Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 7 EsetScan meldet "Win32/Toolbar.Montiera" und weitere Funde (https://www.trojaner-board.de/154067-windows-7-esetscan-meldet-win32-toolbar-montiera-funde.html)

Fl!tsche 19.05.2014 15:11
Windows 7 EsetScan meldet "Win32/Toolbar.Montiera" und weitere Funde
 
Servus

hab wohl ein eher größeres Problem!

PC-Info:
Dell Precision M6500 Windows 7 Home 64bit
Intel(R) Core(TM) i7 CPU Q720 @ 1.60GHz 1.60GHz
16GB Ram
ATI FirePro M7820
Festplatte 1: WDC WD1600BJKT-75F4T0 160GB
Festplatte 2: WDC WD5000BPKT-00PK4T0 500GB

Hatte schon länger die Vermutung das ich mir was eingefangen hab. Also neue Virensoftware (EsetSmartSecurity) gekauft und installiert.
Nach der Installation gleich Scan laufen lassen der dann auch Ergebnisse lieferte. :wtf:

Logfiles von Eset, Defogger, FRST und Gmer :

Eset
Eset Scan 17-05-14.txt
Code:
Log
Version der Signaturdatenbank: 9811 (20140516)
Datum: 17.05.2014  Uhrzeit: 03:46:20
Geprüfte Laufwerke, Ordner und Dateien: C:\
C:\hiberfil.sys - Fehler beim Öffnen  [4]
C:\pagefile.sys - Fehler beim Öffnen  [4]
C:\Program Files\WinRAR\Default.SFX = WINRARSFX - Archiv beschädigt
C:\Program Files\WinRAR\Zip.SFX = WINRARSFX - Archiv beschädigt
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log - Fehler beim Öffnen  [4]
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb - Fehler beim Öffnen  [4]
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb - Fehler beim Öffnen  [4]
C:\ProgramData\Microsoft\Windows Defender\IMpService925A3ACA-C353-458A-AC8D-A7E5EB378092.lock - Fehler beim Öffnen  [4]
C:\System Volume Information\Syscache.hve - Fehler beim Öffnen  [4]
C:\System Volume Information\Syscache.hve.LOG1 - Fehler beim Öffnen  [4]
C:\System Volume Information\Syscache.hve.LOG2 - Fehler beim Öffnen  [4]
C:\System Volume Information\{2508d114-dd5b-11e3-af5a-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{2508d118-dd5b-11e3-af5a-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{2508d125-dd5b-11e3-af5a-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{333dd582-d87e-11e3-a88f-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{3e270f4f-d55e-11e3-aca6-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{608f2ea1-d471-11e3-8e10-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{608f2eb9-d471-11e3-8e10-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{74d8dc57-cfa7-11e3-8a8e-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{9fbf5c58-c883-11e3-ae9d-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{a18c07f2-dd58-11e3-a9aa-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{a18c07f6-dd58-11e3-a9aa-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{b05b634d-dd2e-11e3-aaf9-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{b05b6378-dd2e-11e3-aaf9-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{e04da8c4-cbe2-11e3-b0ca-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{fba2376e-dd5d-11e3-a3e5-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{fba23772-dd5d-11e3-a3e5-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\System Volume Information\{fba237a1-dd5d-11e3-a3e5-f04da24c8216}{3808876b-c176-4e48-b7ae-04046e6cc752} - Fehler beim Öffnen  [4]
C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\MSS.log - Fehler beim Öffnen  [4]
C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb - Fehler beim Öffnen  [4]
C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb - Fehler beim Öffnen  [4]
C:\Users\All Users\Microsoft\Windows Defender\IMpService925A3ACA-C353-458A-AC8D-A7E5EB378092.lock - Fehler beim Öffnen  [4]
C:\Users\Andrea\ntuser.dat - Fehler beim Öffnen  [4]
C:\Users\Andrea\ntuser.dat.LOG1 - Fehler beim Öffnen  [4]
C:\Users\Andrea\ntuser.dat.LOG2 - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\UsrClass.dat - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\WebCacheLock.dat - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7UNMYP92\Setup[1].exe = NSIS = PacFunctionBHO.dll - Variante von Win32/BrowseFox.F evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7UNMYP92\Setup[1].exe = NSIS = updatePacFunction.exe - Variante von Win32/BrowseFox.H evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7UNMYP92\Setup[1].exe = NSIS = PacFunctionUninstall.exe = NSIS = Script.nsi - Win32/BrowseFox.C evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = Script.nsi - Win32/Toolbar.Montiera.I evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = IEFunctions.dll - - OK
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = Script.nsi - Win32/Toolbar.Montiera.E evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminentEng.dll - möglicherweise Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminent.dll - Variante von Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminentApp.dll - Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminentTlbr.dll - Variante von Win32/Toolbar.Montiera.F evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminentsrv.exe - Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = uninstall.exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = uninstall.exe = NSIS = IEFunctions.dll - - OK
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ffx.exe = NSIS = Script.nsi - Win32/Toolbar.Montiera.E evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ffx.exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ffx.exe = NSIS = uninstall.exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\monetizationLoader[1].js - JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung - Aktionsauswahl aufgeschoben bis zum Abschluss des Scans
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAWN71B0\monetizationLoader[1].js - JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung - Aktionsauswahl aufgeschoben bis zum Abschluss des Scans
C:\Users\Andrea\AppData\Local\Microsoft\Windows\WebCache\V01.log - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-da.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-de.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-en.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-es.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-fi.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-fr.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-hr.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-hu.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-it.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-ja.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-ko.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-nl.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-no.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-pl.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-pt.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-ro.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-ru.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-sk.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-sl.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-sv.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-tr.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-ua.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-zh-cn.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/language-zh-tw.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/main-merge.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/omniture_s_code.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = _js/pdc_s_code_sc.js - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = app.config.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = bundles.json - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = download.solidconfig - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = downloader.bundle - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = gccheck.exe - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = gdrcheck.exe - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = gtbcheck.exe - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = index.html - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-cs.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-da.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-de.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-es.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-fi.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-fr.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-hr.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-hu.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-it.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-ja.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-ko.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-nl.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-no.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-pl.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-pt.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-ro.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-ru.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-sk.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-sl.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-sv.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-tr.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-ua.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-zh-cn.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language-zh-tw.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = language.xml - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = launcher.bundle - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = logo.ico - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = openx.html - Fehler - Datei ist passwortgeschützt
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe = ZIP = window.config.xml - Fehler - Datei ist passwortgeschützt
C:\Windows\ServiceProfiles\LocalService\ntuser.dat - Fehler beim Öffnen  [4]
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 - Fehler beim Öffnen  [4]
C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2 - Fehler beim Öffnen  [4]
C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - Fehler beim Öffnen  [4]
C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - Fehler beim Öffnen  [4]
C:\Windows\ServiceProfiles\NetworkService\ntuser.dat - Fehler beim Öffnen  [4]
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 - Fehler beim Öffnen  [4]
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2 - Fehler beim Öffnen  [4]
C:\Windows\System32\catroot2\edb.log - Fehler beim Öffnen  [4]
C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb - Fehler beim Öffnen  [4]
C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb - Fehler beim Öffnen  [4]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7UNMYP92\Setup[1].exe = NSIS = PacFunctionBHO.dll - Variante von Win32/BrowseFox.F evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7UNMYP92\Setup[1].exe = NSIS = updatePacFunction.exe - Variante von Win32/BrowseFox.H evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7UNMYP92\Setup[1].exe = NSIS = PacFunctionUninstall.exe = NSIS = Script.nsi - Win32/BrowseFox.C evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = Script.nsi - Win32/Toolbar.Montiera.I evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = IEFunctions.dll - - OK
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = Script.nsi - Win32/Toolbar.Montiera.E evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminentEng.dll - möglicherweise Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminent.dll - Variante von Win32/Toolbar.Escort.A evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminentApp.dll - Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminentTlbr.dll - Variante von Win32/Toolbar.Montiera.F evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = iminentsrv.exe - Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = uninstall.exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ie.exe = NSIS = uninstall.exe = NSIS = IEFunctions.dll - - OK
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ffx.exe = NSIS = Script.nsi - Win32/Toolbar.Montiera.E evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ffx.exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\IMinentToolbar[1].exe = NSIS = iminent4ffx.exe = NSIS = uninstall.exe = NSIS = mt.dll - Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L3QF9R23\monetizationLoader[1].js - JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung - Gesäubert durch Löschen - in Quarantäne kopiert [1]
C:\Users\Andrea\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAWN71B0\monetizationLoader[1].js - JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung - Gesäubert durch Löschen - in Quarantäne kopiert [1]
Geprüfte Objekte: 103341
Erkannte Bedrohungen: 18
Anzahl gesäuberter Objekte: 18
Abgeschlossen: 04:20:55  Benötigte Zeit: 2075 Sek. (00:34:35)

Hinweise:
[1] Objekt wurde gelöscht. Es enthielt ausschließlich Viruscode.
[4] Objekt kann nicht geöffnet werden. Möglicherweise in Benutzung durch eine andere Anwendung oder das Betriebssystem.
Defogger
defogger_disable.log
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 05:21 on 17/05/2014 (Andrea 2)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
FRST
FRST.txt
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-05-2014
Ran by Andrea 2 (administrator) on PRECISION_M6400 on 17-05-2014 05:26:16
Running from C:\Users\Andrea\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
(Broadcom Corporation) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-07-22] (IDT, Inc.)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5618456 2013-09-12] (ESET)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-07-24] (Advanced Micro Devices, Inc.)

