 18:20 - 00000000 ___SD () C:\uninstall.exe

2014-02-18 17:55 - 2014-02-18 17:55 - 00000359 _____ () C:\Windows\DirectX.log

2014-02-18 17:53 - 2014-02-18 17:53 - 00001636 _____ () C:\Users\Public\Desktop\Outlast.lnk

2014-02-18 17:40 - 2014-02-18 17:40 - 00000000 ____D () C:\GOG Games

2014-02-18 17:35 - 2014-02-18 17:36 - 00000000 ____D () C:\Program Files (x86)\Outlast

2014-02-18 17:08 - 2013-12-15 20:53 - 00000000 ____D () C:\Users\Pc\Downloads\Outlast-GoodOldGames

2014-02-18 15:00 - 2014-02-18 15:00 - 00002942 _____ () C:\Windows\System32\Tasks\{C5C38CE5-09E8-406A-BAA2-E4C07F7224FB}

2014-02-18 13:55 - 2014-02-18 13:55 - 00000000 ____D () C:\Users\Pc\AppData\Local\Skype

2014-02-18 13:54 - 2014-02-19 18:32 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-02-18 13:52 - 2014-02-18 13:53 - 35671200 _____ (Skype Technologies S.A.) C:\Users\Pc\Downloads\SkypeSetupFull(1).exe

2014-02-17 16:53 - 2014-03-03 13:40 - 00015668 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-02-15 20:38 - 2014-02-15 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-15 20:36 - 2014-02-15 20:36 - 02347384 _____ (ESET) C:\Users\Pc\Downloads\esetsmartinstaller_enu.exe

2014-02-14 14:24 - 2014-02-14 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT

2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe

2014-02-13 21:51 - 2014-02-13 22:05 - 00000000 ____D () C:\AdwCleaner

2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe

2014-02-13 21:35 - 2014-03-03 13:39 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip

2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-13 16:40 - 2014-02-13 16:41 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe

2014-02-13 16:40 - 2014-02-13 16:41 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe

2014-02-13 15:18 - 2014-02-13 15:40 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar

2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar

2014-02-13 15:16 - 2014-02-13 15:19 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip

2014-02-13 15:11 - 2014-02-13 15:43 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar

2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip

2014-02-13 14:36 - 2014-02-10 23:37 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe

2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt

2014-02-13 13:51 - 2014-02-13 13:50 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\combofix.exe

2014-02-13 13:49 - 2014-02-13 13:50 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira

2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-02-12 22:23 - 2013-12-09 11:45 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-02-12 22:23 - 2013-12-09 11:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk

2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com

2014-02-12 22:04 - 2014-02-12 22:08 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe

2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg

2014-02-12 21:18 - 2014-02-13 21:59 - 00110882 _____ () C:\Windows\PFRO.log

2014-02-12 21:04 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-02-12 21:04 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-02-12 21:03 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-12 21:03 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-12 21:03 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-12 21:03 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-12 21:03 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-12 21:03 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-12 21:03 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-12 21:03 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-12 21:03 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-12 21:03 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-12 21:03 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-12 21:03 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-12 21:03 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-12 21:03 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-12 21:03 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-12 21:03 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-12 21:03 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-12 21:03 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-12 21:03 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-12 21:03 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-12 21:03 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-12 21:03 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-12 21:03 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-12 21:03 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-12 21:03 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-12 21:03 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-12 21:03 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-12 21:03 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-12 21:03 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-12 21:03 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-12 21:03 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-12 21:03 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-12 21:03 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-12 21:03 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-12 21:03 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-12 21:03 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-12 21:03 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-12 21:03 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-12 21:03 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-12 21:00 - 2014-03-03 10:26 - 00063672 _____ () C:\Windows\setupact.log

2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-12 20:57 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls

2014-02-12 20:57 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls

2014-02-12 20:57 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2014-02-12 20:57 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-02-12 20:57 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-02-12 20:57 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-02-12 20:57 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-02-12 20:57 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll

2014-02-12 20:57 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll

2014-02-12 20:57 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll

2014-02-12 20:57 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe

2014-02-12 20:57 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe

2014-02-12 20:57 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll

2014-02-12 20:57 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll

2014-02-12 20:57 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll

2014-02-12 20:57 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe

2014-02-12 20:57 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

2014-02-12 20:57 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll

2014-02-12 20:57 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

2014-02-12 19:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-02-12 19:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-02-12 19:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2014-02-12 19:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2014-02-12 19:36 - 2014-02-19 18:20 - 00000000 ____D () C:\Qoobox

2014-02-12 18:58 - 2014-02-13 14:16 - 00000000 ____D () C:\Windows\erdnt

2014-02-12 15:21 - 2014-02-12 16:05 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite

2014-02-12 14:10 - 2014-02-12 14:11 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe

2014-02-12 12:30 - 2014-02-12 13:02 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar

2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk

2014-02-12 12:03 - 2014-02-12 12:18 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe

2014-02-12 11:22 - 2014-02-12 11:39 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip

2014-02-11 22:27 - 2014-02-19 18:18 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-11 22:23 - 2014-03-03 13:39 - 00000000 ____D () C:\FRST

2014-02-11 22:22 - 2014-03-03 13:39 - 02156544 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 21:23 - 2014-02-11 22:00 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:22 - 2014-02-11 21:23 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:19 - 2014-02-11 21:20 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 17:54 - 2014-02-12 21:06 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-11 17:50 - 2014-02-12 20:59 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:50 - 2014-02-11 17:34 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:30 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-02-11 16:30 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-02-11 16:30 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-02-11 16:30 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-02-11 16:29 - 2014-02-11 16:30 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:27 - 2014-02-11 16:32 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-04 16:14 - 2013-06-12 15:15 - 00100864 _____ () C:\Users\Pc\AppData\Roaming\zlib1.dll

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:09 - 2014-02-13 16:47 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-04 13:07 - 2014-02-04 13:08 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:20 - 2014-02-02 13:21 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe
 

==================== One Month Modified Files and Folders =======
 

2014-03-03 13:40 - 2014-02-17 16:53 - 00015668 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-03-03 13:39 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-03-03 13:39 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST

2014-03-03 13:39 - 2014-02-11 22:22 - 02156544 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-03-03 13:33 - 2011-05-10 01:27 - 01762216 _____ () C:\Windows\WindowsUpdate.log

2014-03-03 13:28 - 2014-02-19 18:25 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype

2014-03-03 13:27 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-03-03 12:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-03-03 12:49 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files

2014-03-03 12:49 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files

2014-03-03 10:27 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-03-03 10:27 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-03-03 10:26 - 2014-02-21 10:01 - 681276793 _____ () C:\Windows\MEMORY.DMP

2014-03-03 10:26 - 2014-02-12 21:00 - 00063672 _____ () C:\Windows\setupact.log

2014-03-03 10:26 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump

2014-03-03 10:26 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-03-02 12:31 - 2014-03-02 12:31 - 00262144 ____N () C:\Windows\Minidump\030214-23290-01.dmp

2014-03-02 01:35 - 2014-03-02 01:21 - 00000000 ____D () C:\Users\Pc\Desktop\Anwalt

2014-03-02 01:24 - 2014-03-02 01:24 - 00262144 ____N () C:\Windows\Minidump\030214-22011-01.dmp

2014-03-01 20:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-02-28 22:19 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-02-28 22:19 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat

2014-02-28 22:19 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat

2014-02-28 22:19 - 2009-07-14 06:13 - 01625030 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-28 15:26 - 2014-02-28 15:26 - 00262144 ____N () C:\Windows\Minidump\022814-26005-01.dmp

2014-02-28 12:17 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify

2014-02-28 12:16 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify

2014-02-28 10:18 - 2014-02-28 10:18 - 00262144 ____N () C:\Windows\Minidump\022814-23665-01.dmp

2014-02-28 08:46 - 2014-02-28 08:46 - 00275704 _____ () C:\Windows\Minidump\022814-34226-01.dmp

2014-02-27 18:14 - 2014-02-27 18:14 - 00275704 _____ () C:\Windows\Minidump\022714-24070-01.dmp

2014-02-25 23:19 - 2014-02-25 23:18 - 00275704 _____ () C:\Windows\Minidump\022514-25162-01.dmp

2014-02-25 22:38 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-25 22:38 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-25 19:45 - 2014-02-25 19:45 - 01956366 _____ () C:\Users\Pc\Downloads\EasyRootingToolkit_XPERIA-Z_SO-02E_v101-ENGLISH_tkymgr.zip

2014-02-25 19:44 - 2014-02-25 19:38 - 00015636 _____ () C:\Windows\DPINST.LOG

2014-02-25 19:43 - 2014-02-25 19:42 - 15305933 _____ () C:\Users\Pc\Downloads\Flashtool-drivers.exe

2014-02-25 17:43 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps

2014-02-25 14:20 - 2014-02-25 14:20 - 00275704 _____ () C:\Windows\Minidump\022514-24382-01.dmp

2014-02-22 14:04 - 2014-02-22 14:04 - 00262144 ____N () C:\Windows\Minidump\022214-20467-01.dmp

2014-02-21 21:00 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-21 21:00 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-21 21:00 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-21 17:37 - 2014-02-21 17:37 - 00262144 ____N () C:\Windows\Minidump\022114-21996-01.dmp

2014-02-21 10:01 - 2014-02-21 10:01 - 00275704 _____ () C:\Windows\Minidump\022114-22214-01.dmp

2014-02-20 15:05 - 2014-02-20 15:05 - 00262144 ____N () C:\Windows\Minidump\022014-19281-01.dmp

2014-02-19 21:22 - 2012-10-18 00:39 - 00004098 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-02-19 21:22 - 2012-10-18 00:39 - 00003846 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-02-19 18:32 - 2014-02-19 18:32 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-02-19 18:32 - 2014-02-18 13:54 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-02-19 18:32 - 2012-10-26 13:14 - 00000000 ____D () C:\ProgramData\Skype

2014-02-19 18:24 - 2012-10-26 13:15 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Old_skype

2014-02-19 18:20 - 2014-02-19 18:20 - 00000000 ___SD () C:\uninstall.exe

2014-02-19 18:20 - 2014-02-12 19:36 - 00000000 ____D () C:\Qoobox

2014-02-19 18:18 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-02-19 18:18 - 2012-09-28 18:04 - 00000000 ____D () C:\Users\Pc

2014-02-18 18:02 - 2012-11-03 20:03 - 00000000 ____D () C:\Users\Pc\Documents\My Games

2014-02-18 17:55 - 2014-02-18 17:55 - 00000359 _____ () C:\Windows\DirectX.log

2014-02-18 17:53 - 2014-02-18 17:53 - 00001636 _____ () C:\Users\Public\Desktop\Outlast.lnk

2014-02-18 17:40 - 2014-02-18 17:40 - 00000000 ____D () C:\GOG Games

2014-02-18 17:36 - 2014-02-18 17:35 - 00000000 ____D () C:\Program Files (x86)\Outlast

2014-02-18 15:00 - 2014-02-18 15:00 - 00002942 _____ () C:\Windows\System32\Tasks\{C5C38CE5-09E8-406A-BAA2-E4C07F7224FB}

2014-02-18 13:55 - 2014-02-18 13:55 - 00000000 ____D () C:\Users\Pc\AppData\Local\Skype

2014-02-18 13:53 - 2014-02-18 13:52 - 35671200 _____ (Skype Technologies S.A.) C:\Users\Pc\Downloads\SkypeSetupFull(1).exe

2014-02-16 18:30 - 2012-11-24 19:22 - 00000000 ____D () C:\Program Files (x86)\JDownloader

2014-02-15 21:03 - 2012-10-28 12:40 - 00000000 ____D () C:\AeriaGames

2014-02-15 20:38 - 2014-02-15 20:38 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-15 20:36 - 2014-02-15 20:36 - 02347384 _____ (ESET) C:\Users\Pc\Downloads\esetsmartinstaller_enu.exe

2014-02-15 20:35 - 2012-10-18 00:39 - 00000000 ____D () C:\Users\Pc\AppData\Local\Google

2014-02-15 20:35 - 2012-10-18 00:39 - 00000000 ____D () C:\Program Files (x86)\Google

2014-02-15 14:14 - 2013-08-20 18:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-02-14 22:09 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client

2014-02-14 14:24 - 2014-02-14 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-02-13 22:32 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Apps\2.0

2014-02-13 22:16 - 2014-02-13 22:16 - 00000000 ____D () C:\Windows\ERUNT

2014-02-13 22:13 - 2014-02-13 22:13 - 01037530 _____ (Thisisu) C:\Users\Pc\Desktop\JRT.exe

2014-02-13 22:11 - 2013-05-21 18:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Codec Pack Packages

2014-02-13 22:05 - 2014-02-13 21:51 - 00000000 ____D () C:\AdwCleaner

2014-02-13 21:59 - 2014-02-12 21:18 - 00110882 _____ () C:\Windows\PFRO.log

2014-02-13 21:51 - 2014-02-13 21:51 - 01166132 _____ () C:\Users\Pc\Desktop\adwcleaner.exe

2014-02-13 21:19 - 2014-02-13 21:19 - 01243588 _____ () C:\Users\Pc\Downloads\ProcessExplorer.zip

2014-02-13 19:45 - 2013-12-30 14:50 - 00000000 ____D () C:\Program Files (x86)\Wargame AirLand Battle

2014-02-13 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-02-13 16:47 - 2014-02-04 13:09 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Riot Games

2014-02-13 16:43 - 2014-02-13 16:43 - 00001613 _____ () C:\Users\Public\Desktop\Play League of Legends.lnk

2014-02-13 16:41 - 2014-02-13 16:40 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13(1).exe

2014-02-13 16:41 - 2014-02-13 16:40 - 32229024 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_NA_Installer_05_07_13.exe

2014-02-13 15:43 - 2014-02-13 15:11 - 760671830 _____ () C:\Users\Pc\Downloads\Narutowip2.rar

2014-02-13 15:40 - 2014-02-13 15:18 - 347645656 _____ () C:\Users\Pc\Downloads\2.0_Music.rar

2014-02-13 15:19 - 2014-02-13 15:16 - 29934138 _____ () C:\Users\Pc\Downloads\narutowippatch.14.zip

2014-02-13 15:17 - 2014-02-13 15:17 - 03067492 _____ () C:\Users\Pc\Downloads\narutosource.rar

2014-02-13 14:36 - 2014-02-13 14:36 - 04102163 _____ () C:\Users\Pc\Downloads\tdsskiller.zip

2014-02-13 14:29 - 2014-02-13 14:29 - 00043125 _____ () C:\ComboFix.txt

2014-02-13 14:18 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2014-02-13 14:16 - 2014-02-12 18:58 - 00000000 ____D () C:\Windows\erdnt

2014-02-13 14:15 - 2012-09-28 18:06 - 00000000 ___RD () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-02-13 13:50 - 2014-02-13 13:51 - 05180679 ____R (Swearware) C:\Users\Pc\Desktop\combofix.exe

2014-02-13 13:50 - 2014-02-13 13:49 - 05180679 _____ (Swearware) C:\Users\Pc\Downloads\ComboFix.exe

2014-02-12 22:27 - 2014-02-12 22:27 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Avira

2014-02-12 22:24 - 2014-02-12 22:24 - 00002078 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\ProgramData\Avira

2014-02-12 22:23 - 2014-02-12 22:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-02-12 22:08 - 2014-02-12 22:04 - 139704984 _____ () C:\Users\Pc\Downloads\avira_ultimate_protection_suite_de.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00264757 _____ () C:\Users\Pc\Downloads\FHSetup.exe

2014-02-12 22:05 - 2014-02-12 22:05 - 00001981 _____ () C:\Users\Pc\Desktop\Update Checker.lnk

2014-02-12 22:05 - 2014-02-12 22:05 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com

2014-02-12 21:54 - 2014-02-12 21:54 - 00007674 _____ () C:\Users\Pc\AppData\Local\Resmon.ResmonCfg

2014-02-12 21:16 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT

2014-02-12 21:10 - 2012-10-18 05:30 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-02-12 21:06 - 2014-02-11 17:54 - 02539172 _____ () C:\Windows\system32\Drivers\Cat.DB

2014-02-12 21:00 - 2014-02-12 21:00 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-12 20:59 - 2014-02-11 17:50 - 00000000 ____D () C:\ProgramData\PC Tools

2014-02-12 20:56 - 2012-10-17 23:45 - 00000000 ____D () C:\Users\Pc\AppData\Local\Adobe

2014-02-12 19:44 - 2012-10-18 00:43 - 00000000 ____D () C:\ProgramData\Norton

2014-02-12 16:59 - 2013-04-07 21:02 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade Warband Savegames

2014-02-12 16:05 - 2014-02-12 15:21 - 1064637787 _____ () C:\Users\Pc\Downloads\Naruto2.1.rar

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Suite 2013

2014-02-12 14:12 - 2014-02-12 14:12 - 00000000 ____D () C:\Program Files (x86)\DLLSuite

2014-02-12 14:11 - 2014-02-12 14:10 - 16588429 _____ ( ) C:\Users\Pc\Downloads\DLLSuite_Setup.exe

2014-02-12 13:02 - 2014-02-12 12:30 - 1312122312 _____ () C:\Users\Pc\Downloads\ACOK_1.11.rar

2014-02-12 12:27 - 2014-02-12 12:27 - 00001152 _____ () C:\Users\Pc\Desktop\Mount&Blade Warband.lnk

2014-02-12 12:24 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband

2014-02-12 12:18 - 2014-02-12 12:03 - 615004486 _____ () C:\Users\Pc\Downloads\mb_warband_setup_1158.exe

2014-02-12 11:39 - 2014-02-12 11:22 - 53254767 _____ () C:\Users\Pc\Downloads\LoLRADS_EUW_german.zip

2014-02-12 11:02 - 2013-12-30 17:30 - 00000000 ____D () C:\Program Files (x86)\Supreme Commander 2

2014-02-12 08:31 - 2012-10-19 17:25 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll

2014-02-12 08:31 - 2012-10-19 17:25 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll

2014-02-11 22:21 - 2014-02-11 22:21 - 00000466 _____ () C:\Windows\SysWOW64\defogger_disable.log

2014-02-11 22:00 - 2014-02-11 21:23 - 00000000 ____D () C:\ProgramData\SecTaskMan

2014-02-11 21:23 - 2014-02-11 21:22 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager

2014-02-11 21:20 - 2014-02-11 21:19 - 02365840 _____ () C:\Users\Pc\Downloads\SecurityTaskManager_Setup.exe

2014-02-11 21:03 - 2014-02-11 21:03 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TestApp

2014-02-11 20:58 - 2014-02-11 20:58 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-11 20:58 - 2013-08-20 16:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-11 20:57 - 2014-02-11 20:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pc\Downloads\mbam-setup-1.75.0.1300(1).exe

2014-02-11 17:34 - 2014-02-11 16:50 - 00000000 ____D () C:\Users\Pc\AppData\Local\NPE

2014-02-11 16:55 - 2012-12-20 15:52 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-02-11 16:54 - 2014-02-11 16:54 - 00000000 ____D () C:\ProgramData\SMR410

2014-02-11 16:38 - 2014-02-11 16:38 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

2014-02-11 16:37 - 2014-02-11 16:37 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-02-11 16:35 - 2013-07-29 11:35 - 00000196 _____ () C:\Users\Pc\AppData\Roaming\WB.CFG

2014-02-11 16:32 - 2014-02-11 16:27 - 223165336 ____N (Symantec Corporation) C:\Users\Pc\Downloads\NIS_21.1.0.18_SYMTB_TMD_MRFTT_820_10131.exe

2014-02-11 16:32 - 2013-10-20 11:29 - 00000000 ____D () C:\ProgramData\Oracle

2014-02-11 16:30 - 2014-02-11 16:29 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log

2014-02-11 16:30 - 2013-07-20 17:55 - 00000000 ____D () C:\Program Files (x86)\Java

2014-02-11 16:03 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-02-11 16:03 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite

2014-02-11 16:03 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent

2014-02-11 15:59 - 2014-02-11 15:59 - 00003582 _____ () C:\Windows\System32\Tasks\PileFile reminder

2014-02-11 15:59 - 2014-02-11 15:59 - 00003160 _____ () C:\Windows\System32\Tasks\PileFile logon

2014-02-11 15:59 - 2014-02-11 15:59 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Oxy

2014-02-10 23:37 - 2014-02-13 14:36 - 04122976 _____ (Kaspersky Lab ZAO) C:\Users\Pc\Desktop\TDSSKiller.exe

2014-02-07 17:18 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt

2014-02-06 13:16 - 2014-02-12 21:03 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-06 12:30 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-06 12:30 - 2014-02-12 21:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-06 12:12 - 2014-02-12 21:03 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-06 12:07 - 2014-02-12 21:03 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-06 12:06 - 2014-02-12 21:03 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-06 11:57 - 2014-02-12 21:03 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-06 11:56 - 2014-02-12 21:03 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-06 11:52 - 2014-02-12 21:03 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-06 11:49 - 2014-02-12 21:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-06 11:48 - 2014-02-12 21:03 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-06 11:48 - 2014-02-12 21:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-06 11:38 - 2014-02-12 21:03 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-06 11:32 - 2014-02-12 21:03 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-06 11:20 - 2014-02-12 21:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-06 11:17 - 2014-02-12 21:03 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-06 11:11 - 2014-02-12 21:03 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-06 11:01 - 2014-02-12 21:03 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-06 11:00 - 2014-02-12 21:03 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-06 10:57 - 2014-02-12 21:03 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-06 10:57 - 2014-02-12 21:03 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-06 10:52 - 2014-02-12 21:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-06 10:52 - 2014-02-12 21:03 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-06 10:50 - 2014-02-12 21:03 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-06 10:49 - 2014-02-12 21:03 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-06 10:47 - 2014-02-12 21:03 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-06 10:46 - 2014-02-12 21:03 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-06 10:25 - 2014-02-12 21:03 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-06 10:25 - 2014-02-12 21:03 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-06 10:24 - 2014-02-12 21:03 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-06 10:22 - 2014-02-12 21:03 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-06 10:13 - 2014-02-12 21:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-06 10:09 - 2014-02-12 21:03 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-06 10:03 - 2014-02-12 21:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-06 09:55 - 2014-02-12 21:03 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-06 09:41 - 2014-02-12 21:03 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-06 09:40 - 2014-02-12 21:03 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-06 09:36 - 2014-02-12 21:03 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-06 09:34 - 2014-02-12 21:03 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-05 12:36 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr

2014-02-05 12:36 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe

2014-02-04 15:46 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0

2014-02-04 13:49 - 2014-02-04 13:49 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WinSecurity.FISC.37314945131128502.8.1.Run.exe

2014-02-04 13:42 - 2014-02-04 13:42 - 00347816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\MicrosoftFixit.WindowsFirewall.RNP.Run.exe

2014-02-04 13:08 - 2014-02-04 13:07 - 34888568 _____ (Riot Games) C:\Users\Pc\Downloads\LeagueofLegends_EUW_Installer_06_12_13.exe

2014-02-04 12:20 - 2014-02-04 12:20 - 00001024 _____ () C:\Windows\SysWOW64\.rnd

2014-02-04 12:20 - 2014-01-21 10:23 - 00000000 ____D () C:\Users\Pc\AppData\Local\CyberGhost

2014-02-02 13:32 - 2014-02-02 13:32 - 00000000 ___SH () C:\Users\Pc\AppData\Local\LumaEmu

2014-02-02 13:28 - 2014-02-02 13:28 - 00000000 ____D () C:\Users\Pc\Desktop\RustClient_v19.12.2013

2014-02-02 13:27 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele

2014-02-02 13:21 - 2014-02-02 13:20 - 06499816 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\vcredist_x86.exe

2014-02-02 13:21 - 2013-08-18 17:43 - 00000000 ____D () C:\ProgramData\Package Cache

2014-02-01 11:35 - 2013-06-17 13:35 - 00000005 _____ () C:\Users\Pc\AppData\Roaming\WBPU-TTL.DAT
 

Some content of TEMP:

====================

C:\Users\Pc\AppData\Local\Temp\avgnt.exe

C:\Users\Pc\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-02-28 20:09
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-03-2014

Ran by Pc at 2014-03-03 13:40:37

Running from C:\Users\Pc\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

µTorrent (HKCU\...\uTorrent) (Version: 3.3.2.30303 - BitTorrent Inc.)

Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)

Adobe Reader X (10.1.7) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.7 - Adobe Systems Incorporated)

Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden

Aeria Ignite (HKLM-x32\...\Aeria Ignite 1.13.3296) (Version: 1.13.3296 - Aeria Games & Entertainment)

Aeria Ignite (HKLM-x32\...\Aeria Ignite) (Version: 1.13.3296 - Aeria Games & Entertainment)

Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment) Hidden

Age of Conan: Unchained (HKLM-x32\...\Age of Conan_is1) (Version:  - Funcom)

Age of Empires III (HKLM-x32\...\InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}) (Version: 1.00.0000 - Microsoft Game Studios)

Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden

AI Suite (HKLM-x32\...\{310BC5E2-31AF-49BB-904D-E71EB93645DC}) (Version: 1.06.22 - )

AION Free-To-Play (HKLM-x32\...\InstallShield_{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}) (Version: 2.70.0000 - Gameforge)

AION Free-To-Play (x32 Version: 2.70.0000 - Gameforge) Hidden

AirPlus XtremeG DWL-G122 (HKLM-x32\...\{2B7E4354-0492-460A-BDB1-1F59EE141025}) (Version: 1.0.30 - D-Link)

Aiseesoft MP4 Video Converter 7.1.20 (HKLM-x32\...\{75CE1C3D-5B84-4e3b-BC17-246607907E6B}_is1) (Version: 7.1.20 - Aiseesoft Studio)

Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)

Akamai NetSession Interface (HKLM-x32\...\Akamai) (Version:  - Akamai Technologies, Inc)

Alliance of Valiant Arms (HKLM-x32\...\Alliance of Valiant Arms) (Version:  - )

AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden

AMD APP SDK Runtime (Version: 10.0.923.1 - Advanced Micro Devices Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (HKLM\...\{3C378793-5288-0165-FCA4-D319D5E4A490}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden

AMD Fuel (Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden

AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden

AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden

American Conquest Fight Back (HKLM-x32\...\American Conquest Fight Back) (Version:  - )

ANNO 2070 (HKLM-x32\...\{B48E264C-C8CD-4617-B0BE-46E977BAD694}) (Version: 1.0.0.0 - Ubisoft)

ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 3.0.94.193 - eCareme Technologies, Inc.)

ASUSUpdate (HKLM-x32\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 7.18.03 - ASUSTeK Computer Inc.)

ATI AVIVO64 Codecs (Version: 11.6.0.10707 - ATI Technologies Inc.) Hidden

Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)

Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-4300-A758B70C0A00}) (Version: 12.10.0.2951 - APN, LLC)

Avira Ultimate Protection Suite (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.340 - Avira)

Battle For Graxia (HKLM-x32\...\BattleForGraxia) (Version:  - )

BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version:  - Irrational Games)

Black & White® 2 (HKLM-x32\...\{D9E52CD1-9DF1-4A8A-9BDC-1E5E53982F2B}) (Version: 1.00.0000 - Lionhead Studios)

Blitzkrieg Burning Horizon (HKLM-x32\...\Blitzkrieg Burning Horizon) (Version:  - )

Brick-Force  (HKLM-x32\...\Brick-Force) (Version:  - Infernum Productions AG)

Brytenwalda Version 1.40 (HKLM-x32\...\{4D15C6C1-74C9-4AA4-8378-CEEDE7E53F39}_is1) (Version: 1.40 - Brytenwalda Dev.)