==================== Internet (Whitelisted) ====================

SearchScopes: HKCU - DefaultScope {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
SearchScopes: HKCU - {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -  No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-05-17]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-05-17]

==================== Services (Whitelisted) =================

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1337752 2013-09-12] (ESET)

==================== Drivers (Whitelisted) ====================

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
R3 tifm21; C:\Windows\System32\drivers\tifm21.sys [319488 2009-06-19] (Texas Instruments)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-17 05:26 - 2014-05-17 05:26 - 00006712 _____ () C:\Users\Andrea\Desktop\FRST.txt
2014-05-17 05:26 - 2014-05-17 05:26 - 00000000 ____D () C:\FRST
2014-05-17 05:25 - 2014-05-17 05:25 - 02067456 _____ (Farbar) C:\Users\Andrea\Desktop\FRST64.exe
2014-05-17 05:21 - 2014-05-17 05:21 - 00000478 _____ () C:\Users\Andrea\Desktop\defogger_disable.log
2014-05-17 05:21 - 2014-05-17 05:21 - 00000000 _____ () C:\Users\Andrea 2\defogger_reenable
2014-05-17 05:20 - 2014-05-17 05:20 - 00050477 _____ () C:\Users\Andrea\Desktop\Defogger.exe
2014-05-17 04:38 - 2014-05-17 04:38 - 00328672 _____ () C:\Windows\Minidump\051714-24367-01.dmp
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\Program Files\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Local\ESET
2014-05-17 02:11 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-17 02:11 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-17 02:11 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-17 02:11 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-17 02:11 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-17 02:11 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-16 21:24 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-16 21:24 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-16 21:24 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-16 21:24 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-16 21:24 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-16 21:24 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-16 21:24 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-16 21:24 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-16 21:24 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-16 21:24 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-16 21:24 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-16 21:24 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-16 21:24 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-16 21:24 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-16 21:24 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-16 21:24 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-16 21:24 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-16 21:24 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-16 21:24 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-16 21:24 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-16 21:24 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-16 21:24 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-16 21:24 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-16 21:24 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-16 21:24 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-16 21:24 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-16 21:24 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-16 21:24 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-16 21:24 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-16 21:24 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-16 21:24 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-16 21:24 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-16 21:24 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-16 21:24 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-11 23:54 - 2014-05-11 23:54 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_wpdcomp_01_09_00.Wdf
2014-05-11 23:49 - 2014-05-11 23:50 - 00328672 _____ () C:\Windows\Minidump\051114-18361-01.dmp
2014-05-10 22:25 - 2014-05-10 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 02:24 - 2014-05-10 02:25 - 00000000 ____D () C:\Users\Andrea\Desktop\Gruber
2014-05-07 01:28 - 2014-05-17 02:16 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-29 16:06 - 2014-04-29 16:06 - 00884960 _____ () C:\Windows\Minidump\042914-13868-01.dmp
2014-04-20 14:12 - 2014-04-20 14:12 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Adobe
2014-04-19 04:46 - 2014-04-19 04:48 - 00000000 ____D () C:\Users\Andrea\Desktop\Neuer Ordner (2)
2014-04-19 04:18 - 2014-04-19 04:19 - 00000000 ____D () C:\Users\Andrea\Desktop\Arbeit
2014-04-19 01:42 - 2014-04-19 01:42 - 00000000 __SHD () C:\Users\Andrea\AppData\Local\EmieUserList
2014-04-19 01:42 - 2014-04-19 01:42 - 00000000 __SHD () C:\Users\Andrea\AppData\Local\EmieSiteList
2014-04-17 05:05 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-17 05:05 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-17 05:05 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-17 05:05 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-17 05:04 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-17 05:04 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-17 05:04 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-17 05:04 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-17 05:04 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-17 05:04 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-17 05:04 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-17 05:04 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-17 05:04 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-17 05:04 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-17 05:04 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-17 05:04 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-17 05:04 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-17 05:04 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-17 05:04 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-17 05:04 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-17 05:04 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-17 05:04 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-17 05:04 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-17 05:04 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-17 05:04 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-17 05:04 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-17 05:04 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-17 05:04 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-17 05:04 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-17 05:04 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-17 05:04 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-17 05:04 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-17 05:04 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-17 05:04 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-17 05:04 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-17 05:04 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-17 05:04 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-17 05:04 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-17 05:04 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-17 05:04 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-17 05:04 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-17 05:04 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-17 05:04 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-17 05:04 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

==================== One Month Modified Files and Folders =======

2014-05-17 05:26 - 2014-05-17 05:26 - 00006712 _____ () C:\Users\Andrea\Desktop\FRST.txt
2014-05-17 05:26 - 2014-05-17 05:26 - 00000000 ____D () C:\FRST
2014-05-17 05:25 - 2014-05-17 05:25 - 02067456 _____ (Farbar) C:\Users\Andrea\Desktop\FRST64.exe
2014-05-17 05:21 - 2014-05-17 05:21 - 00000478 _____ () C:\Users\Andrea\Desktop\defogger_disable.log
2014-05-17 05:21 - 2014-05-17 05:21 - 00000000 _____ () C:\Users\Andrea 2\defogger_reenable
2014-05-17 05:21 - 2014-04-09 19:19 - 00000000 ____D () C:\Users\Andrea 2
2014-05-17 05:20 - 2014-05-17 05:20 - 00050477 _____ () C:\Users\Andrea\Desktop\Defogger.exe
2014-05-17 05:16 - 2009-07-14 06:45 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-17 05:16 - 2009-07-14 06:45 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-17 05:13 - 2011-04-12 09:43 - 00699088 _____ () C:\Windows\system32\perfh007.dat
2014-05-17 05:13 - 2011-04-12 09:43 - 00149196 _____ () C:\Windows\system32\perfc007.dat
2014-05-17 05:13 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-17 05:11 - 2014-02-15 10:02 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-05-17 05:09 - 2014-03-07 20:08 - 00000443 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-05-17 05:09 - 2014-02-02 20:43 - 00015428 _____ () C:\Windows\setupact.log
2014-05-17 05:09 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-17 04:42 - 2014-02-01 17:19 - 01621474 _____ () C:\Windows\WindowsUpdate.log
2014-05-17 04:38 - 2014-05-17 04:38 - 00328672 _____ () C:\Windows\Minidump\051714-24367-01.dmp
2014-05-17 04:38 - 2014-02-08 19:14 - 1005960709 _____ () C:\Windows\MEMORY.DMP
2014-05-17 04:38 - 2014-02-08 19:14 - 00000000 ____D () C:\Windows\Minidump
2014-05-17 04:06 - 2014-02-01 19:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\Program Files\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Local\ESET
2014-05-17 02:38 - 2014-02-06 20:53 - 00000000 ____D () C:\ProgramData\Apple
2014-05-17 02:34 - 2014-02-27 19:36 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-05-17 02:31 - 2014-02-01 19:55 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-05-17 02:20 - 2014-02-01 17:49 - 00000000 ___RD () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-17 02:20 - 2014-02-01 17:49 - 00000000 ___RD () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-17 02:16 - 2014-05-07 01:28 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-17 02:12 - 2014-02-01 19:13 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-17 02:09 - 2014-02-01 19:22 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-17 02:08 - 2014-02-01 19:22 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-16 22:06 - 2014-02-01 19:37 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-16 22:06 - 2014-02-01 19:37 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-16 22:06 - 2014-02-01 19:37 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-11 23:54 - 2014-05-11 23:54 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_wpdcomp_01_09_00.Wdf
2014-05-11 23:50 - 2014-05-11 23:49 - 00328672 _____ () C:\Windows\Minidump\051114-18361-01.dmp
2014-05-11 23:49 - 2014-02-01 19:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-10 22:25 - 2014-05-10 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 02:25 - 2014-05-10 02:24 - 00000000 ____D () C:\Users\Andrea\Desktop\Gruber
2014-05-09 08:14 - 2014-05-16 21:24 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-16 21:24 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-07 23:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-06 06:40 - 2014-05-17 02:11 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-17 02:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-17 02:11 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-17 02:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-17 02:11 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-17 02:11 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-30 19:22 - 2014-02-17 18:13 - 00000000 ____D () C:\Users\Andrea\Desktop\Musiik
2014-04-29 16:06 - 2014-04-29 16:06 - 00884960 _____ () C:\Windows\Minidump\042914-13868-01.dmp
2014-04-21 00:41 - 2014-02-15 10:00 - 00033324 _____ () C:\Windows\PFRO.log
2014-04-20 21:19 - 2014-04-13 21:08 - 00000000 ____D () C:\Users\Andrea\Desktop\Neuer Ordner
2014-04-20 14:12 - 2014-04-20 14:12 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Adobe
2014-04-19 04:48 - 2014-04-19 04:46 - 00000000 ____D () C:\Users\Andrea\Desktop\Neuer Ordner (2)
2014-04-19 04:19 - 2014-04-19 04:18 - 00000000 ____D () C:\Users\Andrea\Desktop\Arbeit
2014-04-19 01:42 - 2014-04-19 01:42 - 00000000 __SHD () C:\Users\Andrea\AppData\Local\EmieUserList
2014-04-19 01:42 - 2014-04-19 01:42 - 00000000 __SHD () C:\Users\Andrea\AppData\Local\EmieSiteList
2014-04-17 05:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\BackupSetup.exe
C:\Users\Andrea\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe
C:\Users\Andrea\AppData\Local\Temp\InstHelper.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-05-16 21:24] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 03:36

==================== End Of Log ============================
FRST
Addition.txt
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-05-2014
Ran by Andrea 2 at 2014-05-17 05:26:53
Running from C:\Users\Andrea\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: ESET Smart Security 7.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 7.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personal Firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
ATI Catalyst Install Manager (HKLM\...\{47938B5E-5D52-7A4B-2D5C-432B7B24AB2C}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
BioAPI Framework (Version: 1.0.1 - Dell Inc.) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0724.2243.38944 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0724.2243.38944 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0724.2243.38944 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0724.2243.38944 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help English (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help French (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help German (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0724.2243.38944 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0724.2243.38944 - ATI) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{349F73CA-653A-43A6-AE77-970B07D6EDA0}) (Version:  - Microsoft)
Dell ControlVault Host Components Installer 64Bit (Version: 1.7.459.360 - Broadcom Corporation) Hidden
Dell Security Device Driver Pack (HKLM-x32\...\{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}) (Version: 1.4.056 - Dell Inc.)
ESET Smart Security (HKLM\...\{F5A3E880-A737-48F2-A124-6F5D4CEA6AB4}) (Version: 7.0.302.26 - ESET, spol s r. o.)
HDVidCodec (HKLM-x32\...\1ClickDownload) (Version: 2.1 Build 26473 - hdvidcodec.com) <==== ATTENTION
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6292.0 - IDT)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
K-Lite Codec Pack 10.2.0 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.2.0 - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.18.0 - NEC Electronics Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0 - NEC Electronics Corporation) Hidden
Nero 7.11.10.0 Lite (HKLM-x32\...\Nero7Lite_is1) (Version: 7.11.10.0 - Nero AG)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Texas Instruments PCIxx21/x515/xx12 drivers. (HKLM-x32\...\InstallShield_{B54B8CD3-E12B-4C29-AF5A-2101E2FF5F53}) (Version: 2.00.0005 - Texas Instruments Inc.)
TIPCI (x32 Version: 2.00.0005 - Texas Instruments Inc.) Hidden
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{4B93560B-F33D-4A67-A224-F5E1C329BD22}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version:  - Microsoft)
UPEK TouchChip Fingerprint Reader (Version: 1.2.0 - Dell Inc.) Hidden
Windows-Treiberpaket - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6) (HKLM\...\9512AA21B791B05A54E27065C45BBC417AB282DF) (Version: 09/11/2009 1.0.1.6 - Dell Inc.)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points  =========================

20-04-2014 12:13:19 Windows Update
24-04-2014 19:12:47 Windows Update
29-04-2014 14:17:29 Windows Update
05-05-2014 16:32:44 Windows Update
05-05-2014 23:59:25 Windows Update
06-05-2014 23:28:36 Windows Update
10-05-2014 20:14:18 Windows Update
16-05-2014 19:28:01 Windows Update
17-05-2014 00:07:13 Windows Update
17-05-2014 00:32:57 Removed Bonjour
17-05-2014 00:33:24 Removed iTunes
17-05-2014 00:37:14 Removed Apple Application Support
17-05-2014 00:38:29 Removed Apple Mobile Device Support
17-05-2014 00:39:08 Removed Apple Software Update
17-05-2014 01:19:02 ESET Smart Security wurde installiert
17-05-2014 01:22:33 ESET Smart Security wurde installiert
17-05-2014 01:35:17 ESET Smart Security wurde installiert

==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-01-03 11:25 - 00646495 ___RA C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 serial.alcohol-soft.com
127.0.0.1 www.alcohol-soft.com
127.0.0.1 serial.alcohol-soft.com
127.0.0.1 images.alcohol-soft.com
127.0.0.1 trial.alcohol-soft.com
127.0.0.1 forum.alcohol-soft.com
127.0.0.1 support.alcohol-soft.com
127.0.0.1 users.alcohol-soft.com
127.0.0.1 shop.alcohol-soft.com
127.0.0.1 vodka.alcohol-soft.com
127.0.0.1 *.alcohol-soft.com
127.0.0.1 *.alcohol-soft.*
127.0.0.1 iw2.slysoft.com
127.0.0.1 h3.slysoft.com
127.0.0.1 update.slysoft.com
127.0.0.1 slysoft.com
127.0.0.1 sb2slysoft.com
127.0.0.1 ns6.gandi.net
127.0.0.1 ev1slysoft.com
127.0.0.1 reverse.privatedns.com
127.0.0.1 update.slysoft.com
127.0.0.1 ev1slysoft.com
127.0.0.1 flashfxp.com
127.0.0.1 flashfxp.org
127.0.0.1 flashfxp.ws
127.0.0.1 www.flashfxp.com
127.0.0.1 www.flashfxp.org
127.0.0.1 www.flashfxp.ws
127.0.0.1 liveupdate.inicom.net/verify.php

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {62BA4D3D-253B-44BB-A506-B1463FC234C7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-16] (Adobe Systems Incorporated)
Task: {B518F164-6FE3-424B-9017-10622FBAD55A} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-02-01] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2009-04-16 14:35 - 2009-04-16 14:35 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-07-24 23:41 - 2010-07-24 23:41 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/17/2014 05:11:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 04:44:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 04:40:20 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 03:39:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 02:57:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 02:45:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 02:38:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Precision_M6400)
Description: Die Anwendung oder der Dienst "Apple Mobile Device" konnte nicht neu gestartet werden.

Error: (05/17/2014 02:37:29 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 02:19:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/16/2014 09:19:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (05/17/2014 04:43:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (05/17/2014 04:43:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (05/17/2014 04:43:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (05/17/2014 04:43:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (05/17/2014 04:43:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (05/17/2014 04:43:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (05/17/2014 04:43:42 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (05/17/2014 04:43:23 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (05/17/2014 04:43:21 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (05/17/2014 04:43:21 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068


Microsoft Office Sessions:
=========================
Error: (05/17/2014 05:11:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 04:44:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 04:40:20 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 03:39:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 02:57:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 02:45:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 02:38:08 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Precision_M6400)
Description: 0AppleMobileDeviceService.exeApple Mobile Device03026217816640

Error: (05/17/2014 02:37:29 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/17/2014 02:19:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/16/2014 09:19:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 16308.19 MB
Available physical RAM: 14542.29 MB
Total Pagefile: 32614.55 MB
Available Pagefile: 30716.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:402.15 GB) NTFS
Drive z: (SICHERUNG) (Fixed) (Total:148.95 GB) (Free:127.59 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: 3017E1C1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 000C1EAF)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Gmer
Gmer.txt
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-17 05:44:45
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD5000BPKT-00PK4T0 rev.01.01A01 465,76GB
Running: 8kw0v6sr.exe; Driver: C:\Users\ANDREA~1\AppData\Local\Temp\fgwdqfoc.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1716] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter  00000000751e8791 4 bytes [C2, 04, 00, 00]
.text  C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1716] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69      0000000075531465 2 bytes [53, 75]
.text  C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1716] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155      00000000755314bb 2 bytes [53, 75]
.text  ...                                                                                                                        * 2

---- Disk sectors - GMER 2.1 ----

Disk  \Device\Harddisk1\DR1                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----
ich hoffe ihr könnt mir irgendwie helfen....

cosinus 19.05.2014 15:34
Hi und :hallo:

Code:
127.0.0.1 serial.alcohol-soft.com
127.0.0.1 www.alcohol-soft.com
127.0.0.1 serial.alcohol-soft.com
127.0.0.1 images.alcohol-soft.com
127.0.0.1 trial.alcohol-soft.com
127.0.0.1 forum.alcohol-soft.com
127.0.0.1 support.alcohol-soft.com
127.0.0.1 users.alcohol-soft.com
127.0.0.1 shop.alcohol-soft.com
127.0.0.1 vodka.alcohol-soft.com
127.0.0.1 *.alcohol-soft.com
127.0.0.1 *.alcohol-soft.*
127.0.0.1 iw2.slysoft.com
127.0.0.1 h3.slysoft.com
127.0.0.1 update.slysoft.com
127.0.0.1 slysoft.com
127.0.0.1 sb2slysoft.com
127.0.0.1 ns6.gandi.net
127.0.0.1 ev1slysoft.com
127.0.0.1 reverse.privatedns.com
127.0.0.1 update.slysoft.com
127.0.0.1 ev1slysoft.com
127.0.0.1 flashfxp.com
127.0.0.1 flashfxp.org
127.0.0.1 flashfxp.ws
127.0.0.1 www.flashfxp.com
127.0.0.1 www.flashfxp.org
127.0.0.1 www.flashfxp.ws
Erklärung hierfür? Sieht aus, als hättest du da ordentlich mit gecrackter Software "experimentiert" und mindestens eine gecrackte Software ist noch drauf :pfui: nämlich MS-Office:

System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-02-01] ()

AutoKMS ist der typische illegale MS-Office-Activator.

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

Fl!tsche 19.05.2014 22:21
Servus Cosinus,

danke erstmal für die Antwort auch wenn meine jetzt gedauert hat.
ich muss gestehen, ich hab echt nicht viel Ahnung von PC und Internet. Belese mich aber zu dem Thema so oft wie ich kann.
Hab jetzt das MS Office und alle Dateien die ich zu AutoKMS gefunden hab gelöscht. Bin mir blos nicht ganz sicher weil dieses AutoKMS nicht mal in der Systemsteuerung aufgeführt war. Bin dann über die WindowsSuchfunktion drauf gestoßen. Nach Neustart und erneuter Suche wurde mir dann nichts mehr angezeigt.
Auch wenn sich hier mal wieder der Spruch "Dummheit schützt vor Strafe nicht." bewahrheitet, ich war mir der Funktion dieses Programms nicht bewusst. Das Betriebssystem und alles andere hat mir ein Arbeitskollege installiert. Auf Grund meiner Unwissenheit hab ich mir das dann doch nicht zugetraut.
Die Strafe hab ich wohl aber gekriegt :headbang:

Diesen Auszug aus dem Log kann ich auch nicht erklären. Diese 127.0.... ist eine spezielle IP-Adresse soweit ich des verstanden hab. In den Einstellungen für meine Internetverbindung hab die nicht eingetragen und konnte sie auch jetzt nicht finden. Auch die Namen dahinter kenn ich nicht. :confused:
Allmählich beschleicht mich das beschämende Gefühl auch da was falsch gemacht zu haben...