CAESAR IV (HKLM-x32\...\{B7666229-351B-47D9-AA6F-DF777CF04BBF}) (Version: 1.2 - Tilted Mill Entertainment)

Call of Duty: Black Ops II - Multiplayer (HKLM-x32\...\Steam App 202990) (Version:  - )

Call of Duty: Black Ops II - Zombies (HKLM-x32\...\Steam App 212910) (Version:  - )

Camtasia Studio 8 (HKLM-x32\...\{B1F8F5EB-75E2-40C3-9A50-7907F1C910F1}) (Version: 8.0.3.994 - TechSmith Corporation)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.3868 - CDBurnerXP)

Celtic Kings - The Punic Wars (HKLM-x32\...\{D1641CBC-4C2F-4C32-AC65-4BBDF20B839D}) (Version:  - )

Chivalry Medieval Warfare (c) Torn Banner Studios version 1 (HKLM-x32\...\Chivalry Medieval Warfare (c) Torn Banner Studios_is1) (Version: 1 - )

Codec Pack Packages (HKCU\...\Codec Pack Packages) (Version:  - ) <==== ATTENTION

Cossacks - The Art Of War (HKLM-x32\...\Cossacks : The Art Of War) (Version:  - )

Cossacks 2 - Battle for Europe (HKLM-x32\...\Cossacks 2 - Battle for Europe) (Version:  - )

Cossacks II (HKLM-x32\...\Cossacks II) (Version:  - )

Cross Fire En (HKLM-x32\...\Cross Fire_is1) (Version:  - Z8Games.com)

Crossfire Europe (HKLM-x32\...\Crossfire Europe) (Version: 1.107 - SG INTERACTIVE)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)

DarthMod: Shogun II (HKLM-x32\...\DarthMod: Shogun II) (Version:  - )

DBO_CT_TW (HKLM-x32\...\{0E892FBB-0060-44C9-9E8C-017855956193}) (Version: 1.57.22 - Cayennetech)

DC-Bass Source 1.3.0 (HKLM-x32\...\DC-Bass Source) (Version:  - )

Die Schlacht um Mittelerde™ II (HKLM-x32\...\{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}) (Version:  - )

DirectVobSub 2.40.4209 (HKLM-x32\...\vsfilter_is1) (Version: 2.40.4209 - MPC-HC Team)

DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.8 - DivX, LLC)

DLL Suite 2013 (HKLM-x32\...\{885843E7-6CAC-4791-B7BF-1CD516017954}_is1) (Version:  - )

Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve )

Dungeons and Dragons Online (HKCU\...\DDO_midres_en) (Version:  - )

Elsword_DE (HKLM-x32\...\Elsword_DE_is1) (Version:  - )

EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Europa Universalis IV (HKLM-x32\...\Europa Universalis IV_is1) (Version:  - Paradox Interactive)

ffdshow v1.1.4399 [2012-03-22] (HKLM-x32\...\ffdshow_is1) (Version: 1.1.4399.0 - )

FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version:  - )

Floris Mod Pack 2.54 (HKLM-x32\...\Floris Mod Pack_is1) (Version:  - )

Forged By Chaos (HKLM-x32\...\ForgedByChaos) (Version:  - )

Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Fraps (remove only) (HKLM-x32\...\Fraps) (Version:  - )

Free Audio CD Burner version 2.0.22.320 (HKLM-x32\...\Free Audio CD Burner_is1) (Version: 2.0.22.320 - DVDVideoSoft Ltd.)

Free MP4 Video Converter version 5.0.20.1031 (HKLM-x32\...\Free MP4 Video Converter_is1) (Version: 5.0.20.1031 - DVDVideoSoft Ltd.)

From Dust (HKLM-x32\...\{578485F8-60F3-4C61-9183-0698E581B902}) (Version: 1.0.0 - Ubisoft)

FuNDeaulls (HKLM-x32\...\{478472F9-9E09-492A-BDAB-42EE595EF1AD}) (Version:  - FFunDeals)

Gameforge Live 1.7.0 "Legend" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 1.7.0 - Gameforge)

GameRanger (HKCU\...\GameRanger) (Version:  - GameRanger Technologies)

GamersFirst LIVE! (HKCU\...\GamersFirst LIVE!) (Version:  - GamersFirst)

Ghost Recon Online (EU) (HKCU\...\d8be6c3f847d7d92) (Version: 1.34.9860.1 - Ubisoft)

GIMP 2.8.2 (HKLM\...\GIMP-2_is1) (Version: 2.8.2 - The GIMP Team)

Google Drive (HKLM-x32\...\{E87022D3-C8C9-4C76-8E27-BC7F18F9B8FB}) (Version: 1.14.6059.644 - Google, Inc.)

Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4805.320 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden

Gothic III (HKLM-x32\...\{02B244A2-7F6A-42E8-A36F-8C385D7A1625}) (Version: 1.0.0 - JoWooD Productions Software AG)

grafstat4 (HKLM-x32\...\{58AEE3E0-8746-11DD-81B6-000AE67E2618}_is1) (Version: 4.276 - DrSoft)

GS-Supporter 1.80 (HKLM-x32\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{e81a9dc1}) (Version:  - Verified Publisher) <==== ATTENTION

Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)

Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )

Happy Cloud Client (HKCU\...\HappyCloud) (Version: 3.41 - Happy Cloud, Inc.)

Haunt 1.0 64bit (HKCU\...\Haunt 1.0 64bit) (Version:  - )

Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)

HydraVision (x32 Version: 4.2.208.0 - ATI Technologies Inc.) Hidden

Infestation: Survivor Stories (HKLM-x32\...\Steam App 226700) (Version:  - Hammerpoint Interactive)

inSSIDer 3 (HKLM-x32\...\{CDF246AE-C6E3-438F-AA76-21700DCC15F6}) (Version: 3.0.6.42 - MetaGeek, LLC)

Installation (HKCU\...\7b57a0c21f2bb884) (Version: 1.0.0.8 - Installation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2266 - Intel Corporation)

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)

Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)

King Arthur II (HKLM-x32\...\{B756513E-70E9-4513-916C-9E3D02DC42D7}}_is1) (Version:  - Paradox Interactive)

K-Lite Codec Pack 9.4.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 9.4.0 - )

Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version:  - )

LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )

League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)

League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )

League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden

LOCO EVOLUTION (HKLM-x32\...\LOCO) (Version: EVOLUTION - DanalGames)

Logitech Print Service (HKLM-x32\...\Logitech Print Service) (Version:  - )

Logitech QuickCam-Software (HKLM-x32\...\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}) (Version: 8.47.0000 - Logitech, Inc.)

LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.5.1 - www.leaguereplays.com)

Lost Empire - Immortals (HKLM-x32\...\{28259F68-33B4-45C1-82F8-51D1DBD6AEB9}) (Version: 1.0.0 - Pollux Gamelabs)

Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)

Metin2 (HKLM-x32\...\Metin2_is1) (Version:  - Gameforge 4D GmbH)

Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )

Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version:  - )

Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden

Microsoft XNA Framework Redistributable 1.0 Refresh (HKLM-x32\...\{311F799A-FCE9-4D9E-B5D2-CBB8859B40BB}) (Version: 1.1.10405.0 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Mobistel Cynus T1 Drivers(x86) (HKLM-x32\...\{1581C5CA-D918-4822-A35A-DDED69A5631B}) (Version: 2.00 - Mobistel)

Mount&Blade Warband (HKLM-x32\...\Mount&Blade Warband) (Version:  - )

Mount&Blade With Fire and Sword (HKLM-x32\...\Mount&Blade With Fire and Sword) (Version:  - )

MountMusket Battalion (HKLM-x32\...\{8AF7479C-B28D-4BFF-867B-4755DE019259}_is1) (Version: 0.4.2 - MountMusket Battalion Team)

Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MySQL Connector/ODBC 3.51 (HKLM-x32\...\{0CB3C535-1171-4A20-B549-E2CB5DEB9723}) (Version: 3.51.12 - MySQL AB)

Napoleonic Wars (HKLM-x32\...\Napoleonic Wars) (Version: 1.0 - Mount&Blade Napoleonic Wars)

NC Launcher (GameForge) (HKLM-x32\...\NCLauncher_GameForge) (Version:  - NCsoft)

Nero 9 Essentials (HKLM-x32\...\{42ed5c4e-e2b0-4b4f-9db8-a0362aa23b6a}) (Version:  - Nero AG)

Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden

Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden

Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden

Nero StartSmart (x32 Version: 9.4.12.100 - Nero AG) Hidden

Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.4.2 - Notepad++ Team)

NVIDIA 3D Vision Treiber 270.61 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 270.61 - NVIDIA Corporation)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)

NVIDIA ForceWare Network Access Manager (HKLM-x32\...\{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}) (Version: 1.00.7325.0 - NVIDIA Corporation)

NVIDIA Grafiktreiber 270.61 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 270.61 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.2.22.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.22.1 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.270.54.0 - NVIDIA Corporation) Hidden

NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.7061 - NVIDIA Corporation) Hidden

NVIDIA Systemsteuerung 270.61 (Version: 270.61 - NVIDIA Corporation) Hidden

OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)

OpenSource Flash Video Splitter 1.0.0.5 (HKLM-x32\...\OpenSource Flash Video Splitter) (Version: 1.0.0.5 - )

Outlast (HKLM-x32\...\GOGPACKOUTLAST_is1) (Version: 2.0.0.3 - GOG.com)

Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)

Panzar (HKLM-x32\...\{4FF82163-423A-43CE-898D-3B60D19A5E8F}_is1) (Version: 1.0 - Panzar)

Patch v2.2 (HKLM-x32\...\{74A84478-70A5-4F7A-966C-FA2771FF91A5}_is1) (Version:  - RUNEFORGE Games Studios)

Patrizier IV (HKLM-x32\...\{25B473C3-2C62-482B-858F-94ED76880F79}) (Version: 1.0.0 - Kalypso Media)

PC Probe II (HKLM-x32\...\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}) (Version: 1.04.92 - ASUSTeK Computer Inc.)

Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Pixsta (HKCU\...\Pokki_83453a3d886e527a470b5bb8291dd338de4b1e44) (Version: 2.5.0.48600 - Pokki)

PlanetSide 2 (HKCU\...\soe-PlanetSide 2 PSG) (Version: 1.0.3.183 - Sony Online Entertainment)

Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden

Pokki (HKCU\...\Pokki) (Version: 0.266.1.172 - Pokki)

Pokki Download Helper (HKCU\...\PokkiDownloadHelper) (Version: 1.3.1.282 - Pokki)

PowerISO (HKLM-x32\...\PowerISO) (Version: 5.4 - Power Software Ltd)

PrivitizeVPN (HKLM-x32\...\PrivitizeVPN) (Version: 1.0.0 - OOO Industry) <==== ATTENTION

ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)

PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)

QuickShare (HKLM-x32\...\{B630320B-4B6A-4623-A05D-80DAA4C73CE9}) (Version: 1.38.61.10911 - Linkury Inc.) <==== ATTENTION

RaiderZ (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219435}_is1) (Version: 1.0.0.36787 - Gameforge)

RAIDXpert (HKLM-x32\...\InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}) (Version: 3.2.1540.10 - AMD)

RAIDXpert (x32 Version: 3.2.1540.10 - AMD) Hidden

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)

Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 1.00.0000 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.34.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation) Hidden

Rise and Fall (HKLM-x32\...\{D078226E-83F2-45FD-9CDE-5DA66E5ADB51}) (Version: 1.00.0000 - Midway Games)

Roads of Rome 3 (HKLM-x32\...\Roads of Rome 3_is1) (Version:  - Realore Studios)

Roma Surrectum Deutsch 1.1.0.5 (HKLM-x32\...\Roma Surrectum Deutsch 1.1.0.5) (Version: 1.1.0.5 - ecozone)

Roma Surrectum II 2.5 (HKLM-x32\...\Roma Surrectum II) (Version: 2.5 - Roma Surrectum Team)

Rome - Total War(TM) (HKLM-x32\...\InstallShield_{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}) (Version: 1.0 - Activision)

Rome - Total War(TM) (x32 Version: 1.0 - Activision) Hidden

Rome Total War - patch 1.3 (HKLM-x32\...\{A5D65411-8E73-4C85-AD80-9FE8B7391CF9}) (Version: 1.3 - )

S4 League_EU (HKLM-x32\...\{42BB88C5-14B5-4AF7-84FC-9EB600BEBD26}) (Version: 1.00.0000 - )

S4 League_EU (HKLM-x32\...\{920AF47C-7A87-42C0-944F-7D07CECC3467}) (Version: 1.00.0000 - )

Security Task Manager 1.8g (HKLM-x32\...\Security Task Manager) (Version: 1.8g - Neuber Software)

Sid Meier's Civilization IV Colonization (HKLM-x32\...\{EF36A836-BF89-4A4F-B079-057B0C68C1E0}) (Version: 1.00 - Firaxis Games)

Skype™ 6.0 (HKLM-x32\...\{EA17F4FC-FDBF-4CF8-A529-2D983132D053}) (Version: 6.0.120 - Skype Technologies S.A.)

Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 0.1.1850.0 - Hi-Rez Studios)

SOE Web Installer (HKCU\...\SOE Web Installer) (Version: 1.0.3.171 - Sony Online Entertainment)

Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.13.6.201305161305 - Sony Ericsson Communications AB)

Sony PC Companion 2.10.181 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.181 - Sony)

Special Force 2  1.0 (HKLM-x32\...\Special Force 2 Beta_is1) (Version:  - )

Spotify (HKCU\...\Spotify) (Version: 0.9.7.16.g4b197456 - Spotify AB)

Spotydl 0.9.36.0 (HKLM-x32\...\Spotydl_is1) (Version: 0.9.36.0 - spotydl.com)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

Stronghold 2 (HKLM-x32\...\{16D2C649-CBA8-44EE-B730-12584667D487}) (Version: 1.00 - Firefly Studios)

Swords and Sandals 3 Multiplae Ultratus (HKLM-x32\...\Swords and Sandals 3 Multiplae Ultratus 1.2.7) (Version: 1.2.7 - 3rdsense Pty Ltd)

System Requirements Lab CYRI (HKLM-x32\...\{E362724E-9320-4946-AF34-874E7B6B2927}) (Version: 6.0.7.0 - Husdawg, LLC)

System Requirements Lab Detection (HKLM-x32\...\{A407FC22-36BF-4C82-A516-59D94BC505A9}) (Version: 1.0.5.0 - Husdawg, LLC)

System Requirements Lab for Intel (HKLM-x32\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)

TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.13.1 - TeamSpeak Systems GmbH)

The War Z version 1.0 (HKLM-x32\...\{BC3051A7-1021-4B57-A3DA-AAC24566FAE7}_is1) (Version: 1.0 - Arktos Entertainment Group LLC)

Tube Karaoke (HKLM-x32\...\YTKaraoke@DacSoft.org) (Version:  - Dacotta SoftEngineering)

Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)

Turbo Key (HKLM-x32\...\{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}) (Version: 1.01.03 - )

Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)

Vanguard: Saga of Heroes (HKLM-x32\...\{D0B3166F-BBE3-4025-B822-84A4D3D8608E}) (Version: 1.00.000 - Sigil Games Online)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)

VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)

VLC media player 2.0.2 (HKLM-x32\...\VLC media player) (Version: 2.0.2 - VideoLAN)

VLC Media Player DB Toolbar Toolbar (HKLM-x32\...\VLC Media Player DB Toolbar Toolbar) (Version:  - )

War Thunder Launcher 1.0.1.278 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version:  - 2013 Gaijin Entertainment Corporation)

Wargame AirLand Battle (c) Focus Home Interactive version RLD! (HKLM-x32\...\V2FyZ2FtZUFpckxhbmRCYXR0bGU=_is1) (Version: RLD! - )

Winamp (HKLM-x32\...\Winamp) (Version: 5.63  - Nullsoft, Inc)

Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Mobile Device Updater Component (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

WinRAR 4.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)

World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

Xfire (remove only) (HKLM-x32\...\Xfire) (Version:  - )

Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)

YGOPro DevPro Version 1.9.6 r0 (HKLM-x32\...\{3CF2634F-3F38-4DD3-9201-CB2FE6B5FF23}_is1) (Version: 1.9.6 r0 - YGOPro DevPro Online)

Zune (HKLM\...\Zune) (Version: 04.08.2345.00 - Microsoft Corporation)

Zune (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (CHS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (CHT) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (CSY) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (DAN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (DEU) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (ELL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (ESP) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (FIN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (FRA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (HUN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (IND) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (ITA) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (JPN) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (KOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (MSL) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (NLD) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (NOR) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (PLK) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (PTB) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (PTG) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (RUS) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden

Zune Language Pack (SVE) (Version: 04.08.2345.00 - Microsoft Corporation) Hidden
 

==================== Restore Points  =========================
 

22-02-2014 13:46:03 Geplanter Prüfpunkt

25-02-2014 12:21:49 Windows Update

25-02-2014 13:30:40 Windows-Sicherung

25-02-2014 18:38:52 Gerätetreiber-Paketinstallation: Sony Netzwerkadapter

25-02-2014 18:39:07 Gerätetreiber-Paketinstallation: Google, Inc.

28-02-2014 10:18:43 Windows Update

28-02-2014 21:16:59 Windows Update

03-03-2014 09:23:50 Windows-Sicherung
 

==================== Hosts content: ==========================
 

2009-07-14 03:34 - 2014-02-13 14:18 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {04316C8C-AAE9-4C0D-8A03-B85F7B769C08} - \PC Health Advisor Defrag No Task File

Task: {07441F79-075D-46D1-9621-B4385A0413E1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)

Task: {0ACDB7B0-58EC-44A5-B853-C74A95AB7C8B} - System32\Tasks\{350C38A0-1817-4215-9180-5D11686186E7} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()

Task: {0E29D04E-C41C-460F-89F4-9A92734E1D47} - System32\Tasks\{C5C38CE5-09E8-406A-BAA2-E4C07F7224FB} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2012-10-19] (Skype Technologies S.A.)

Task: {175BF8A3-9AD4-4F9A-B98B-598E8F706334} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18] (Google Inc.)

Task: {2691ADFB-DB4E-45E7-9439-ACD0C99AA70D} - System32\Tasks\{B7AB28D8-B0B8-4B92-82A6-19F4C878FB44} => C:\Users\Public\Sony Online Entertainment\Installed Games\PlanetSide 2 PSG\LaunchPad.exe [2013-03-05] (Sony Online Entertainment)

Task: {278F70B7-06C4-4D40-B948-858B1C8E33C9} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe

Task: {2B8021C3-95EB-4032-8827-F4F20FC80119} - System32\Tasks\{2AF4B969-DDA4-42BC-AC4D-0202126F86FA} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()

Task: {2E3A57BD-04E8-453A-AE42-B25FECD4F834} - System32\Tasks\{B08B504C-C99F-4CA5-AB04-41F9856C1544} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)

Task: {35C6FCEA-3FEE-4B6E-8BC6-983499CA4E4E} - \ParetoLogic Update Version3 No Task File

Task: {3AD8A18D-8622-47E6-A995-18047D8EF1D0} - \ParetoLogic Registration3 No Task File

Task: {43AF4D92-3759-4F3B-9F90-EFBFD6FC21D7} - \PC Health Advisor No Task File

Task: {46983AB9-9DB0-4B15-9866-70EB3D8ED964} - \Digital Sites No Task File

Task: {4913A02B-EF24-4AAE-98AF-0834AF4DCD6F} - System32\Tasks\{BB6CE9F5-E484-406C-AD0E-5A4DC75E4283} => D:\support\DrvSetup.exe

Task: {742E0C46-1F1B-4465-9AFF-E499A0C68AA9} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)

Task: {78BBB10A-F364-4E92-8219-8439ED42836E} - System32\Tasks\PileFile reminder => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION

Task: {7F1E600F-A1FB-44A2-95B1-0A9CFB4AED02} - System32\Tasks\{BEE78D85-4CF3-4479-8433-33E17174DFEB} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)

Task: {85F44FDF-4E73-4F08-858C-DC3F9505CFEB} - \DSite No Task File

Task: {8BDCC15A-AFC6-4F6B-9A3E-2D7C1ACF8C54} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe

Task: {8EDAF150-B25F-4F96-8025-08EF10739F82} - System32\Tasks\{31CDF611-4FF3-4119-866C-074E0E880CD6} => D:\support\DrvSetup.exe

Task: {8EDF384F-376F-4AB7-BA38-D81A4DAC2105} - \DealPly No Task File

Task: {981EBD38-9CF4-43D6-917F-8EFD65DC3C76} - System32\Tasks\{59A28418-2F35-48CC-8491-DB29133B4A07} => C:\Program Files (x86)\Ubisoft\Related Designs\ANNO 2070\Anno5.exe [2011-11-26] ()

Task: {99E34A15-E072-4951-88AF-47AFBAFFADE7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {9F055FC0-CA38-4918-A35F-E6909C3003BB} - System32\Tasks\{0CA4769F-3858-49F3-9E24-950045D22EC6} => D:\support\DrvSetup.exe

Task: {9FE6EAD7-A7CA-4ADC-BDE3-78CA35F5CD32} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-21] (Adobe Systems Incorporated)

Task: {ADB9BBC4-A3DA-49FF-A644-3E893812D24D} - System32\Tasks\PileFile logon => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION

Task: {B2D48DE0-F4A7-42F9-816C-1AC56B1A8872} - \DealPlyUpdate No Task File

Task: {B5285F3B-D7AF-45AE-9F2E-1BB7DBCFE22C} - \EPUpdater No Task File

Task: {B7F72847-9DC9-4BB9-83F3-9AADE971AD15} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.12\AsLoader.exe [2010-01-14] (ASUSTeK Computer Inc.)

Task: {BDAE8D31-C31A-436B-B816-F52EBF6947BA} - System32\Tasks\{69E6A0E4-9323-4511-9F4D-F69A398016E0} => D:\support\DrvSetup.exe

Task: {BE8F4974-67DF-4139-8246-206804A585FD} - System32\Tasks\{0C835611-E4AA-47E2-B53B-38A3543F30E8} => C:\Program Files (x86)\Cossacks - Back To War\dmcr.exe

Task: {C68FBEF9-502F-4103-B36B-27B4CDCDDD95} - System32\Tasks\{DA870EE4-507F-42F9-9DFB-BB41BD1ACED8} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)

Task: {CA19F92B-7524-4334-B5E5-3F47A5A3A453} - System32\Tasks\ASUS\Cpu Level Up Hook Lanunch => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHookLaunch.exe [2009-12-28] ()

Task: {D57D1710-AB16-40CD-A68E-A83485C47529} - System32\Tasks\{C02B44A9-7C7F-4B5E-87FD-8BFE74268C40} => C:\Program Files (x86)\American Conquest - Fight Back\dmcr.exe [2003-04-24] (-GSC-)

Task: {EB55C353-1ABB-4AFA-91C2-31D786524836} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe

Task: {F04B063C-0CD8-4D1E-941D-A30B17FF7A50} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-12-06 16:06 - 2013-12-06 16:06 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll

2013-07-26 05:59 - 2013-07-26 05:59 - 00814592 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll

2013-07-26 05:59 - 2013-07-26 05:59 - 03650560 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll

2013-12-06 16:06 - 2013-12-06 16:06 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2009-12-15 16:40 - 2009-12-15 16:40 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

2013-08-18 17:42 - 2014-01-24 22:17 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2011-05-10 01:43 - 2010-01-21 00:53 - 00496232 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

2011-05-10 01:42 - 2010-01-21 00:52 - 00076392 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll

2011-05-10 01:42 - 2010-01-21 00:53 - 00731752 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\SpecialCase.dll

2011-05-10 01:42 - 2010-01-21 00:53 - 00209000 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

2009-12-15 16:40 - 2009-12-15 16:40 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe

2009-12-15 16:41 - 2009-12-15 16:41 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe

2014-02-12 22:23 - 2013-12-09 11:45 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2012-10-18 00:42 - 2009-03-19 21:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll

2012-10-18 00:42 - 2009-03-19 21:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll

2012-10-18 00:42 - 2009-01-15 13:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll

2009-12-15 22:44 - 2009-12-15 22:44 - 00516096 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\libxml2.dll

2012-10-18 00:33 - 2009-04-29 13:24 - 00253952 _____ () C:\Program Files\ASUS\Turbo Key\pngio.dll

2012-10-18 00:33 - 2009-04-29 13:24 - 00208896 _____ () C:\Program Files\ASUS\Turbo Key\AiNap.dll

2012-10-18 00:33 - 2009-04-29 13:24 - 00008704 _____ () C:\Program Files\ASUS\Turbo Key\vvc.dll

2014-02-14 14:24 - 2014-02-14 14:24 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2011-04-07 20:54 - 2011-04-07 20:54 - 00239720 _____ () C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\Services: AdobeARMservice => 2

MSCONFIG\Services: McComponentHostService => 3

MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2

MSCONFIG\Services: Sony PC Companion => 3

MSCONFIG\Services: TunngleService => 3

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^Pc^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GamersFirst LIVE!.lnk => C:\Windows\pss\GamersFirst LIVE!.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: Aeria Ignite => "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent

MSCONFIG\startupreg: ASUSWebStorage => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSPanel.exe /S

MSCONFIG\startupreg: cefbaeacdccceasacfsfdsf => "C:\ProgramData\cefbaeacdccceasacfsfdsf.exe"

MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe

MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

MSCONFIG\startupreg: HDAudDeck => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

MSCONFIG\startupreg: ISUSPM => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

MSCONFIG\startupreg: LogitechSoftwareUpdate => "C:\Program Files (x86)\Logitech\Video\ManifestEngine.exe" boot

MSCONFIG\startupreg: LogitechVideoRepair => C:\Program Files (x86)\Logitech\Video\ISStart.exe /RegAll

MSCONFIG\startupreg: LogitechVideoTray => C:\Program Files (x86)\Logitech\Video\LogiTray.exe

MSCONFIG\startupreg: Pokki => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform

MSCONFIG\startupreg: PrivitizeVPN => C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe /autorun

MSCONFIG\startupreg: QtraxNotification => C:\Users\Pc\Qtrax\Player\Notification.exe

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background

MSCONFIG\startupreg: Spotify => "C:\Users\Pc\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Pc\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun

MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent

MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

MSCONFIG\startupreg: uTorrent => "C:\Users\Pc\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED

MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"

MSCONFIG\startupreg: Xvid => C:\Program Files (x86)\Xvid\CheckUpdate.exe

MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"
 

==================== Faulty Device Manager Devices =============
 

Name: TAP-Win32 Adapter V9 (Tunngle)

Description: TAP-Win32 Adapter V9 (Tunngle)

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: TAP-Win32 Provider V9 (Tunngle)

Service: tap0901t

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: 

Description: 

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (03/03/2014 10:26:55 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/03/2014 10:13:24 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/02/2014 00:31:58 PM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/02/2014 11:46:56 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/02/2014 01:29:41 AM) (Source: Application Hang) (User: )

Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 93c
 

Startzeit: 01cf35ade5703805
 

Endzeit: 453
 

Anwendungspfad: C:\Windows\Explorer.EXE
 

Berichts-ID: bafd13f6-a1a1-11e3-bdd7-3085a94266a8
 

Error: (03/02/2014 01:25:21 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/02/2014 01:20:53 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/01/2014 06:31:09 PM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/01/2014 06:25:46 PM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (02/28/2014 08:12:29 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
 

System errors:

=============

Error: (03/03/2014 10:27:37 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/03/2014 10:27:31 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/03/2014 10:26:45 AM) (Source: BugCheck) (User: )

Description: 0x00000101 (0x0000000000000021, 0x0000000000000000, 0xfffff880009b3180, 0x0000000000000004)C:\Windows\MEMORY.DMP
 

Error: (03/03/2014 10:26:45 AM) (Source: BugCheck) (User: )

Description: 
 

Error: (03/03/2014 10:26:44 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ‎03.‎03.‎2014 um 10:25:16 unerwartet heruntergefahren.
 

Error: (03/03/2014 10:13:53 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/03/2014 10:13:51 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/02/2014 00:32:57 PM) (Source: Microsoft-Windows-WHEA-Logger) (User: NT-AUTORITÄT)

Description: Schwerwiegender Hardwarefehler.
 

Komponente: AMD Northbridge

Fehlerquelle: 3

Fehlertyp: 25

Prozessor-ID: 0
 

Die Detailansicht dieses Eintrags beinhaltet weitere Informationen.
 

Error: (03/02/2014 00:32:32 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/02/2014 00:32:28 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 
 

Microsoft Office Sessions:

=========================

Error: (03/03/2014 10:26:55 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/03/2014 10:13:24 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/02/2014 00:31:58 PM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/02/2014 11:46:56 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/02/2014 01:29:41 AM) (Source: Application Hang)(User: )

Description: Explorer.EXE6.1.7601.1756793c01cf35ade5703805453C:\Windows\Explorer.EXEbafd13f6-a1a1-11e3-bdd7-3085a94266a8
 

Error: (03/02/2014 01:25:21 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/02/2014 01:20:53 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/01/2014 06:31:09 PM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/01/2014 06:25:46 PM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (02/28/2014 08:12:29 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-03-03 10:27:37.126

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 10:27:36.985

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 10:27:31.151

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 10:27:31.026

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 10:13:53.442

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 10:13:53.255

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 10:13:51.321

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 10:13:51.196

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-02 12:32:32.767

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-02 12:32:32.611

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 28%

Total physical RAM: 8174.12 MB

Available physical RAM: 5814.34 MB

Total Pagefile: 16346.41 MB

Available Pagefile: 13627.73 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:245.92 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 85EAEEE9)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

sunjojo

03.03.2014 16:41

Hi,

das gucken wir uns mal genauer an :).

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

Task: {04316C8C-AAE9-4C0D-8A03-B85F7B769C08} - \PC Health Advisor Defrag No Task File

Task: {35C6FCEA-3FEE-4B6E-8BC6-983499CA4E4E} - \ParetoLogic Update Version3 No Task File

Task: {3AD8A18D-8622-47E6-A995-18047D8EF1D0} - \ParetoLogic Registration3 No Task File

Task: {43AF4D92-3759-4F3B-9F90-EFBFD6FC21D7} - \PC Health Advisor No Task File

Task: {46983AB9-9DB0-4B15-9866-70EB3D8ED964} - \Digital Sites No Task File

Task: {85F44FDF-4E73-4F08-858C-DC3F9505CFEB} - \DSite No Task File

Task: {8EDF384F-376F-4AB7-BA38-D81A4DAC2105} - \DealPly No Task File

Task: {B2D48DE0-F4A7-42F9-816C-1AC56B1A8872} - \DealPlyUpdate No Task File

Task: {B5285F3B-D7AF-45AE-9F2E-1BB7DBCFE22C} - \EPUpdater No Task File

Task: {78BBB10A-F364-4E92-8219-8439ED42836E} - System32\Tasks\PileFile reminder => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION

Task: {ADB9BBC4-A3DA-49FF-A644-3E893812D24D} - System32\Tasks\PileFile logon => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION

C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe

Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\cefbaeacdccceasacfsfdsf" /f

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Ok, bitte packe folgende Datei (z.B. mit 7-Zip):

Code:

C:\Windows\Minidump\030214-23290-01.dmp

und hänge sie als *.zip Datei als Anhang an. Dann kann ich mir genauer angucken, warum dein Rechner sich häufiger ausschaltet.