hoff weiter auf deine/eure Unterstützung. werd mitarbeiten wo ich kann... ansonsten bleibt mir wohl nur der Gang zu nem Händler

trotzdem nochmal Danke
Grüße

cosinus 19.05.2014 23:46
Dann bitte jetzt Combofix ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Fl!tsche 20.05.2014 13:42
hier das Log von ComboFix
Code:
ComboFix 14-05-19.01 - Andrea 2 20.05.2014  14:13:43.1.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.16308.14464 [GMT 2:00]
ausgeführt von:: c:\users\Andrea\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-04-20 bis 2014-05-20  ))))))))))))))))))))))))))))))
.
.
2014-05-20 12:16 . 2014-05-20 12:16        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-05-20 12:16 . 2014-05-20 12:16        --------        d-----w-        c:\users\Andrea 2\AppData\Local\temp
2014-05-20 11:54 . 2014-04-16 01:22        10651704        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CBE92FFB-431A-4D90-A68C-4036ED2D10C5}\mpengine.dll
2014-05-19 22:18 . 2014-05-19 22:18        --------        d-----w-        c:\users\Andrea\AppData\Local\Apps
2014-05-19 15:33 . 2014-05-19 15:33        --------        d-----w-        c:\users\Andrea 2\AppData\Local\Microsoft Help
2014-05-19 11:11 . 2014-04-23 09:50        1031560        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B514E2F9-9A3B-4391-8A2F-F99AB36CC946}\gapaengine.dll
2014-05-19 11:11 . 2014-04-16 01:22        10651704        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-05-19 10:35 . 2014-05-19 10:35        --------        d-----w-        c:\users\Andrea\AppData\Roaming\Apple Computer
2014-05-18 21:30 . 2010-02-01 21:21        73728        ----a-w-        c:\windows\system32\wltrynt.dll
2014-05-18 21:30 . 2013-10-10 15:04        134656        ----a-w-        c:\windows\system32\WinToolkitRunOnce.exe
2014-05-18 21:30 . 2012-09-11 12:39        1721576        ----a-w-        c:\windows\system32\wdfcoinstaller01009.dll
2014-05-18 21:30 . 2009-11-03 16:40        1919968        ----a-w-        c:\windows\system32\WdfCoInstaller01005.dll
2014-05-18 21:30 . 2010-02-01 21:21        457        ----a-w-        c:\windows\system32\vcredist_x64.bat
2014-05-18 21:30 . 2010-02-01 21:21        3161088        ----a-w-        c:\windows\system32\vcredist_x64.exe
2014-05-18 21:30 . 2013-03-18 15:51        6112864        ----a-w-        c:\windows\system32\usbaaplrc.dll
2014-05-18 21:30 . 2008-01-17 17:25        2520064        ----a-w-        c:\windows\system32\tfmessbsp.dll
2014-05-18 21:30 . 2010-07-22 02:19        431616        ----a-w-        c:\windows\system32\stcplx64.dll
2014-05-18 21:30 . 2010-07-22 02:19        209920        ----a-w-        c:\windows\system32\st646292.dll
2014-05-18 21:30 . 2010-07-22 02:19        1952256        ----a-w-        c:\windows\system32\stlang64.dll
2014-05-18 21:30 . 2009-07-14 01:45        24144        ----a-w-        c:\windows\system32\streamci.dll
2014-05-18 21:30 . 2013-10-02 00:15        1057280        ----a-w-        c:\windows\system32\rdvidcrl.dll
2014-05-18 21:28 . 2010-07-24 23:27        120320        ----a-w-        c:\windows\system32\atitmm64.dll
2014-05-18 21:27 . 2014-05-19 19:40        --------        d-----w-        c:\windows\PCHEALTH
2014-05-18 21:21 . 2014-02-01 16:05        0        ----a-w-        c:\windows\ativpsrm.bin
2014-05-18 21:12 . 2014-05-19 19:16        --------        d-----w-        C:\IDE
2014-05-18 21:12 . 2014-05-19 19:16        --------        d-----w-        C:\FRST
2014-05-18 15:38 . 2014-05-18 15:38        --------        d-----w-        C:\Intel
2014-05-18 15:35 . 2014-05-18 15:35        --------        d-----w-        c:\users\Andrea 2\AppData\Local\Diagnostics
2014-05-18 12:09 . 2014-05-18 19:17        --------        d-----w-        c:\users\Andrea 2\AppData\Local\Deployment
2014-05-18 12:09 . 2014-05-18 12:09        --------        d-----w-        c:\users\Andrea 2\AppData\Local\Apps
2014-05-18 11:58 . 2014-05-18 11:58        --------        d-----w-        c:\programdata\Dell
2014-05-18 11:58 . 2014-05-18 11:58        --------        d-----w-        c:\users\Andrea 2\AppData\Local\Dell
2014-05-18 11:43 . 2014-05-18 11:43        --------        d-----w-        c:\users\Andrea 2\AppData\Local\Broadcom
2014-05-18 11:40 . 2014-05-18 11:40        --------        d-----w-        c:\program files\WIDCOMM
2014-05-18 10:55 . 2014-05-18 10:55        --------        d-----w-        c:\program files (x86)\Cisco
2014-05-18 10:53 . 2014-05-18 11:59        --------        d-----w-        c:\program files\Dell
2014-05-18 09:03 . 2014-05-18 09:03        --------        d-----w-        c:\users\Andrea 2\AppData\Local\ESET
2014-05-18 04:34 . 2014-05-18 05:07        --------        d-----w-        c:\users\Andrea 2\AppData\Local\ElevatedDiagnostics
2014-05-18 04:01 . 2014-05-18 04:01        --------        d-sh--w-        c:\users\Andrea 2\AppData\Local\EmieUserList
2014-05-18 04:01 . 2014-05-18 04:01        --------        d-sh--w-        c:\users\Andrea 2\AppData\Local\EmieSiteList
2014-05-18 03:12 . 2014-05-18 03:14        --------        d-----w-        C:\Dell
2014-05-17 20:24 . 2014-05-19 11:24        --------        d-----w-        c:\program files\7-Zip
2014-05-17 19:53 . 2014-05-17 19:53        --------        d-----w-        c:\program files (x86)\NirSoft
2014-05-17 06:51 . 2014-05-17 06:51        --------        d-----w-        c:\users\Andrea 2\AppData\Local\Programs
2014-05-17 01:36 . 2014-05-17 01:36        --------        d-----w-        c:\program files\ESET
2014-05-17 01:27 . 2014-05-17 01:27        --------        d-----w-        c:\users\Andrea\AppData\Local\ESET
2014-05-17 00:08 . 2014-05-17 00:08        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help
2014-05-06 23:28 . 2014-05-19 11:33        --------        d-s---w-        c:\windows\system32\CompatTel
2014-05-06 15:48 . 2014-04-14 02:24        465408        ----a-w-        c:\windows\system32\aepdu.dll
2014-05-06 15:48 . 2014-04-14 02:19        424448        ----a-w-        c:\windows\system32\aeinv.dll
2014-05-05 23:59 . 2014-04-29 14:01        23547904        ----a-w-        c:\windows\system32\mshtml.dll
2014-05-05 23:59 . 2014-04-29 13:40        2724864        ----a-w-        c:\windows\system32\mshtml.tlb
2014-05-05 23:59 . 2014-04-29 12:34        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-16 20:06 . 2014-02-01 17:37        70832        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-16 20:06 . 2014-02-01 17:37        692400        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-05 16:32 . 2014-02-19 16:50        1031560        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-03-11 07:52 . 2013-06-18 20:50        133928        ----a-w-        c:\windows\system32\drivers\NisDrvWFP.sys
2014-03-06 09:31 . 2014-04-17 03:04        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll
2014-03-06 08:59 . 2014-04-17 03:04        66048        ----a-w-        c:\windows\system32\iesetup.dll
2014-03-06 08:57 . 2014-04-17 03:05        548352        ----a-w-        c:\windows\system32\vbscript.dll
2014-03-06 08:57 . 2014-04-17 03:04        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll
2014-03-06 08:53 . 2014-04-17 03:04        2767360        ----a-w-        c:\windows\system32\iertutil.dll
2014-03-06 08:40 . 2014-04-17 03:04        51200        ----a-w-        c:\windows\system32\jsproxy.dll
2014-03-06 08:39 . 2014-04-17 03:04        33792        ----a-w-        c:\windows\system32\iernonce.dll
2014-03-06 08:32 . 2014-04-17 03:05        574976        ----a-w-        c:\windows\system32\ieui.dll
2014-03-06 08:29 . 2014-04-17 03:04        139264        ----a-w-        c:\windows\system32\ieUnatt.exe
2014-03-06 08:29 . 2014-04-17 03:04        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe
2014-03-06 08:28 . 2014-04-17 03:04        752640        ----a-w-        c:\windows\system32\jscript9diag.dll
2014-03-06 08:15 . 2014-04-17 03:04        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2014-03-06 08:11 . 2014-04-17 03:04        5784064        ----a-w-        c:\windows\system32\jscript9.dll
2014-03-06 08:09 . 2014-04-17 03:04        453120        ----a-w-        c:\windows\system32\dxtmsft.dll
2014-03-06 08:03 . 2014-04-17 03:04        586240        ----a-w-        c:\windows\system32\ie4uinit.exe
2014-03-06 08:02 . 2014-04-17 03:04        61952        ----a-w-        c:\windows\SysWow64\iesetup.dll
2014-03-06 08:02 . 2014-04-17 03:05        455168        ----a-w-        c:\windows\SysWow64\vbscript.dll
2014-03-06 08:01 . 2014-04-17 03:04        51200        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll
2014-03-06 07:56 . 2014-04-17 03:04        38400        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll
2014-03-06 07:48 . 2014-04-17 03:04        195584        ----a-w-        c:\windows\system32\msrating.dll
2014-03-06 07:46 . 2014-04-17 03:04        4254720        ----a-w-        c:\windows\SysWow64\jscript9.dll
2014-03-06 07:42 . 2014-04-17 03:04        296960        ----a-w-        c:\windows\system32\dxtrans.dll
2014-03-06 07:38 . 2014-04-17 03:04        112128        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2014-03-06 07:36 . 2014-04-17 03:04        592896        ----a-w-        c:\windows\SysWow64\jscript9diag.dll
2014-03-06 07:21 . 2014-04-17 03:04        628736        ----a-w-        c:\windows\system32\msfeeds.dll
2014-03-06 07:13 . 2014-04-17 03:04        32256        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-03-06 07:11 . 2014-04-17 03:04        2043904        ----a-w-        c:\windows\system32\inetcpl.cpl
2014-03-06 06:53 . 2014-04-17 03:04        13551104        ----a-w-        c:\windows\system32\ieframe.dll
2014-03-06 06:40 . 2014-04-17 03:04        1967104        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2014-03-06 06:22 . 2014-04-17 03:04        2260480        ----a-w-        c:\windows\system32\wininet.dll
2014-03-06 05:58 . 2014-04-17 03:04        1400832        ----a-w-        c:\windows\system32\urlmon.dll
2014-03-06 05:50 . 2014-04-17 03:04        846336        ----a-w-        c:\windows\system32\ieapfltr.dll
2014-03-06 05:41 . 2014-04-17 03:04        1789440        ----a-w-        c:\windows\SysWow64\wininet.dll
2014-03-04 09:44 . 2014-04-09 21:57        362496        ----a-w-        c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-09 21:57        243712        ----a-w-        c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-09 21:57        13312        ----a-w-        c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-09 21:57        16384        ----a-w-        c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-09 21:57        1163264        ----a-w-        c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-09 21:57        14336        ----a-w-        c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-09 21:57        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-09 21:57        25600        ----a-w-        c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-09 21:57        5120        ----a-w-        c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-09 21:57        7680        ----a-w-        c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-09 21:57        2048        ----a-w-        c:\windows\SysWow64\user.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [x]
R4 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 cvusbdrv;Dell ControlVault;c:\windows\system32\Drivers\cvusbdrv.sys;c:\windows\SYSNATIVE\Drivers\cvusbdrv.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-01 20:06]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2009-07-14 415232]
"*Restore"="c:\windows\system32\rstrui.exe" [2010-11-21 296960]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-1ClickDownload - c:\program files (x86)\hdvidcodec.com\uninst.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-05-20  14:18:37
ComboFix-quarantined-files.txt  2014-05-20 12:18
.
Vor Suchlauf: 10 Verzeichnis(se), 418.041.368.576 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 417.970.012.160 Bytes frei
.
- - End Of File - - 3BCF7A11C19DAAB606DAEDADB6759D69
A36C5E4F47E84449FF07ED3517B43A31

cosinus 20.05.2014 15:00
Adware/Junkware/Toolbars entfernen


1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Fl!tsche 20.05.2014 17:17
Adw-Log:

Code:
# AdwCleaner v3.210 - Bericht erstellt am 20/05/2014 um 16:29:58
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Andrea 2 - PRECISION_M6400
# Gestartet von : C:\Users\Andrea\Desktop\adwcleaner_3.210.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gelöscht : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\dcw0gby5.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


*************************

AdwCleaner[R0].txt - [1555 octets] - [20/05/2014 16:24:08]
AdwCleaner[S0].txt - [1478 octets] - [20/05/2014 16:29:58]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [1538 octets] ##########
JRT-Log:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Andrea 2 on 20.05.2014 at 17:03:43,42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.05.2014 at 17:09:06,41
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
bei FRST kam kein "Addition.txt"-Log

nur der FRST-Log:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Andrea 2 (administrator) on PRECISION_M6400 on 20-05-2014 17:25:58
Running from C:\Users\Andrea\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-14] (Microsoft Corporation)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-21] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U5 BTHPORT; C:\Windows\System32\Drivers\BTHPORT.sys [552960 2013-10-09] (Microsoft Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 tifm21; C:\Windows\System32\drivers\tifm21.sys [319488 2009-06-19] (Texas Instruments)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-20 17:25 - 2014-05-20 17:25 - 00004004 _____ () C:\Users\Andrea\Desktop\FRST.txt
2014-05-20 17:20 - 2014-05-20 17:20 - 02067456 _____ (Farbar) C:\Users\Andrea\Desktop\FRST64.exe
2014-05-20 17:09 - 2014-05-20 17:09 - 00000628 _____ () C:\Users\Andrea 2\Desktop\JRT.txt
2014-05-20 17:03 - 2014-05-20 17:03 - 00000000 ____D () C:\Windows\ERUNT
2014-05-20 16:59 - 2014-05-20 16:59 - 01016261 _____ (Thisisu) C:\Users\Andrea\Desktop\JRT.exe
2014-05-20 16:20 - 2014-05-20 16:29 - 00000000 ____D () C:\AdwCleaner
2014-05-20 16:19 - 2014-05-20 16:19 - 01326389 _____ () C:\Users\Andrea\Desktop\adwcleaner_3.210.exe
2014-05-20 14:18 - 2014-05-20 14:18 - 00015040 _____ () C:\ComboFix.txt
2014-05-20 14:12 - 2014-05-20 14:18 - 00000000 ____D () C:\Qoobox
2014-05-20 14:12 - 2014-05-20 14:17 - 00000000 ____D () C:\Windows\erdnt
2014-05-20 14:12 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-20 14:12 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-20 14:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-20 13:51 - 2014-05-20 13:51 - 05200426 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2014-05-20 00:18 - 2014-05-20 00:18 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Apps\2.0
2014-05-19 18:10 - 2014-05-19 18:10 - 00001421 _____ () C:\Users\Andrea\Desktop\Internet Explorer.lnk
2014-05-19 17:33 - 2014-05-19 17:33 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Microsoft Help
2014-05-19 12:35 - 2014-05-19 12:35 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Apple Computer
2014-05-18 23:31 - 2014-05-19 21:46 - 00000445 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-05-18 23:31 - 2014-05-11 23:54 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_wpdcomp_01_09_00.Wdf
2014-05-18 23:31 - 2014-04-01 04:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ggsemc_01009.Wdf
2014-05-18 23:31 - 2014-04-01 04:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ggflt_01009.Wdf
2014-05-18 23:31 - 2014-04-01 04:00 - 00027760 _____ (Sony Ericsson Mobile Communications) C:\Windows\system32\Drivers\ggsemc.sys
2014-05-18 23:31 - 2014-04-01 04:00 - 00014448 _____ (Sony Ericsson Mobile Communications) C:\Windows\system32\Drivers\ggflt.sys
2014-05-18 23:31 - 2014-02-07 01:59 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2014-05-18 23:31 - 2014-02-06 21:26 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-05-18 23:31 - 2014-02-01 21:20 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_cvusbdrv_01005.Wdf
2014-05-18 23:31 - 2014-02-01 17:20 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WUDFUsbccidDriver_01_09_00.Wdf
2014-05-18 23:31 - 2014-02-01 17:19 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-05-18 23:31 - 2013-10-09 21:35 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2014-05-18 23:31 - 2013-10-09 21:34 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-05-18 23:31 - 2013-10-09 21:34 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-05-18 23:31 - 2013-10-09 20:41 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2014-05-18 23:31 - 2013-10-09 19:48 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BTHUSB.SYS
2014-05-18 23:31 - 2013-10-09 19:44 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2014-05-18 23:31 - 2013-10-09 19:44 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2014-05-18 23:31 - 2013-10-09 19:44 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2014-05-18 23:31 - 2013-10-09 19:44 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2014-05-18 23:31 - 2013-10-09 19:44 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00239320 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00239296 _____ (ESET) C:\Windows\system32\Drivers\edevmon.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00220232 _____ (ESET) C:\Windows\system32\Drivers\epfw.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00168256 _____ (ESET) C:\Windows\system32\Drivers\ehdrv.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00062136 _____ (ESET) C:\Windows\system32\Drivers\epfwwfp.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00044120 _____ (ESET) C:\Windows\system32\Drivers\EpfwLWF.sys
2014-05-18 23:31 - 2013-08-06 16:13 - 00023040 _____ (Apple Inc.) C:\Windows\system32\Drivers\netaapl64.sys
2014-05-18 23:31 - 2013-03-18 17:51 - 00054784 _____ (Apple, Inc.) C:\Windows\system32\Drivers\usbaapl64.sys
2014-05-18 23:31 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2014-05-18 23:31 - 2011-02-16 16:53 - 00014464 _____ (Western Digital Technologies) C:\Windows\system32\Drivers\wdcsam64.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00215936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00155008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpio.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00140672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msdsm.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00103808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sbp2port.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00078720 _____ (Hewlett-Packard Company) C:\Windows\system32\Drivers\HpSAMD.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00031104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msahci.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffp_sd.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpipmi.sys
2014-05-18 23:31 - 2010-07-25 02:35 - 06858240 _____ (ATI Technologies Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2014-05-18 23:31 - 2010-07-25 00:55 - 00264192 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2014-05-18 23:31 - 2010-07-25 00:54 - 00053248 _____ (ATI Technologies Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2014-05-18 23:31 - 2010-07-22 04:19 - 00515584 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt64.sys
2014-05-18 23:31 - 2010-07-15 10:47 - 00116240 _____ (ATI Technologies, Inc.) C:\Windows\system32\Drivers\AtihdW76.sys
2014-05-18 23:31 - 2010-02-01 23:21 - 00047632 _____ (CACE Technologies, Inc.) C:\Windows\system32\Drivers\npf.sys
2014-05-18 23:31 - 2010-02-01 23:20 - 03058168 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\BCMWL664.SYS
2014-05-18 23:31 - 2010-02-01 23:20 - 00022520 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\bcm42rly.sys
2014-05-18 23:31 - 2009-11-03 18:40 - 00038440 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\cvusbdrv.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00491088 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\adp94xx.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00339536 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\adpahci.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00194128 _____ (AMD Technologies Inc.) C:\Windows\system32\Drivers\amdsbs.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00182864 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\adpu320.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00097856 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\arcsas.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00087632 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\arc.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00061008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00021584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\compbatt.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00017488 _____ (CMD Technology, Inc.) C:\Windows\system32\Drivers\cmdide.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00015440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdide.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00015440 _____ (Acer Laboratories Inc.) C:\Windows\system32\Drivers\aliide.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00284736 _____ (LSI Corporation, Inc.) C:\Windows\system32\Drivers\MegaSR.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00122960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
2014-05-18 23:31 - 2009-07-14 03:48 - 00115776 _____ (LSI Corporation) C:\Windows\system32\Drivers\lsi_scsi.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00114752 _____ (LSI Corporation) C:\Windows\system32\Drivers\lsi_fc.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00106560 _____ (LSI Corporation) C:\Windows\system32\Drivers\lsi_sas.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00065600 _____ (LSI Corporation) C:\Windows\system32\Drivers\lsi_sas2.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00051264 _____ (IBM Corporation) C:\Windows\system32\Drivers\nfrd960.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00044112 _____ (Intel Corp./ICP vortex GmbH) C:\Windows\system32\Drivers\iirsp.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00035392 _____ (LSI Corporation) C:\Windows\system32\Drivers\megasas.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00020544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00016960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelide.sys
2014-05-18 23:31 - 2009-07-14 03:47 - 00530496 _____ (Emulex) C:\Windows\system32\Drivers\elxstor.sys
2014-05-18 23:31 - 2009-07-14 03:47 - 00065088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\GAGP30KX.SYS