Redblood

03.03.2014 19:32

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-03-2014

Ran by Pc at 2014-03-03 19:29:50 Run:4

Running from C:\Users\Pc\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

Task: {04316C8C-AAE9-4C0D-8A03-B85F7B769C08} - \PC Health Advisor Defrag No Task File

Task: {35C6FCEA-3FEE-4B6E-8BC6-983499CA4E4E} - \ParetoLogic Update Version3 No Task File

Task: {3AD8A18D-8622-47E6-A995-18047D8EF1D0} - \ParetoLogic Registration3 No Task File

Task: {43AF4D92-3759-4F3B-9F90-EFBFD6FC21D7} - \PC Health Advisor No Task File

Task: {46983AB9-9DB0-4B15-9866-70EB3D8ED964} - \Digital Sites No Task File

Task: {85F44FDF-4E73-4F08-858C-DC3F9505CFEB} - \DSite No Task File

Task: {8EDF384F-376F-4AB7-BA38-D81A4DAC2105} - \DealPly No Task File

Task: {B2D48DE0-F4A7-42F9-816C-1AC56B1A8872} - \DealPlyUpdate No Task File

Task: {B5285F3B-D7AF-45AE-9F2E-1BB7DBCFE22C} - \EPUpdater No Task File

Task: {78BBB10A-F364-4E92-8219-8439ED42836E} - System32\Tasks\PileFile reminder => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION

Task: {ADB9BBC4-A3DA-49FF-A644-3E893812D24D} - System32\Tasks\PileFile logon => C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe <==== ATTENTION

C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe

Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\cefbaeacdccceasacfsfdsf" /f

*****************
 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04316C8C-AAE9-4C0D-8A03-B85F7B769C08} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04316C8C-AAE9-4C0D-8A03-B85F7B769C08} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Health Advisor Defrag => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{35C6FCEA-3FEE-4B6E-8BC6-983499CA4E4E} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{35C6FCEA-3FEE-4B6E-8BC6-983499CA4E4E} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ParetoLogic Update Version3 => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3AD8A18D-8622-47E6-A995-18047D8EF1D0} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3AD8A18D-8622-47E6-A995-18047D8EF1D0} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ParetoLogic Registration3 => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{43AF4D92-3759-4F3B-9F90-EFBFD6FC21D7} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{43AF4D92-3759-4F3B-9F90-EFBFD6FC21D7} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Health Advisor => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{46983AB9-9DB0-4B15-9866-70EB3D8ED964} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{46983AB9-9DB0-4B15-9866-70EB3D8ED964} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Digital Sites => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{85F44FDF-4E73-4F08-858C-DC3F9505CFEB} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{85F44FDF-4E73-4F08-858C-DC3F9505CFEB} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DSite => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8EDF384F-376F-4AB7-BA38-D81A4DAC2105} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8EDF384F-376F-4AB7-BA38-D81A4DAC2105} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPly => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B2D48DE0-F4A7-42F9-816C-1AC56B1A8872} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B2D48DE0-F4A7-42F9-816C-1AC56B1A8872} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B5285F3B-D7AF-45AE-9F2E-1BB7DBCFE22C} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B5285F3B-D7AF-45AE-9F2E-1BB7DBCFE22C} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EPUpdater => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{78BBB10A-F364-4E92-8219-8439ED42836E} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{78BBB10A-F364-4E92-8219-8439ED42836E} => Key deleted successfully.

C:\Windows\System32\Tasks\PileFile reminder => Moved successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PileFile reminder => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{ADB9BBC4-A3DA-49FF-A644-3E893812D24D} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADB9BBC4-A3DA-49FF-A644-3E893812D24D} => Key deleted successfully.

C:\Windows\System32\Tasks\PileFile logon => Moved successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PileFile logon => Key deleted successfully.

"C:\Users\Pc\AppData\Local\Temp\Rust ESP GOD SPAWN HackDownload_BE8D\Rust_ESP_GOD_SPAWN_Hack_Downloader.exe" => File/Directory not found.
 

========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\cefbaeacdccceasacfsfdsf" /f =========
 

FEHLER: Der angegebene Registrierungsschlüssel bzw. Wert wurde nicht gefunden.
 
 

========= End of Reg: =========
 
 

==== End of Fixlog ====

sunjojo

03.03.2014 21:46

Ok, also laut dem Minidump, stimmt etwas mit der Harware nicht. Bitte beantworte die folgenden Fragen:

Sind alle Treiber aktuell?
Hast du Änderungen am System vorgenommen, bevor die Systemabstürze losgingen (Treiberupdates, BIOS Einstellungen, ...)?
Hattest du schonmal Probleme mit deiner Hardware?

Zitat:

Error: (03/02/2014 00:32:57 PM) (Source: Microsoft-Windows-WHEA-Logger) (User: NT-AUTORITÄT)
Description: Schwerwiegender Hardwarefehler.

Komponente: AMD Northbridge
Fehlerquelle: 3
Fehlertyp: 25
Prozessor-ID: 0

Damit ich mir noch genauer die Fehlermeldungen ansehen kann, führe bitte folgenden Schritt aus:
Schritt 1
Downloade dir bitte Farbar's MiniToolBox auf deinen Desktop und starte das Tool

Setze einen Haken bei folgenden Einträgen

List last 10 Event Viewer log
List Users, Partitions and Memory size
List Minidump Files

Klicke Go und poste den Inhalt der Result.txt.

Redblood

04.03.2014 13:35

Eigentlich habe ich nichts weiter verändert. Die Probleme fingen bisschen später nach unserem Reinigungsvorgang an. Meine Treiber müssten aktuell sein, aber ich bin mir nicht sicher.

Code:

MiniToolBox by Farbar  Version: 23-01-2014

Ran by Pc (administrator) on 04-03-2014 at 13:32:45

Running from "C:\Users\Pc\Desktop"

Microsoft Windows 7 Enterprise  Service Pack 1 (X64)

Boot Mode: Normal

***************************************************************************
 

========================= Event log errors: ===============================
 

Application errors:

==================

Error: (03/04/2014 00:55:57 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (03/04/2014 11:11:16 AM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: League of Legends.exe, Version: 4.3.0.487, Zeitstempel: 0x530c09d0

Name des fehlerhaften Moduls: League of Legends.exe, Version: 4.3.0.487, Zeitstempel: 0x530c09d0

Ausnahmecode: 0xc0000005

Fehleroffset: 0x005c7fd0

ID des fehlerhaften Prozesses: 0x138c

Startzeit der fehlerhaften Anwendung: 0xLeague of Legends.exe0

Pfad der fehlerhaften Anwendung: League of Legends.exe1

Pfad des fehlerhaften Moduls: League of Legends.exe2

Berichtskennung: League of Legends.exe3
 

Error: (03/04/2014 10:27:01 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/04/2014 10:16:39 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/03/2014 07:49:17 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: LolClient.exe, Version: 0.0.0.0, Zeitstempel: 0x515663e0

Name des fehlerhaften Moduls: Adobe AIR.dll, Version: 3.7.0.1530, Zeitstempel: 0x5156646c

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0006dd76

ID des fehlerhaften Prozesses: 0x10bc

Startzeit der fehlerhaften Anwendung: 0xLolClient.exe0

Pfad der fehlerhaften Anwendung: LolClient.exe1

Pfad des fehlerhaften Moduls: LolClient.exe2

Berichtskennung: LolClient.exe3
 

Error: (03/03/2014 07:20:31 PM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/03/2014 07:10:34 PM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/03/2014 02:16:16 PM) (Source: Application Hang) (User: )

Description: Programm eu4.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 9c4
 

Startzeit: 01cf36e29d772a73
 

Endzeit: 44
 

Anwendungspfad: C:\Program Files (x86)\Europa Universalis IV\eu4.exe
 

Berichts-ID: fcb24973-a2d5-11e3-91fd-3085a94266a8
 

Error: (03/03/2014 10:26:55 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 

Error: (03/03/2014 10:13:24 AM) (Source: Winlogon) (User: )

Description: Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
 
 

System errors:

=============

Error: (03/04/2014 10:28:31 AM) (Source: Microsoft-Windows-WHEA-Logger) (User: NT-AUTORITÄT)

Description: Schwerwiegender Hardwarefehler.
 

Gemeldet von Komponente: Prozessorkern

Fehlerquelle: 3

Fehlertyp: 10

Prozessor-ID: 2
 

Die Detailansicht dieses Eintrags beinhaltet weitere Informationen.
 

Error: (03/04/2014 10:28:31 AM) (Source: Microsoft-Windows-WHEA-Logger) (User: NT-AUTORITÄT)

Description: Schwerwiegender Hardwarefehler.
 

Komponente: AMD Northbridge

Fehlerquelle: 3

Fehlertyp: 25

Prozessor-ID: 0
 

Die Detailansicht dieses Eintrags beinhaltet weitere Informationen.
 

Error: (03/04/2014 10:27:51 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/04/2014 10:27:47 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/04/2014 10:26:55 AM) (Source: BugCheck) (User: )

Description: 0x00000124 (0x0000000000000000, 0xfffffa80083ba548, 0x0000000000000000, 0x0000000000000000)C:\Windows\Minidump\030414-21871-01.dmp030414-21871-01
 

Error: (03/04/2014 10:26:54 AM) (Source: EventLog) (User: )

Description: Das System wurde zuvor am ?04.?03.?2014 um 10:25:33 unerwartet heruntergefahren.
 

Error: (03/04/2014 10:17:31 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/04/2014 10:17:28 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/03/2014 07:21:19 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 

Error: (03/03/2014 07:21:13 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%577
 
 

Microsoft Office Sessions:

=========================

Error: (03/04/2014 00:55:57 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
 

Error: (03/04/2014 11:11:16 AM) (Source: Application Error)(User: )

Description: League of Legends.exe4.3.0.487530c09d0League of Legends.exe4.3.0.487530c09d0c0000005005c7fd0138c01cf378c6551b96cC:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.12\deploy\League of Legends.exeC:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.12\deploy\League of Legends.exe52695b17-a385-11e3-b75d-3085a94266a8
 

Error: (03/04/2014 10:27:01 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/04/2014 10:16:39 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/03/2014 07:49:17 PM) (Source: Application Error)(User: )

Description: LolClient.exe0.0.0.0515663e0Adobe AIR.dll3.7.0.15305156646cc00000050006dd7610bc01cf370f95fcebefC:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.74\deploy\LolClient.exeC:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.74\deploy\Adobe AIR\Versions\1.0\Adobe AIR.dll8522f714-a304-11e3-b17b-3085a94266a8
 

Error: (03/03/2014 07:20:31 PM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/03/2014 07:10:34 PM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/03/2014 02:16:16 PM) (Source: Application Hang)(User: )

Description: eu4.exe1.0.0.09c401cf36e29d772a7344C:\Program Files (x86)\Europa Universalis IV\eu4.exefcb24973-a2d5-11e3-91fd-3085a94266a8
 

Error: (03/03/2014 10:26:55 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 

Error: (03/03/2014 10:13:24 AM) (Source: Winlogon)(User: )

Description: 0x800700050x00000000
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-03-04 10:27:51.860

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-04 10:27:51.735

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-04 10:27:47.679

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-04 10:27:47.570

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-04 10:17:31.356

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-04 10:17:31.216

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-04 10:17:28.314

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-04 10:17:28.205

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 19:21:19.287

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-03-03 19:21:19.162

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

========================= Memory info: ===================================
 

Percentage of memory in use: 33%

Total physical RAM: 8174.12 MB

Available physical RAM: 5416.98 MB

Total Pagefile: 16346.41 MB

Available Pagefile: 12972.61 MB

Total Virtual: 4095.88 MB

Available Virtual: 3959.81 MB
 

========================= Partitions: =====================================
 

1 Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:243.87 GB) NTFS
 

========================= Users: ========================================
 

Benutzerkonten fr \\PC-PC
 

Administrator            ASPNET                   Gast                     

Pc                       

Der Befehl wurde erfolgreich ausgefhrt.
 

========================= Minidump Files ==================================
 

No minidump file found
 
 

**** End of log ****

sunjojo

04.03.2014 21:58

Zitat:

Eigentlich habe ich nichts weiter verändert

Dem entnehme ich mal, dass du keine Systemänderungen vorgenommen hast, die solche Fehler theoretisch verursachen könnten.

Führe trotzdem mal einen Test des Arbeitsspeichers durch, zum Beispiel nach folgender Anleitung: Arbeitsspeicher auf Fehler überprüfen mit Memtest / Memtest86 (wenn du Fragen hast, ruhig fragen :)).

Wie läuft denn dein Rechner generell, eher langsam oder normal/unauffällig?

Redblood

06.03.2014 18:17

Also ich habe den Test durchgeführt (Ich war während des Tests nicht vor dem Pc). Als ich wiederkam, war der Pc gestartet ( also auf dem Desktop), aber es kam keine Meldung, ob der etwas gefunden wurde oder nicht. Gibt es irgendwo ein Log oder so?

Zu deiner Frage. Mein Pc läuft auf jeden Fall schneller als früher (großes Dankeschön nochmal) und verhält sich unauffälig, außer den Abstürzen natürlich. Kann man da irgendwas machen?

Lg Omid

sunjojo

07.03.2014 17:54

Zitat:

Ich glaube, bei keinem Tool wird direkt ein Logfile gespeichert. Wenn du memtest86+ verwendet hast, werden dir die Fehler beim scannen gleich gezeigt (sofern vorhanden), bei dem windowseigenen Test erscheint nach dem Start kurz ein kleines Fenster (evtl. nochmal ausführen, damit wir sicher gehen können, dass nicht wirklich ein Hardwarefehler vorliegt). Ich hab nochmal ein bisschen bei den Kollegen rumgefragt und keinem ist so ein Fall bekannt. Die Bereinigung wurde damals auch noch von einem Mitglied des Kompetenzteams beaufsichtigt. Wir gucken aber natürlich weiter :).