2014-05-18 23:31 - 2009-07-14 03:47 - 00024144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crcdisk.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 01524816 _____ (QLogic Corporation) C:\Windows\system32\Drivers\ql2300.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00161872 _____ (VIA Technologies Inc.,Ltd) C:\Windows\system32\Drivers\vsmraid.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00128592 _____ (QLogic Corporation) C:\Windows\system32\Drivers\ql40xx.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00080464 _____ (Silicon Integrated Systems) C:\Windows\system32\Drivers\sisraid4.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00064592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
2014-05-18 23:31 - 2009-07-14 03:45 - 00064080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UAGP35.SYS
2014-05-18 23:31 - 2009-07-14 03:45 - 00043584 _____ (Silicon Integrated Systems Corp.) C:\Windows\system32\Drivers\sisraid2.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00024656 _____ (Promise Technology) C:\Windows\system32\Drivers\stexstor.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00021056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wd.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00017488 _____ (VIA Technologies, Inc.) C:\Windows\system32\Drivers\viaide.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00012496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00012352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pciide.sys
2014-05-18 23:31 - 2009-07-14 03:19 - 00286720 _____ (Brother Industries Ltd.) C:\Windows\system32\Drivers\BrSerId.sys
2014-05-18 23:31 - 2009-07-14 02:38 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbprint.sys
2014-05-18 23:31 - 2009-07-14 02:17 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpbus.sys
2014-05-18 23:31 - 2009-07-14 02:07 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthpan.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rfcomm.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidbth.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00072832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ohci1394.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthmodem.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\1394bus.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidir.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\circlass.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthenum.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\umpass.sys
2014-05-18 23:31 - 2009-07-14 02:02 - 00027776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wacompen.sys
2014-05-18 23:31 - 2009-07-14 02:02 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\MTConfig.sys
2014-05-18 23:31 - 2009-07-14 02:01 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sfloppy.sys
2014-05-18 23:31 - 2009-07-14 02:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffdisk.sys
2014-05-18 23:31 - 2009-07-14 02:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffp_mmc.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\parport.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00094208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\serial.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fdc.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\flpydisk.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\serenum.sys
2014-05-18 23:31 - 2009-07-14 01:35 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\blbdrive.sys
2014-05-18 23:31 - 2009-07-14 01:31 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidbatt.sys
2014-05-18 23:31 - 2009-07-14 01:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\errdev.sys
2014-05-18 23:31 - 2009-07-14 01:19 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdk8.sys
2014-05-18 23:31 - 2009-07-14 01:19 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdppm.sys
2014-05-18 23:31 - 2009-07-14 01:19 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\processr.sys
2014-05-18 23:31 - 2009-07-01 12:46 - 00132648 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwavdt.sys
2014-05-18 23:31 - 2009-07-01 12:46 - 00098344 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwaudio.sys
2014-05-18 23:31 - 2009-07-01 12:46 - 00021160 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwrchid.sys
2014-05-18 23:31 - 2009-06-19 17:44 - 00319488 _____ (Texas Instruments) C:\Windows\system32\Drivers\tifm21.sys
2014-05-18 23:31 - 2009-06-10 23:00 - 00017463 _____ () C:\Windows\system32\Drivers\etc\services
2014-05-18 23:31 - 2009-06-10 23:00 - 00003683 _____ () C:\Windows\system32\Drivers\etc\lmhosts.sam
2014-05-18 23:31 - 2009-06-10 23:00 - 00001358 _____ () C:\Windows\system32\Drivers\etc\protocol
2014-05-18 23:31 - 2009-06-10 23:00 - 00000407 _____ () C:\Windows\system32\Drivers\etc\networks
2014-05-18 23:31 - 2009-06-10 22:41 - 00047104 _____ (Brother Industries Ltd.) C:\Windows\system32\Drivers\BrSerWdm.sys
2014-05-18 23:31 - 2009-06-10 22:41 - 00018432 _____ (Brother Industries, Ltd.) C:\Windows\system32\Drivers\BrFiltLo.sys
2014-05-18 23:31 - 2009-06-10 22:41 - 00014976 _____ (Brother Industries Ltd.) C:\Windows\system32\Drivers\BrUsbMdm.sys
2014-05-18 23:31 - 2009-06-10 22:41 - 00014720 _____ (Brother Industries Ltd.) C:\Windows\system32\Drivers\BrUsbSer.sys
2014-05-18 23:31 - 2009-06-10 22:41 - 00008704 _____ (Brother Industries, Ltd.) C:\Windows\system32\Drivers\BrFiltUp.sys
2014-05-18 23:31 - 2009-06-10 22:37 - 00023040 _____ (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) C:\Windows\system32\Drivers\secdrv.sys
2014-05-18 23:31 - 2009-06-10 22:34 - 03286016 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\evbda.sys
2014-05-18 23:31 - 2009-06-10 22:34 - 00468480 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\bxvbda.sys
2014-05-18 23:31 - 2009-06-10 22:34 - 00270848 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\b57nd60a.sys
2014-05-18 23:31 - 2009-06-10 22:31 - 00031232 _____ (Hauppauge Computer Works, Inc.) C:\Windows\system32\Drivers\hcw85cir.sys
2014-05-18 23:31 - 2009-04-07 15:33 - 00035104 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwl2cap.sys
2014-05-18 23:31 - 2008-06-04 15:14 - 00032240 _____ (Dell Inc) C:\Windows\system32\Drivers\PBADRV.SYS
2014-05-18 23:30 - 2014-02-01 17:01 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
2014-05-18 23:30 - 2014-02-01 17:01 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
2014-05-18 23:30 - 2013-10-10 17:04 - 00134656 _____ (Legolash2o) C:\Windows\system32\WinToolkitRunOnce.exe
2014-05-18 23:30 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-05-18 23:30 - 2013-03-18 17:51 - 06112864 _____ (Apple, Inc.) C:\Windows\system32\usbaaplrc.dll
2014-05-18 23:30 - 2012-09-11 14:39 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\wdfcoinstaller01009.dll
2014-05-18 23:30 - 2010-11-21 05:58 - 00018432 _____ () C:\Windows\system32\umstartup.etl
2014-05-18 23:30 - 2010-11-21 05:40 - 00046080 _____ () C:\Windows\system32\umstartup000.etl
2014-05-18 23:30 - 2010-07-22 04:19 - 01952256 _____ (IDT, Inc.) C:\Windows\system32\stlang64.dll
2014-05-18 23:30 - 2010-07-22 04:19 - 00431616 _____ (IDT, Inc.) C:\Windows\system32\stcplx64.dll
2014-05-18 23:30 - 2010-07-22 04:19 - 00209920 _____ (IDT, Inc.) C:\Windows\system32\st646292.dll
2014-05-18 23:30 - 2010-02-01 23:21 - 03161088 _____ (Microsoft Corporation) C:\Windows\system32\vcredist_x64.exe
2014-05-18 23:30 - 2010-02-01 23:21 - 00073728 _____ (Broadcom Corporation) C:\Windows\system32\wltrynt.dll
2014-05-18 23:30 - 2010-02-01 23:21 - 00000457 _____ () C:\Windows\system32\vcredist_x64.bat
2014-05-18 23:30 - 2009-11-03 18:40 - 01919968 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01005.dll
2014-05-18 23:30 - 2009-07-14 03:45 - 00024144 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
2014-05-18 23:30 - 2009-06-10 22:31 - 00001988 _____ () C:\Windows\system32\ticrf.rat
2014-05-18 23:30 - 2008-01-17 19:25 - 02520064 _____ (UPEK, Inc.) C:\Windows\system32\tfmessbsp.dll
2014-05-18 23:29 - 2014-05-20 17:16 - 01527552 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-18 23:29 - 2014-05-20 17:16 - 00661436 _____ () C:\Windows\system32\perfh007.dat
2014-05-18 23:29 - 2014-05-20 17:16 - 00141416 _____ () C:\Windows\system32\perfc007.dat
2014-05-18 23:29 - 2014-05-20 13:43 - 00412616 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-18 23:29 - 2014-05-17 02:08 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-18 23:29 - 2014-03-31 09:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-05-18 23:29 - 2013-10-14 19:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2014-05-18 23:29 - 2013-09-11 20:39 - 00855664 _____ (Microsoft Corporation) C:\Windows\system32\msvcr110_clr0400.dll
2014-05-18 23:29 - 2013-09-11 20:39 - 00614000 _____ (Microsoft Corporation) C:\Windows\system32\msvcp110_clr0400.dll
2014-05-18 23:29 - 2013-09-11 20:39 - 00018000 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100_clr0400.dll
2014-05-18 23:29 - 2011-04-12 09:43 - 00295922 _____ () C:\Windows\system32\perfi007.dat
2014-05-18 23:29 - 2011-04-12 09:43 - 00038104 _____ () C:\Windows\system32\perfd007.dat
2014-05-18 23:29 - 2011-02-20 06:51 - 00608080 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll
2014-05-18 23:29 - 2011-02-19 08:52 - 00829264 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100.dll
2014-05-18 23:29 - 2010-11-21 05:28 - 00029815 _____ () C:\Windows\system32\InstallPackage_ETW.Log
2014-05-18 23:29 - 2010-11-21 05:26 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2014-05-18 23:29 - 2010-11-21 05:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\fsquirt.exe
2014-05-18 23:29 - 2010-11-21 04:52 - 00000050 _____ () C:\Windows\system32\Local_LLU.log
2014-05-18 23:29 - 2010-11-21 04:52 - 00000040 _____ () C:\Windows\system32\Network_LLU.log
2014-05-18 23:29 - 2010-11-21 04:52 - 00000015 _____ () C:\Windows\system32\LocalGroupAdminAdd.log
2014-05-18 23:29 - 2010-07-25 00:43 - 00055296 _____ (AMD) C:\Windows\system32\coinst.dll
2014-05-18 23:29 - 2010-07-22 04:19 - 11941376 _____ (IDT, Inc.) C:\Windows\system32\idtsg64.cpl
2014-05-18 23:29 - 2010-03-22 16:21 - 00283016 _____ () C:\Windows\system32\bipbsp.dll
2014-05-18 23:29 - 2010-03-22 16:16 - 00105864 _____ (Broadcom Corporation) C:\Windows\system32\lms.dll
2014-05-18 23:29 - 2010-03-22 16:15 - 00305544 _____ (Broadcom Corporation) C:\Windows\system32\bipdll.dll
2014-05-18 23:29 - 2010-03-22 16:15 - 00018320 _____ (Broadcom Corporation) C:\Windows\system32\CVUsrIfc.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 08075776 _____ (Dell Inc.) C:\Windows\system32\BCMWLCPL.CPL
2014-05-18 23:29 - 2010-02-01 23:20 - 04750848 _____ (Dell Inc.) C:\Windows\system32\bcmttls.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 01089024 _____ (Dell Inc.) C:\Windows\system32\BCMLogon.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 00095472 _____ (Broadcom Corporation) C:\Windows\system32\bcmwlcoi.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 00060928 _____ (Broadcom Corporation) C:\Windows\system32\bcmwlrmt.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 00006656 _____ () C:\Windows\system32\bcmwlrc.dll
2014-05-18 23:29 - 2010-02-01 23:19 - 03891200 _____ (Broadcom Corporation) C:\Windows\system32\bcmihvsrv64.dll