Zitat:

Meine Treiber müssten aktuell sein, aber ich bin mir nicht sicher.

Kontrolliere das nochmal bitte, achte dabei besonders auf deine BIOS Version und den Chipsatz Treiber (ggf. updaten).

Code:

Error: (03/04/2014 10:28:31 AM) (Source: Microsoft-Windows-WHEA-Logger) (User: NT-AUTORITÄT)

Description: Schwerwiegender Hardwarefehler.
 

Komponente: AMD Northbridge

Fehlerquelle: 3

Fehlertyp: 25

Prozessor-ID: 0
 

Die Detailansicht dieses Eintrags beinhaltet weitere Informationen.

Gehe bitte auf Start und gibt in der Suchleiste "Ereignisanzeige" ein. Es sollte sich ein Fenster öffnen, gehe dort auf "Windows Protokolle" -> "System" und such den neusten "Schweriegenden Hardwarefehler" heraus. Klicke das Ereignis an, gehe auf Details und poste mir diese.

Redblood

07.03.2014 19:11

Ich werde den Test später wiederholen.
Es gab "Fehler" "Kritisch" und "Warnung" in der Liste.

Neueste "Fehler" Meldung:

Code:

Protokollname: System

Quelle:        Service Control Manager

Datum:         07.03.2014 09:50:01

Ereignis-ID:   7000

Aufgabenkategorie:Keine

Ebene:         Fehler

Schlüsselwörter:Klassisch

Benutzer:      Nicht zutreffend

Computer:      Pc-PC

Beschreibung:

Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

Die digitale Signatur dieser Datei kann nicht überprüft werden. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um böswillige Software aus einer unbekannten Quelle handelt, installiert.

Ereignis-XML:

<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

    <EventID Qualifiers="49152">7000</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2014-03-07T08:50:01.318916900Z" />

    <EventRecordID>205179</EventRecordID>

    <Correlation />

    <Execution ProcessID="700" ThreadID="704" />

    <Channel>System</Channel>

    <Computer>Pc-PC</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="param1">lirsgt</Data>

    <Data Name="param2">%%577</Data>

  </EventData>

</Event>

Dann habe noch eine "Fehler" Meldung gefunden die sagt: Schwerwiegender Hardware Fehler

Code:

Protokollname: System

Quelle:        Microsoft-Windows-WHEA-Logger

Datum:         06.03.2014 18:11:58

Ereignis-ID:   18

Aufgabenkategorie:Keine

Ebene:         Fehler

Schlüsselwörter:

Benutzer:      LOKALER DIENST

Computer:      Pc-PC

Beschreibung:

Schwerwiegender Hardwarefehler.
 

Gemeldet von Komponente: Prozessorkern

Fehlerquelle: Ausnahme bei der Computerüberprüfung

Fehlertyp: Bus-/Verbindungsfehler

Prozessor-ID: 2
 

Die Detailansicht dieses Eintrags beinhaltet weitere Informationen.

Ereignis-XML:

<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-WHEA-Logger" Guid="{C26C4F3C-3F66-4E99-8F8A-39405CFED220}" />

    <EventID>18</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8000000000000000</Keywords>

    <TimeCreated SystemTime="2014-03-06T17:11:58.654634100Z" />

    <EventRecordID>205012</EventRecordID>

    <Correlation ActivityID="{420DDAB4-DCA5-4CC6-B96A-1E4C654BAB93}" />

    <Execution ProcessID="1976" ThreadID="4660" />

    <Channel>System</Channel>

    <Computer>Pc-PC</Computer>

    <Security UserID="S-1-5-19" />

  </System>

  <EventData>

    <Data Name="ErrorSource">3</Data>

    <Data Name="ApicId">2</Data>

    <Data Name="MCABank">5</Data>

    <Data Name="MciStat">0xb480000000020e0f</Data>

    <Data Name="MciAddr">0x27</Data>

    <Data Name="MciMisc">0x0</Data>

    <Data Name="ErrorType">10</Data>

    <Data Name="TransactionType">256</Data>

    <Data Name="Participation">3</Data>

    <Data Name="RequestType">0</Data>

    <Data Name="MemorIO">3</Data>

    <Data Name="MemHierarchyLvl">3</Data>

    <Data Name="Timeout">0</Data>

    <Data Name="OperationType">256</Data>

    <Data Name="Channel">256</Data>

    <Data Name="Length">928</Data>

    <Data Name="RawData">435045521002FFFFFFFF03000100000002000000A00300003709110006030E140000000000000000000000000000000000000000000000000000000000000000BDC407CF89B7184EB3C41F732CB57131FE6FF5E89C91C54CBA8865ABE14913BB0D2593DE5E39CF0102000000000000000000000000000000000000000000000058010000C00000000102000001000000ADCC7698B447DB4BB65E16F193C4F3DB0000000000000000000000000000000001000000000000000000000000000000000000000000000018020000800000000102000000000000B0A03EDC44A19747B95B53FA242B6E1D0000000000000000000000000000000001000000000000000000000000000000000000000000000098020000080100000102000000000000011D1E8AF94257459C33565E5CC3F7E8000000000000000000000000000000000100000000000000000000000000000000000000000000007F010000000000000002040000030000120F60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000007000000000000000200000000000000120F6000000806020B22981EFFFB8B170000000000000000000000000000000000000000000000000000000000000000B3F8F31CB1C5A249AA595EEF92FFA63C03000000000000009E07C0C4060000002700000000000000000000000000000000000000000000000000000000000000010000000200000058B59AE55E39CF010200000000000000000000000000000000000000050000000F0E0200000080B4270000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Data>

  </EventData>

</Event>

Neueste "Kritisch" Meldung:

Code:

Protokollname: System

Quelle:        Microsoft-Windows-Kernel-Power

Datum:         06.03.2014 18:09:56

Ereignis-ID:   41

Aufgabenkategorie:(63)

Ebene:         Kritisch

Schlüsselwörter:(2)

Benutzer:      SYSTEM

Computer:      Pc-PC

Beschreibung:

Das System wurde neu gestartet, ohne dass es zuvor ordnungsgemäß heruntergefahren wurde. Dieser Fehler kann auftreten, wenn das System nicht mehr reagiert hat oder abgestürzt ist oder die Stromzufuhr unerwartet unterbrochen wurde.

Ereignis-XML:

<Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />

    <EventID>41</EventID>

    <Version>2</Version>

    <Level>1</Level>

    <Task>63</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8000000000000002</Keywords>

    <TimeCreated SystemTime="2014-03-06T17:09:56.370022400Z" />

    <EventRecordID>204912</EventRecordID>

    <Correlation />

    <Execution ProcessID="4" ThreadID="8" />

    <Channel>System</Channel>

    <Computer>Pc-PC</Computer>

    <Security UserID="S-1-5-18" />

  </System>

  <EventData>

    <Data Name="BugcheckCode">0</Data>

    <Data Name="BugcheckParameter1">0x0</Data>

    <Data Name="BugcheckParameter2">0x0</Data>

    <Data Name="BugcheckParameter3">0x0</Data>

    <Data Name="BugcheckParameter4">0x0</Data>

    <Data Name="SleepInProgress">false</Data>

    <Data Name="PowerButtonTimestamp">0</Data>

  </EventData>

</Event>

sunjojo

08.03.2014 11:50

Zitat:

Ich werde den Test später wiederholen.

Alles klar. Ich warte erstmal auf den Test.

Zitat:

Dann habe noch eine "Fehler" Meldung gefunden die sagt: Schwerwiegender Hardware Fehler

Jop, das war der richtige Eintrag :).

Zitat:

Kontrolliere das nochmal bitte, achte dabei besonders auf deine BIOS Version und den Chipsatz Treiber (ggf. updaten).

Das hast du gelesen?

Kannst du mal genauer die Hardwarekomponenten deines Rechners aufzählen? Überprüfe außerdem dein Netzteil, kannst du vll. zum Test ein anderes Netzteil nehmen und gucken, ob die Abstürze noch auftreten?

sunjojo

13.03.2014 15:42

Hi,

ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe?

Hinweis: Wir sind noch nicht fertig! Auch wenn die Symptome verschwunden sein sollten, kann dein System weiterhin infiziert sein und über Sicherheitslücken verfügen, welche eine erneute Infektion ermöglichen.

sunjojo

16.03.2014 14:37

Fehlende Rückmeldung

Dieses Thema wurde aus meinen Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. Falls du weitermachen willst, schicke mir bitte eine private Nachricht.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte folgendes lesen: http://www.trojaner-board.de/69886-a...-beachten.html und einen eigenen Thread erstellen.

Redblood

21.03.2014 16:46

Ich konnte wegen Internet Problemen bisher nicht antworten.

Ich bin mir sicher, das alle Treiber aktuell sind.
Laut dem Test gab es keine Probleme mit dem Arbeitsspeicher.
Meine Komponnenten:

Graphikkarte: AMD Radeon HD 6680
Prozesssor: Fx-6100 3.30 GHz
Betriebssystem: Windows 7 Enterprise 64 Bit

Reicht das, oder brauchst du nochmehr Information?

sunjojo

22.03.2014 11:43

Zitat:

Ich konnte wegen Internet Problemen bisher nicht antworten.

Tritt das Problem noch genauso häufig auf?

Zitat:

Ich bin mir sicher, das alle Treiber aktuell sind.
Laut dem Test gab es keine Probleme mit dem Arbeitsspeicher.

Alles klar.

Zitat:

Reicht das, oder brauchst du nochmehr Information?

Kannst du mal genauer die Hardwarekomponenten deines Rechners aufzählen? Überprüfe außerdem dein Netzteil, kannst du vll. zum Test ein anderes Netzteil nehmen und gucken, ob die Abstürze noch auftreten?

Und ich hätte noch gerne ein frisches FRST Logfile :).

Redblood

24.03.2014 14:16

Ja sie treten weiterhin auf. Nicht häufig, sondern immer. Es gibt ein bestimmtes System.

1. Ich mach den Pc an
2.Nach 10-15 Min stürtzt er plötzlich ab und startet neu
3. Nach dem Neustart, gibt es keinen Absturz mehr.

Hardware:
Motherboard: ASUS M5A78L-M LE
Prozessor: AMD Bulldozer Fx 6100 6x3.6 GHz
System: Windows 7 Enterprise 64 bit
Arbeitsspeicher: 8192 MB DDR3 Pc-1333 MEMSeven
Festplatte: 1000GB SATA II Value
Laufwerk: 22x Dual Layer DVD +/- R/RW DVD Brenner
Grafikkarte: ATI RADEON HD 6870 1024MB DDR5 Speicher
Keine Ahnung...: PC-Case 22
Netzteil: 600W 12 cm LC-Power Silent-Deluxe ATX Marken Netzteil
Lüfter: Silent

Ich habe zurzeit kein anderes Netzteil rumliegen. Ich glaube aber nicht, das es am Netzteil liegt. Das Problem ähnelt mehr einem Virus, da es sehr systematisch ist.

FRST:
FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014

Ran by Pc (administrator) on PC-PC on 24-03-2014 14:16:01

Running from C:\Users\Pc\Desktop

Windows 7 Enterprise Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Spotify Ltd) C:\Users\Pc\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD64.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe

(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe

(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe

(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [Cpu Level Up help] - C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()

HKLM-x32\...\Run: [Turbo Key] - C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0

HKLM\...\Policies\Explorer: [HideSCAHealth] 0

HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0

HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionMDEngine] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraMD.exe [569344 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-07] (AMD)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Spotify Web Helper] - C:\Users\Pc\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-23] (Spotify Ltd)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Run: [Raptr] - C:\Program Files (x86)\Raptr\raptrstub.exe [55360 2014-02-18] (Raptr, Inc)

HKU\S-1-5-21-3424378060-3098743664-1317459497-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEA5B1E2628BDCD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 - C:\Users\Pc\AppData\LocalLow\Sony Online Entertainment\npsoe.dll ()

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\searchplugins\ividi.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Adblock Plus - C:\Users\Pc\AppData\Roaming\Mozilla\Firefox\Profiles\hxtwke4k.default-1377615578566\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-03]
 

==================== Services (Whitelisted) =================
 

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [910416 2014-03-04] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-16] (CyberGhost S.R.L)

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4521720 2012-09-26] (INCA Internet Co., Ltd.)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-01-24] ()

S4 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [745368 2012-11-26] (Tunngle.net GmbH)

S3 ArcService; C:\Users\Pc\Desktop\ArcService.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-05-13] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-04-14] (AVG Technologies)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)

S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-30] (Disc Soft Ltd)

R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-08] (Guillemot Corporation)

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-05-13] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

S3 RT73; C:\Windows\System32\DRIVERS\Dr71WU.sys [610816 2008-01-16] (Ralink Technology, Corp.)