2014-05-18 23:29 - 2010-02-01 23:19 - 03555840 _____ (Broadcom Corporation) C:\Windows\system32\bcmihvui64.dll
2014-05-18 23:29 - 2009-11-04 12:02 - 00440208 _____ () C:\Windows\system32\brcmbsp.dll
2014-05-18 23:29 - 2009-07-14 06:57 - 00001244 _____ () C:\Windows\system32\migwiz.lnk
2014-05-18 23:29 - 2009-07-14 03:40 - 00019456 _____ (Brother Industries Ltd.) C:\Windows\system32\brcoinst.dll
2014-05-18 23:29 - 2009-07-14 03:40 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\CIRCoInst.dll
2014-05-18 23:29 - 2009-06-10 22:53 - 00215943 _____ () C:\Windows\system32\dssec.dat
2014-05-18 23:29 - 2009-06-10 22:50 - 00000741 _____ () C:\Windows\system32\NOISE.DAT
2014-05-18 23:29 - 2009-06-10 22:47 - 11967524 _____ () C:\Windows\system32\korwbrkr.lex
2014-05-18 23:29 - 2009-06-10 22:47 - 00001696 _____ () C:\Windows\system32\NOISE.CHT
2014-05-18 23:29 - 2009-06-10 22:47 - 00001696 _____ () C:\Windows\system32\NOISE.CHS
2014-05-18 23:29 - 2009-06-10 22:47 - 00001486 _____ () C:\Windows\system32\noise.kor
2014-05-18 23:29 - 2009-06-10 22:47 - 00000697 _____ () C:\Windows\system32\NOISE.THA
2014-05-18 23:29 - 2009-06-10 22:31 - 00008798 _____ () C:\Windows\system32\icrav03.rat
2014-05-18 23:29 - 2008-12-09 19:46 - 00239104 _____ () C:\Windows\system32\bioapi_mds300.dll
2014-05-18 23:29 - 2008-12-09 19:46 - 00155136 _____ () C:\Windows\system32\bioapi100.dll
2014-05-18 23:29 - 2008-06-04 15:14 - 00081904 _____ () C:\Windows\system32\pbadrvdll.dll
2014-05-18 23:28 - 2014-05-20 17:19 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-18 23:28 - 2014-05-20 17:19 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-18 23:28 - 2013-09-11 20:39 - 00030312 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2014-05-18 23:28 - 2010-07-25 02:20 - 20017152 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll
2014-05-18 23:28 - 2010-07-25 01:32 - 00057816 _____ () C:\Windows\system32\atiapfxx.blb
2014-05-18 23:28 - 2010-07-25 01:31 - 00143360 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2014-05-18 23:28 - 2010-07-25 01:29 - 00458752 _____ (AMD) C:\Windows\system32\atieclxx.exe
2014-05-18 23:28 - 2010-07-25 01:29 - 00446464 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\ATIDEMGX.dll
2014-05-18 23:28 - 2010-07-25 01:28 - 00203264 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2014-05-18 23:28 - 2010-07-25 01:27 - 00421376 _____ (ATI Technologies, Inc.) C:\Windows\system32\atipdl64.dll
2014-05-18 23:28 - 2010-07-25 01:27 - 00120320 _____ (AMD) C:\Windows\system32\atitmm64.dll
2014-05-18 23:28 - 2010-07-25 01:27 - 00059392 _____ (ATI Technologies, Inc.) C:\Windows\system32\atiedu64.dll
2014-05-18 23:28 - 2010-07-25 01:27 - 00012288 _____ (AMD) C:\Windows\system32\atimuixx.dll
2014-05-18 23:28 - 2010-07-25 01:02 - 04930560 _____ (ATI Technologies Inc. ) C:\Windows\system32\atiumd64.dll
2014-05-18 23:28 - 2010-07-25 00:56 - 00336384 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2014-05-18 23:28 - 2010-07-25 00:55 - 00018432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll
2014-05-18 23:28 - 2010-07-25 00:55 - 00014848 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll
2014-05-18 23:28 - 2010-07-25 00:55 - 00012800 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2014-05-18 23:28 - 2010-07-25 00:54 - 00030208 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll
2014-05-18 23:28 - 2010-07-25 00:41 - 05265408 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll
2014-05-18 23:28 - 2010-07-25 00:41 - 00043008 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll
2014-05-18 23:28 - 2010-07-25 00:41 - 00039936 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll
2014-05-18 23:28 - 2010-07-25 00:15 - 02752512 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll
2014-05-18 23:28 - 2010-07-25 00:13 - 00534960 _____ () C:\Windows\system32\atiumd6a.cap
2014-05-18 23:28 - 2010-07-24 23:59 - 00054272 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll
2014-05-18 23:28 - 2010-07-24 23:59 - 00054272 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll
2014-05-18 23:28 - 2010-06-02 19:28 - 00002189 _____ () C:\Windows\system32\atipblag.dat
2014-05-18 23:28 - 2010-04-06 15:54 - 00203336 _____ () C:\Windows\system32\atiicdxx.dat
2014-05-18 23:28 - 2010-01-27 04:30 - 00162816 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAC64.dll
2014-05-18 23:28 - 2009-10-10 02:45 - 00442368 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTEC64.dll
2014-05-18 23:28 - 2009-05-11 19:35 - 00118784 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atibtmon.exe
2014-05-18 23:28 - 2009-03-03 03:58 - 00068608 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAR64.dll
2014-05-18 23:28 - 2009-02-18 15:55 - 00332288 _____ () C:\Windows\system32\ATIODE.exe
2014-05-18 23:28 - 2009-02-03 18:52 - 00051200 _____ () C:\Windows\system32\ATIODCLI.exe
2014-05-18 23:27 - 2014-05-19 21:40 - 00000000 ____D () C:\Windows\PCHEALTH
2014-05-18 23:27 - 2014-05-18 05:58 - 00328672 _____ () C:\Windows\Minidump\051814-16629-01.dmp
2014-05-18 23:27 - 2014-05-17 17:26 - 00328672 _____ () C:\Windows\Minidump\051714-16052-01.dmp
2014-05-18 23:27 - 2014-05-17 04:38 - 00328672 _____ () C:\Windows\Minidump\051714-24367-01.dmp
2014-05-18 23:27 - 2014-05-11 23:50 - 00328672 _____ () C:\Windows\Minidump\051114-18361-01.dmp
2014-05-18 23:27 - 2014-04-29 16:06 - 00884960 _____ () C:\Windows\Minidump\042914-13868-01.dmp
2014-05-18 23:27 - 2014-04-09 02:33 - 00328672 _____ () C:\Windows\Minidump\040914-14461-01.dmp
2014-05-18 23:27 - 2014-04-06 20:14 - 00328672 _____ () C:\Windows\Minidump\040614-14976-01.dmp
2014-05-18 23:27 - 2014-04-04 18:59 - 00328672 _____ () C:\Windows\Minidump\040414-15163-01.dmp
2014-05-18 23:27 - 2014-03-22 23:18 - 00374088 _____ () C:\Windows\Minidump\032214-16161-01.dmp
2014-05-18 23:27 - 2014-02-16 02:05 - 00328672 _____ () C:\Windows\Minidump\021614-14804-01.dmp
2014-05-18 23:27 - 2014-02-15 14:32 - 01702232 _____ () C:\Windows\Minidump\021514-21013-01.dmp
2014-05-18 23:27 - 2014-02-09 16:46 - 00328672 _____ () C:\Windows\Minidump\020914-17082-01.dmp
2014-05-18 23:27 - 2014-02-08 19:14 - 00328672 _____ () C:\Windows\Minidump\020814-14430-01.dmp
2014-05-18 23:21 - 2014-05-20 17:18 - 02038558 _____ () C:\Windows\WindowsUpdate.log
2014-05-18 23:21 - 2014-05-20 17:12 - 00020881 _____ () C:\Windows\setupact.log
2014-05-18 23:21 - 2014-05-20 16:31 - 00034810 _____ () C:\Windows\PFRO.log
2014-05-18 23:21 - 2014-05-20 14:16 - 00000215 _____ () C:\Windows\system.ini
2014-05-18 23:21 - 2014-05-18 19:38 - 00000658 _____ () C:\Windows\TIPCI.log
2014-05-18 23:21 - 2014-05-18 13:38 - 00009752 _____ () C:\Windows\DPINST.LOG
2014-05-18 23:21 - 2014-05-18 05:58 - 518897157 _____ () C:\Windows\MEMORY.DMP
2014-05-18 23:21 - 2014-05-17 02:31 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-05-18 23:21 - 2014-04-09 19:26 - 00000000 ___HT () C:\Windows\wusa.lock
2014-05-18 23:21 - 2014-02-14 21:32 - 00000478 _____ () C:\Windows\win.ini
2014-05-18 23:21 - 2014-02-02 20:43 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-18 23:21 - 2014-02-01 18:05 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-05-18 23:21 - 2010-07-19 05:55 - 00021591 _____ () C:\Windows\atiogl.xml
2014-05-18 23:21 - 2009-07-14 06:54 - 00000749 ___RH () C:\Windows\WindowsShell.Manifest
2014-05-18 23:21 - 2009-06-10 22:36 - 00001405 _____ () C:\Windows\msdfmap.ini
2014-05-18 23:21 - 2009-06-10 22:31 - 00048201 _____ () C:\Windows\Starter.xml
2014-05-18 23:21 - 2009-06-10 22:30 - 00048265 _____ () C:\Windows\HomePremium.xml
2014-05-18 23:12 - 2014-05-20 17:25 - 00000000 ____D () C:\FRST
2014-05-18 23:12 - 2014-05-19 21:16 - 00000000 ____D () C:\IDE
2014-05-18 19:32 - 2014-05-18 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEC Electronics
2014-05-18 17:38 - 2014-05-18 17:38 - 00000000 ____D () C:\Intel
2014-05-18 14:09 - 2014-05-18 21:17 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Deployment
2014-05-18 14:09 - 2014-05-18 14:09 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Apps\2.0
2014-05-18 13:58 - 2014-05-18 13:58 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Dell
2014-05-18 13:58 - 2014-05-18 13:58 - 00000000 ____D () C:\ProgramData\Dell
2014-05-18 13:43 - 2014-05-18 13:43 - 00000000 ____D () C:\Users\Andrea 2\Documents\Bluetooth-Exchange-Ordner
2014-05-18 13:43 - 2014-05-18 13:43 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Broadcom
2014-05-18 13:40 - 2014-05-18 13:40 - 00000000 ____D () C:\Program Files\WIDCOMM
2014-05-18 12:55 - 2014-05-18 12:55 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-18 12:53 - 2014-05-19 13:24 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DW WLAN
2014-05-18 12:53 - 2014-05-18 13:59 - 00000000 ____D () C:\Program Files\Dell
2014-05-18 11:03 - 2014-05-18 11:03 - 00000000 ____D () C:\Users\Andrea 2\AppData\Roaming\ESET
2014-05-18 11:03 - 2014-05-18 11:03 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\ESET
2014-05-18 06:01 - 2014-05-18 06:01 - 00000000 __SHD () C:\Users\Andrea 2\AppData\Local\EmieUserList
2014-05-18 06:01 - 2014-05-18 06:01 - 00000000 __SHD () C:\Users\Andrea 2\AppData\Local\EmieSiteList
2014-05-18 05:12 - 2014-05-18 05:14 - 00000000 ____D () C:\Dell
2014-05-18 03:27 - 2014-05-19 13:24 - 00000000 ____D () C:\Users\Andrea\Desktop\DriverView
2014-05-17 22:24 - 2014-05-19 13:24 - 00000000 ____D () C:\Program Files\7-Zip
2014-05-17 21:53 - 2014-05-17 21:53 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-05-17 07:29 - 2014-05-17 07:33 - 00023735 _____ () C:\Users\Andrea\Desktop\Eset Scan 17-05-14.txt
2014-05-17 07:12 - 2014-05-17 04:20 - 00050935 _____ () C:\Users\Andrea\Documents\ndl19844.dat
2014-05-17 05:44 - 2014-05-17 05:44 - 00001191 _____ () C:\Users\Andrea\Desktop\Gmer.txt
2014-05-17 05:26 - 2014-05-17 05:27 - 00027345 _____ () C:\Users\Andrea\Desktop\FRSTold.txt
2014-05-17 05:26 - 2014-05-17 05:27 - 00026097 _____ () C:\Users\Andrea\Desktop\Additionold.txt
2014-05-17 05:21 - 2014-05-17 05:21 - 00000478 _____ () C:\Users\Andrea\Desktop\defogger_disable.log
2014-05-17 05:21 - 2014-05-17 05:21 - 00000000 _____ () C:\Users\Andrea 2\defogger_reenable
2014-05-17 03:36 - 2014-05-19 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\Program Files\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Local\ESET
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-10 22:25 - 2014-05-10 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 02:24 - 2014-05-10 02:25 - 00000000 ____D () C:\Users\Andrea\Desktop\Gruber
2014-05-07 01:28 - 2014-05-19 13:33 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 17:48 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 17:48 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 01:59 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 01:59 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 01:59 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 01:59 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-20 14:12 - 2014-04-20 14:12 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Adobe