S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))

R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77432 2009-02-03] (Protection Technology (StarForce))

R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [79800 2012-06-19] (Protection Technology (StarForce))

R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3552384 2009-04-22] ()

S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

S3 X6va016; \??\C:\Windows\SysWOW64\Drivers\X6va016 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-03-24 14:16 - 2014-03-24 14:16 - 00015568 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-03-24 14:02 - 2014-03-24 14:02 - 00001114 _____ () C:\Users\Pc\Desktop\EVEREST Home Edition.lnk

2014-03-24 14:02 - 2014-03-24 14:02 - 00000000 ____D () C:\Program Files (x86)\Lavalys

2014-03-24 14:01 - 2014-03-24 14:01 - 04179293 _____ (Lavalys, Inc. ) C:\Users\Pc\Downloads\everesthome220.exe

2014-03-24 13:48 - 2014-03-24 13:48 - 00262144 ____N () C:\Windows\Minidump\032414-23680-01.dmp

2014-03-24 13:37 - 2014-03-24 13:38 - 00275704 _____ () C:\Windows\Minidump\032414-32229-01.dmp

2014-03-23 19:09 - 2014-03-23 19:09 - 00007334 _____ () C:\Users\Pc\Desktop\OpenDocument Text (neu).odt

2014-03-23 14:34 - 2014-03-23 14:34 - 00262144 ____N () C:\Windows\Minidump\032314-46753-01.dmp

2014-03-22 18:14 - 2014-03-22 18:14 - 00275704 _____ () C:\Windows\Minidump\032214-30186-01.dmp

2014-03-21 21:41 - 2014-03-21 21:41 - 00275704 _____ () C:\Windows\Minidump\032114-44023-01.dmp

2014-03-20 15:20 - 2014-03-20 15:20 - 00262144 ____N () C:\Windows\Minidump\032014-29016-01.dmp

2014-03-19 19:08 - 2014-03-19 19:08 - 00262144 ____N () C:\Windows\Minidump\031914-31184-01.dmp

2014-03-18 13:25 - 2014-03-18 13:25 - 00262144 ____N () C:\Windows\Minidump\031814-26223-01.dmp

2014-03-16 16:22 - 2014-03-16 16:22 - 00275704 _____ () C:\Windows\Minidump\031614-32744-01.dmp

2014-03-15 11:31 - 2014-03-15 11:41 - 325970352 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\X16-32698.exe

2014-03-15 10:46 - 2014-03-15 10:46 - 00262144 ____N () C:\Windows\Minidump\031514-30123-01.dmp

2014-03-15 10:42 - 2014-03-15 10:42 - 00299280 _____ (Appsinstaller) C:\Users\Pc\Downloads\Microsoft%20PowerPoint.exe

2014-03-14 17:20 - 2014-03-14 17:20 - 00262144 ____N () C:\Windows\Minidump\031414-34304-01.dmp

2014-03-13 12:26 - 2014-03-13 12:26 - 00262144 ____N () C:\Windows\Minidump\031314-64740-01.dmp

2014-03-12 11:37 - 2014-03-12 11:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FlorensiaEN

2014-03-12 11:33 - 2014-03-12 11:37 - 00000000 ____D () C:\AHA Entertainment

2014-03-12 11:05 - 2014-03-12 11:05 - 01173504 _____ (ProSiebenSat.1 Games) C:\Users\Pc\Downloads\florensia-dlm.exe

2014-03-12 11:05 - 2014-03-12 11:05 - 00000000 ____D () C:\ProgramData\Solid State Networks

2014-03-12 10:16 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-03-12 10:16 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-03-12 10:16 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-03-12 10:16 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-03-12 10:16 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-03-12 10:16 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-03-12 10:16 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-03-12 10:16 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-03-12 10:16 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-03-12 10:16 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-03-12 10:16 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-03-12 10:16 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-03-12 10:16 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-03-12 10:16 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-03-12 10:16 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-03-12 10:16 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-03-12 10:16 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-03-12 10:16 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-03-12 10:16 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-03-12 10:16 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-03-12 10:16 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-03-12 10:16 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-03-12 10:16 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-03-12 10:16 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-03-12 10:16 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-03-12 10:16 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-03-12 10:16 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-03-12 10:16 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-03-12 10:16 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-03-12 10:16 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-03-12 10:16 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-03-12 10:16 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-03-12 10:16 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-03-12 10:16 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-03-12 10:16 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-03-12 10:16 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-03-12 10:16 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-03-12 10:16 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-03-12 10:16 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-03-12 10:16 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-03-12 10:16 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-03-12 10:16 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll

2014-03-12 10:16 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll

2014-03-12 10:16 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2014-03-12 10:15 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-03-12 10:15 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-03-12 10:15 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2014-03-12 10:15 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-03-12 10:03 - 2014-03-12 10:03 - 00275704 _____ () C:\Windows\Minidump\031214-35911-01.dmp

2014-03-11 14:02 - 2014-03-11 14:02 - 00262144 ____N () C:\Windows\Minidump\031114-34679-01.dmp

2014-03-11 12:03 - 2014-03-11 12:03 - 00262144 ____N () C:\Windows\Minidump\031114-32744-01.dmp

2014-03-10 10:27 - 2014-03-10 10:28 - 00275704 _____ () C:\Windows\Minidump\031014-32370-01.dmp

2014-03-09 22:35 - 2014-03-09 22:35 - 00001152 _____ () C:\Users\Public\Desktop\WavePad Audio-Editor.lnk

2014-03-09 22:34 - 2014-03-16 22:35 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software

2014-03-09 22:34 - 2014-03-09 22:34 - 00001168 _____ () C:\Users\Public\Desktop\VideoPad Video-Editor.lnk

2014-03-09 22:34 - 2014-03-09 22:34 - 00001140 _____ () C:\Users\Public\Desktop\Prism Videodatei-Konverter.lnk

2014-03-09 22:34 - 2014-03-09 22:34 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Videoverwandte Programme

2014-03-09 22:34 - 2014-03-09 22:34 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Produktpalette

2014-03-09 22:32 - 2014-03-16 22:34 - 00000000 ____D () C:\ProgramData\NCH Software

2014-03-09 22:31 - 2014-03-16 22:35 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\NCH Software

2014-03-09 22:31 - 2014-03-09 22:35 - 00000000 ____D () C:\Program Files (x86)\NCH Software

2014-03-09 22:31 - 2014-03-09 22:31 - 00001126 _____ () C:\Users\Public\Desktop\Debut Videorekorder.lnk

2014-03-09 22:30 - 2014-03-09 22:31 - 01579032 _____ (NCH Software) C:\Users\Pc\Downloads\debutpsetup.exe

2014-03-09 22:25 - 2014-03-09 22:25 - 00275704 _____ () C:\Windows\Minidump\030914-24070-01.dmp

2014-03-09 16:24 - 2014-03-09 16:24 - 00262144 ____N () C:\Windows\Minidump\030914-26629-01.dmp

2014-03-09 11:22 - 2014-03-09 11:22 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved

2014-03-09 11:22 - 2014-03-09 11:22 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\library_dir

2014-03-09 11:21 - 2014-03-24 13:49 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Raptr

2014-03-09 11:20 - 2014-03-09 11:22 - 00000000 ____D () C:\Program Files (x86)\Raptr

2014-03-09 11:20 - 2014-03-09 11:20 - 01007930 _____ () C:\Users\Pc\Downloads\amddriverdownload_installer.exe

2014-03-08 14:45 - 2014-03-08 14:45 - 00275704 _____ () C:\Windows\Minidump\030814-21247-01.dmp

2014-03-06 19:46 - 2014-03-06 19:46 - 00002115 _____ () C:\Users\Pc\Desktop\Mount&Blade Dedicated Server [by iMortaluz].lnk

2014-03-06 19:44 - 2014-03-06 19:44 - 170117744 _____ () C:\Users\Pc\Downloads\Warband_Napoleonic_Wars_v1.158+v1.104_UPDATE+CRACKS_by_iMortaluz_v2.exe

2014-03-06 18:10 - 2014-03-06 18:10 - 00262144 ____N () C:\Windows\Minidump\030614-21871-01.dmp

2014-03-05 22:00 - 2014-03-05 22:00 - 00262144 ____N () C:\Windows\Minidump\030514-31917-01.dmp

2014-03-05 21:36 - 2014-03-05 21:36 - 00262144 ____N () C:\Windows\Minidump\030514-27502-01.dmp

2014-03-05 12:21 - 2014-03-05 12:21 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-03-05 12:21 - 2014-03-05 12:21 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-03-04 16:23 - 2014-03-04 16:23 - 00262144 ____N () C:\Windows\Minidump\030414-24928-01.dmp

2014-03-04 13:32 - 2014-03-04 13:32 - 00013668 _____ () C:\Users\Pc\Desktop\Result.txt

2014-03-04 13:31 - 2014-03-04 13:31 - 00982016 _____ (Farbar) C:\Users\Pc\Desktop\MiniToolBox.exe

2014-03-04 10:26 - 2014-03-04 10:26 - 00262144 ____N () C:\Windows\Minidump\030414-21871-01.dmp

2014-03-03 19:32 - 2014-03-03 19:32 - 00010522 _____ () C:\Users\Pc\Downloads\030214-23290-01.rar

2014-03-03 19:31 - 2014-03-02 12:31 - 00262144 _____ () C:\Users\Pc\Desktop\030214-23290-01.dmp

2014-03-03 19:20 - 2014-03-03 19:20 - 00275704 _____ () C:\Windows\Minidump\030314-27705-01.dmp

2014-03-02 12:31 - 2014-03-02 12:31 - 00262144 ____N () C:\Windows\Minidump\030214-23290-01.dmp

2014-03-02 01:24 - 2014-03-02 01:24 - 00262144 ____N () C:\Windows\Minidump\030214-22011-01.dmp

2014-03-02 01:21 - 2014-03-02 01:35 - 00000000 ____D () C:\Users\Pc\Desktop\Anwalt

2014-02-28 15:26 - 2014-02-28 15:26 - 00262144 ____N () C:\Windows\Minidump\022814-26005-01.dmp

2014-02-28 10:18 - 2014-02-28 10:18 - 00262144 ____N () C:\Windows\Minidump\022814-23665-01.dmp

2014-02-28 08:46 - 2014-02-28 08:46 - 00275704 _____ () C:\Windows\Minidump\022814-34226-01.dmp

2014-02-27 18:14 - 2014-02-27 18:14 - 00275704 _____ () C:\Windows\Minidump\022714-24070-01.dmp

2014-02-25 23:18 - 2014-02-25 23:19 - 00275704 _____ () C:\Windows\Minidump\022514-25162-01.dmp

2014-02-25 19:45 - 2014-02-25 19:45 - 01956366 _____ () C:\Users\Pc\Downloads\EasyRootingToolkit_XPERIA-Z_SO-02E_v101-ENGLISH_tkymgr.zip

2014-02-25 19:42 - 2014-02-25 19:43 - 15305933 _____ () C:\Users\Pc\Downloads\Flashtool-drivers.exe

2014-02-25 19:38 - 2014-02-25 19:44 - 00015636 _____ () C:\Windows\DPINST.LOG

2014-02-25 14:20 - 2014-02-25 14:20 - 00275704 _____ () C:\Windows\Minidump\022514-24382-01.dmp

2014-02-22 14:04 - 2014-02-22 14:04 - 00262144 ____N () C:\Windows\Minidump\022214-20467-01.dmp
 

==================== One Month Modified Files and Folders =======
 

2014-03-24 14:16 - 2014-03-24 14:16 - 00015568 _____ () C:\Users\Pc\Desktop\FRST.txt

2014-03-24 14:16 - 2014-02-11 22:23 - 00000000 ____D () C:\FRST

2014-03-24 14:15 - 2014-02-13 21:35 - 00000000 ____D () C:\Users\Pc\Desktop\FRST-OlderVersion

2014-03-24 14:15 - 2014-02-11 22:22 - 02157056 _____ (Farbar) C:\Users\Pc\Desktop\FRST64.exe

2014-03-24 14:02 - 2014-03-24 14:02 - 00001114 _____ () C:\Users\Pc\Desktop\EVEREST Home Edition.lnk

2014-03-24 14:02 - 2014-03-24 14:02 - 00000000 ____D () C:\Program Files (x86)\Lavalys

2014-03-24 14:01 - 2014-03-24 14:01 - 04179293 _____ (Lavalys, Inc. ) C:\Users\Pc\Downloads\everesthome220.exe

2014-03-24 13:59 - 2013-10-05 14:34 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-03-24 13:49 - 2014-03-09 11:21 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Raptr

2014-03-24 13:49 - 2011-05-15 23:01 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-03-24 13:48 - 2014-03-24 13:48 - 00262144 ____N () C:\Windows\Minidump\032414-23680-01.dmp

2014-03-24 13:48 - 2014-02-12 21:00 - 00067872 _____ () C:\Windows\setupact.log

2014-03-24 13:48 - 2012-10-18 15:02 - 00000000 ____D () C:\Windows\Minidump

2014-03-24 13:48 - 2012-10-18 00:39 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-03-24 13:48 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-03-24 13:43 - 2011-05-10 01:27 - 01818454 _____ () C:\Windows\WindowsUpdate.log

2014-03-24 13:38 - 2014-03-24 13:37 - 00275704 _____ () C:\Windows\Minidump\032414-32229-01.dmp

2014-03-24 13:37 - 2014-02-21 10:01 - 723740025 _____ () C:\Windows\MEMORY.DMP

2014-03-23 21:46 - 2014-02-19 18:25 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Skype

2014-03-23 21:27 - 2012-10-18 00:39 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-03-23 19:09 - 2014-03-23 19:09 - 00007334 _____ () C:\Users\Pc\Desktop\OpenDocument Text (neu).odt

2014-03-23 19:04 - 2012-10-20 20:58 - 00000000 ____D () C:\Users\Pc\AppData\Local\PMB Files

2014-03-23 19:04 - 2012-10-20 20:58 - 00000000 ____D () C:\ProgramData\PMB Files

2014-03-23 16:12 - 2012-10-26 14:14 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\TS3Client

2014-03-23 14:34 - 2014-03-23 14:34 - 00262144 ____N () C:\Windows\Minidump\032314-46753-01.dmp

2014-03-22 18:14 - 2014-03-22 18:14 - 00275704 _____ () C:\Windows\Minidump\032214-30186-01.dmp

2014-03-21 21:41 - 2014-03-21 21:41 - 00275704 _____ () C:\Windows\Minidump\032114-44023-01.dmp

2014-03-21 18:45 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-03-21 18:45 - 2009-07-14 05:45 - 00010784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-03-20 15:20 - 2014-03-20 15:20 - 00262144 ____N () C:\Windows\Minidump\032014-29016-01.dmp

2014-03-19 19:08 - 2014-03-19 19:08 - 00262144 ____N () C:\Windows\Minidump\031914-31184-01.dmp

2014-03-19 16:52 - 2012-10-20 13:46 - 00000000 ____D () C:\Users\Pc\AppData\Local\CrashDumps

2014-03-19 15:32 - 2013-08-14 22:07 - 00000000 ____D () C:\Windows\system32\MRT

2014-03-19 15:30 - 2012-10-18 05:30 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-03-18 13:25 - 2014-03-18 13:25 - 00262144 ____N () C:\Windows\Minidump\031814-26223-01.dmp

2014-03-16 23:53 - 2013-02-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-03-16 22:35 - 2014-03-09 22:34 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software

2014-03-16 22:35 - 2014-03-09 22:31 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\NCH Software

2014-03-16 22:34 - 2014-03-09 22:32 - 00000000 ____D () C:\ProgramData\NCH Software

2014-03-16 21:32 - 2009-07-14 11:54 - 00710502 _____ () C:\Windows\system32\perfh007.dat

2014-03-16 21:32 - 2009-07-14 11:54 - 00154832 _____ () C:\Windows\system32\perfc007.dat

2014-03-16 21:32 - 2009-07-14 06:13 - 01651686 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-03-16 16:22 - 2014-03-16 16:22 - 00275704 _____ () C:\Windows\Minidump\031614-32744-01.dmp

2014-03-15 14:52 - 2013-12-27 22:18 - 00000000 ____D () C:\Users\Pc\AppData\Local\Deployment

2014-03-15 11:55 - 2013-12-28 11:49 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr

2014-03-15 11:55 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.exe

2014-03-15 11:54 - 2013-09-07 10:31 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\.minecraft

2014-03-15 11:41 - 2014-03-15 11:31 - 325970352 _____ (Microsoft Corporation) C:\Users\Pc\Downloads\X16-32698.exe

2014-03-15 10:46 - 2014-03-15 10:46 - 00262144 ____N () C:\Windows\Minidump\031514-30123-01.dmp

2014-03-15 10:42 - 2014-03-15 10:42 - 00299280 _____ (Appsinstaller) C:\Users\Pc\Downloads\Microsoft%20PowerPoint.exe

2014-03-14 17:20 - 2014-03-14 17:20 - 00262144 ____N () C:\Windows\Minidump\031414-34304-01.dmp

2014-03-14 11:21 - 2013-08-18 17:42 - 00291128 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0

2014-03-13 12:26 - 2014-03-13 12:26 - 00262144 ____N () C:\Windows\Minidump\031314-64740-01.dmp

2014-03-13 12:19 - 2009-07-14 05:45 - 00321600 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-03-13 12:17 - 2014-02-12 21:18 - 00112644 _____ () C:\Windows\PFRO.log

2014-03-13 12:17 - 2012-10-29 14:03 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-03-13 12:17 - 2012-10-29 14:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-03-12 18:59 - 2013-10-05 14:34 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-03-12 18:59 - 2012-12-10 18:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-03-12 18:59 - 2012-12-10 18:25 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-03-12 13:12 - 2013-02-05 20:06 - 00000000 ____D () C:\Users\Pc\Desktop\Spiele

2014-03-12 11:37 - 2014-03-12 11:37 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FlorensiaEN

2014-03-12 11:37 - 2014-03-12 11:33 - 00000000 ____D () C:\AHA Entertainment

2014-03-12 11:37 - 2014-03-12 11:05 - 00000000 ____D () C:\ProgramData\Solid State Networks

2014-03-12 11:05 - 2014-03-12 11:05 - 01173504 _____ (ProSiebenSat.1 Games) C:\Users\Pc\Downloads\florensia-dlm.exe

2014-03-12 10:03 - 2014-03-12 10:03 - 00275704 _____ () C:\Windows\Minidump\031214-35911-01.dmp

2014-03-11 14:02 - 2014-03-11 14:02 - 00262144 ____N () C:\Windows\Minidump\031114-34679-01.dmp

2014-03-11 12:03 - 2014-03-11 12:03 - 00262144 ____N () C:\Windows\Minidump\031114-32744-01.dmp

2014-03-10 10:28 - 2014-03-10 10:27 - 00275704 _____ () C:\Windows\Minidump\031014-32370-01.dmp

2014-03-09 22:35 - 2014-03-09 22:35 - 00001152 _____ () C:\Users\Public\Desktop\WavePad Audio-Editor.lnk

2014-03-09 22:35 - 2014-03-09 22:31 - 00000000 ____D () C:\Program Files (x86)\NCH Software

2014-03-09 22:34 - 2014-03-09 22:34 - 00001168 _____ () C:\Users\Public\Desktop\VideoPad Video-Editor.lnk

2014-03-09 22:34 - 2014-03-09 22:34 - 00001140 _____ () C:\Users\Public\Desktop\Prism Videodatei-Konverter.lnk

2014-03-09 22:34 - 2014-03-09 22:34 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Videoverwandte Programme

2014-03-09 22:34 - 2014-03-09 22:34 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Produktpalette

2014-03-09 22:31 - 2014-03-09 22:31 - 00001126 _____ () C:\Users\Public\Desktop\Debut Videorekorder.lnk

2014-03-09 22:31 - 2014-03-09 22:30 - 01579032 _____ (NCH Software) C:\Users\Pc\Downloads\debutpsetup.exe

2014-03-09 22:26 - 2012-11-02 19:39 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\uTorrent

2014-03-09 22:25 - 2014-03-09 22:25 - 00275704 _____ () C:\Windows\Minidump\030914-24070-01.dmp

2014-03-09 16:24 - 2014-03-09 16:24 - 00262144 ____N () C:\Windows\Minidump\030914-26629-01.dmp

2014-03-09 11:22 - 2014-03-09 11:22 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved

2014-03-09 11:22 - 2014-03-09 11:22 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\library_dir

2014-03-09 11:22 - 2014-03-09 11:20 - 00000000 ____D () C:\Program Files (x86)\Raptr

2014-03-09 11:20 - 2014-03-09 11:20 - 01007930 _____ () C:\Users\Pc\Downloads\amddriverdownload_installer.exe

2014-03-08 14:45 - 2014-03-08 14:45 - 00275704 _____ () C:\Windows\Minidump\030814-21247-01.dmp

2014-03-07 13:50 - 2013-04-19 22:33 - 00000000 ____D () C:\Users\Pc\Documents\Mount&Blade With Fire and Sword

2014-03-06 19:46 - 2014-03-06 19:46 - 00002115 _____ () C:\Users\Pc\Desktop\Mount&Blade Dedicated Server [by iMortaluz].lnk

2014-03-06 19:46 - 2013-04-19 22:33 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Mount&Blade With Fire and Sword

2014-03-06 19:46 - 2013-04-07 16:20 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Mount&Blade Warband

2014-03-06 19:46 - 2013-04-07 16:18 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade Warband

2014-03-06 19:44 - 2014-03-06 19:44 - 170117744 _____ () C:\Users\Pc\Downloads\Warband_Napoleonic_Wars_v1.158+v1.104_UPDATE+CRACKS_by_iMortaluz_v2.exe

2014-03-06 18:10 - 2014-03-06 18:10 - 00262144 ____N () C:\Windows\Minidump\030614-21871-01.dmp

2014-03-05 22:00 - 2014-03-05 22:00 - 00262144 ____N () C:\Windows\Minidump\030514-31917-01.dmp

2014-03-05 21:36 - 2014-03-05 21:36 - 00262144 ____N () C:\Windows\Minidump\030514-27502-01.dmp

2014-03-05 12:22 - 2012-10-26 13:14 - 00000000 ____D () C:\ProgramData\Skype

2014-03-05 12:21 - 2014-03-05 12:21 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-03-05 12:21 - 2014-03-05 12:21 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-03-04 16:32 - 2013-11-10 13:08 - 00000000 ____D () C:\Program Files (x86)\Europa Universalis IV

2014-03-04 16:23 - 2014-03-04 16:23 - 00262144 ____N () C:\Windows\Minidump\030414-24928-01.dmp

2014-03-04 13:32 - 2014-03-04 13:32 - 00013668 _____ () C:\Users\Pc\Desktop\Result.txt

2014-03-04 13:31 - 2014-03-04 13:31 - 00982016 _____ (Farbar) C:\Users\Pc\Desktop\MiniToolBox.exe

2014-03-04 10:26 - 2014-03-04 10:26 - 00262144 ____N () C:\Windows\Minidump\030414-21871-01.dmp

2014-03-03 20:26 - 2013-09-14 20:24 - 00000424 _____ () C:\Users\Pc\Desktop\Accounts.txt

2014-03-03 19:32 - 2014-03-03 19:32 - 00010522 _____ () C:\Users\Pc\Downloads\030214-23290-01.rar

2014-03-03 19:29 - 2014-02-11 22:27 - 00000000 ____D () C:\Users\Pc\Desktop\Dokus

2014-03-03 19:20 - 2014-03-03 19:20 - 00275704 _____ () C:\Windows\Minidump\030314-27705-01.dmp

2014-03-03 19:10 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-03-03 15:31 - 2014-02-18 17:55 - 00017758 _____ () C:\Windows\DirectX.log

2014-03-03 15:26 - 2012-11-10 17:56 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\DAEMON Tools Lite

2014-03-03 14:04 - 2013-03-12 15:24 - 00000000 ____D () C:\Program Files (x86)\Total War Shogun 2

2014-03-03 13:45 - 2013-08-15 19:23 - 00000000 ____D () C:\ProgramData\HappyCloud

2014-03-02 12:31 - 2014-03-03 19:31 - 00262144 _____ () C:\Users\Pc\Desktop\030214-23290-01.dmp

2014-03-02 12:31 - 2014-03-02 12:31 - 00262144 ____N () C:\Windows\Minidump\030214-23290-01.dmp

2014-03-02 01:35 - 2014-03-02 01:21 - 00000000 ____D () C:\Users\Pc\Desktop\Anwalt

2014-03-02 01:24 - 2014-03-02 01:24 - 00262144 ____N () C:\Windows\Minidump\030214-22011-01.dmp

2014-03-01 20:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-03-01 07:05 - 2014-03-12 10:16 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-03-01 06:17 - 2014-03-12 10:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-03-01 06:16 - 2014-03-12 10:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-03-01 05:58 - 2014-03-12 10:16 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-03-01 05:52 - 2014-03-12 10:16 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-03-01 05:51 - 2014-03-12 10:16 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-03-01 05:42 - 2014-03-12 10:16 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-03-01 05:40 - 2014-03-12 10:16 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-03-01 05:37 - 2014-03-12 10:16 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-03-01 05:33 - 2014-03-12 10:16 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-03-01 05:33 - 2014-03-12 10:16 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-03-01 05:32 - 2014-03-12 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-03-01 05:30 - 2014-03-12 10:16 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-03-01 05:23 - 2014-03-12 10:16 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-03-01 05:17 - 2014-03-12 10:16 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-03-01 05:11 - 2014-03-12 10:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-03-01 05:02 - 2014-03-12 10:16 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-03-01 04:54 - 2014-03-12 10:16 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-03-01 04:52 - 2014-03-12 10:16 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-03-01 04:51 - 2014-03-12 10:16 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-03-01 04:47 - 2014-03-12 10:16 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-03-01 04:43 - 2014-03-12 10:16 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-03-01 04:43 - 2014-03-12 10:16 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-03-01 04:42 - 2014-03-12 10:16 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-03-01 04:40 - 2014-03-12 10:16 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-03-01 04:38 - 2014-03-12 10:16 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-03-01 04:37 - 2014-03-12 10:16 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-03-01 04:35 - 2014-03-12 10:16 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-03-01 04:18 - 2014-03-12 10:16 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-03-01 04:16 - 2014-03-12 10:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-03-01 04:14 - 2014-03-12 10:16 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-03-01 04:10 - 2014-03-12 10:16 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-03-01 04:03 - 2014-03-12 10:16 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-03-01 04:00 - 2014-03-12 10:16 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-03-01 03:57 - 2014-03-12 10:16 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-03-01 03:38 - 2014-03-12 10:16 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-03-01 03:32 - 2014-03-12 10:16 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-03-01 03:27 - 2014-03-12 10:16 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-03-01 03:25 - 2014-03-12 10:16 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-03-01 03:25 - 2014-03-12 10:16 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-28 22:19 - 2012-12-18 19:29 - 01625030 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-02-28 15:26 - 2014-02-28 15:26 - 00262144 ____N () C:\Windows\Minidump\022814-26005-01.dmp

2014-02-28 12:17 - 2013-02-25 14:23 - 00000000 ____D () C:\Users\Pc\AppData\Roaming\Spotify

2014-02-28 12:16 - 2013-02-25 14:24 - 00000000 ____D () C:\Users\Pc\AppData\Local\Spotify

2014-02-28 10:18 - 2014-02-28 10:18 - 00262144 ____N () C:\Windows\Minidump\022814-23665-01.dmp

2014-02-28 08:46 - 2014-02-28 08:46 - 00275704 _____ () C:\Windows\Minidump\022814-34226-01.dmp

2014-02-27 18:14 - 2014-02-27 18:14 - 00275704 _____ () C:\Windows\Minidump\022714-24070-01.dmp

2014-02-25 23:19 - 2014-02-25 23:18 - 00275704 _____ () C:\Windows\Minidump\022514-25162-01.dmp

2014-02-25 19:45 - 2014-02-25 19:45 - 01956366 _____ () C:\Users\Pc\Downloads\EasyRootingToolkit_XPERIA-Z_SO-02E_v101-ENGLISH_tkymgr.zip

2014-02-25 19:44 - 2014-02-25 19:38 - 00015636 _____ () C:\Windows\DPINST.LOG

2014-02-25 19:43 - 2014-02-25 19:42 - 15305933 _____ () C:\Users\Pc\Downloads\Flashtool-drivers.exe

2014-02-25 14:20 - 2014-02-25 14:20 - 00275704 _____ () C:\Windows\Minidump\022514-24382-01.dmp

2014-02-22 14:04 - 2014-02-22 14:04 - 00262144 ____N () C:\Windows\Minidump\022214-20467-01.dmp
 

Some content of TEMP:

====================

C:\Users\Pc\AppData\Local\Temp\avgnt.exe

C:\Users\Pc\AppData\Local\Temp\prismsetup.exe

C:\Users\Pc\AppData\Local\Temp\Quarantine.exe

C:\Users\Pc\AppData\Local\Temp\raptrpatch.exe

C:\Users\Pc\AppData\Local\Temp\vpsetup.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-03-20 15:41
 

==================== End Of Log ============================

--- --- ---

--- --- ---

sunjojo

25.03.2014 18:55

Zitat:

Ich habe zurzeit kein anderes Netzteil rumliegen. Ich glaube aber nicht, das es am Netzteil liegt. Das Problem ähnelt mehr einem Virus, da es sehr systematisch ist.

Ok, aber ich sehe in deinem Log keine Anzeichen für Malware und meiner Meinung nach, liegt das auch an keiner Malware.

Ich werde mal rumfragen, woran das liegen kann und ob einer aus dem Kompetenzteam sowas bereits gesehen/gehört hat.

Kannst du bitte noch die letzen beiden Dumpfiles, die erstellt wurden, anhängen?

Redblood

27.03.2014 14:49

Ich habe das Problem entdeckt. Wie du sagtest, lag es an der Hardware. Ich habe den Computern aufgemacht und festgestellt, dass der Lüfter fast runterhing. Ein Stück vom Modul um den CPU ist abgebrochen, wodurch der Lüfter sich nicht mehr einhaken konnte.

Ich werde demnächst ein neues Modul kaufen gehen und zusätzlich noch neue Wärmeleitpaste, da diese auch nicht mehr richtig ordentlich aussieht.

Die Abstürze kamen vermutlich von der unzureichenden Kühlung.

sunjojo

27.03.2014 16:33

Zitat:

Die Abstürze kamen vermutlich von der unzureichenden Kühlung.

Ok, das wäre mein nächster Punkt gwesen, den du hättest kontrollieren müssen, aber dann hat sich das ja erledigt :).

Hast du noch Fragen?

Redblood

28.03.2014 13:36

Nein. Aber trotzdem großen Dank an dich. Hast mir bei meinem Virenproblem wirklich geholfen. ;)

sunjojo

28.03.2014 16:57

Zitat:

Hast mir bei meinem Virenproblem wirklich geholfen.

Immer wieder gerne :).

Ich lösche dich dann wieder aus meinen Abos.

Alle Zeitangaben in WEZ +1. Es ist jetzt 11:10 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131