==================== One Month Modified Files and Folders =======

2014-05-20 17:26 - 2014-05-20 17:25 - 00004004 _____ () C:\Users\Andrea\Desktop\FRST.txt
2014-05-20 17:25 - 2014-05-18 23:12 - 00000000 ____D () C:\FRST
2014-05-20 17:20 - 2014-05-20 17:20 - 02067456 _____ (Farbar) C:\Users\Andrea\Desktop\FRST64.exe
2014-05-20 17:19 - 2014-05-18 23:28 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-20 17:19 - 2014-05-18 23:28 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-20 17:18 - 2014-05-18 23:21 - 02038558 _____ () C:\Windows\WindowsUpdate.log
2014-05-20 17:16 - 2014-05-18 23:29 - 01527552 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-20 17:16 - 2014-05-18 23:29 - 00661436 _____ () C:\Windows\system32\perfh007.dat
2014-05-20 17:16 - 2014-05-18 23:29 - 00141416 _____ () C:\Windows\system32\perfc007.dat
2014-05-20 17:12 - 2014-05-18 23:21 - 00020881 _____ () C:\Windows\setupact.log
2014-05-20 17:12 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-20 17:09 - 2014-05-20 17:09 - 00000628 _____ () C:\Users\Andrea 2\Desktop\JRT.txt
2014-05-20 17:06 - 2014-02-01 19:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-20 17:03 - 2014-05-20 17:03 - 00000000 ____D () C:\Windows\ERUNT
2014-05-20 16:59 - 2014-05-20 16:59 - 01016261 _____ (Thisisu) C:\Users\Andrea\Desktop\JRT.exe
2014-05-20 16:31 - 2014-05-18 23:21 - 00034810 _____ () C:\Windows\PFRO.log
2014-05-20 16:29 - 2014-05-20 16:20 - 00000000 ____D () C:\AdwCleaner
2014-05-20 16:19 - 2014-05-20 16:19 - 01326389 _____ () C:\Users\Andrea\Desktop\adwcleaner_3.210.exe
2014-05-20 14:18 - 2014-05-20 14:18 - 00015040 _____ () C:\ComboFix.txt
2014-05-20 14:18 - 2014-05-20 14:12 - 00000000 ____D () C:\Qoobox
2014-05-20 14:17 - 2014-05-20 14:12 - 00000000 ____D () C:\Windows\erdnt
2014-05-20 14:16 - 2014-05-18 23:21 - 00000215 _____ () C:\Windows\system.ini
2014-05-20 14:07 - 2014-04-09 19:19 - 00000000 ____D () C:\Users\Andrea 2
2014-05-20 13:51 - 2014-05-20 13:51 - 05200426 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2014-05-20 13:43 - 2014-05-18 23:29 - 00412616 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-20 01:15 - 2014-02-01 18:05 - 00106808 _____ () C:\Users\Andrea\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-20 00:18 - 2014-05-20 00:18 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Apps\2.0
2014-05-19 21:48 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-19 21:46 - 2014-05-18 23:31 - 00000445 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-05-19 21:42 - 2014-02-08 19:14 - 00000000 ____D () C:\Windows\Minidump
2014-05-19 21:42 - 2011-04-12 09:54 - 00000000 ____D () C:\Windows\ShellNew
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\hr-HR
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\he-IL
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\et-EE
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\bg-BG
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\ar-SA
2014-05-19 21:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help
2014-05-19 21:40 - 2014-05-18 23:27 - 00000000 ____D () C:\Windows\PCHEALTH
2014-05-19 21:16 - 2014-05-18 23:12 - 00000000 ____D () C:\IDE
2014-05-19 18:10 - 2014-05-19 18:10 - 00001421 _____ () C:\Users\Andrea\Desktop\Internet Explorer.lnk
2014-05-19 17:39 - 2014-02-01 19:13 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-19 17:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-05-19 17:33 - 2014-05-19 17:33 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Microsoft Help
2014-05-19 13:33 - 2014-05-07 01:28 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-19 13:33 - 2014-04-09 19:20 - 00000000 ___RD () C:\Users\Andrea 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 13:33 - 2014-04-09 19:20 - 00000000 ___RD () C:\Users\Andrea 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 13:33 - 2014-02-27 19:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-05-19 13:33 - 2014-02-27 19:36 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-05-19 13:33 - 2014-02-27 19:36 - 00000000 ____D () C:\Program Files\iTunes
2014-05-19 13:33 - 2014-02-27 19:36 - 00000000 ____D () C:\Program Files\iPod
2014-05-19 13:33 - 2014-02-27 19:36 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-05-19 13:33 - 2014-02-06 20:54 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-05-19 13:33 - 2014-02-06 20:54 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-05-19 13:33 - 2014-02-06 20:54 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-05-19 13:33 - 2014-02-06 20:53 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-05-19 13:33 - 2014-02-06 20:53 - 00000000 ____D () C:\Program Files\Bonjour
2014-05-19 13:33 - 2014-02-06 20:53 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-05-19 13:33 - 2014-02-01 19:55 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-05-19 13:33 - 2014-02-01 19:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-05-19 13:33 - 2014-02-01 19:49 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-05-19 13:33 - 2014-02-01 19:37 - 00000000 ____D () C:\Windows\system32\Macromed
2014-05-19 13:33 - 2014-02-01 18:01 - 00000000 ____D () C:\Windows\system32\SRSLabs
2014-05-19 13:33 - 2014-02-01 18:00 - 00000000 ____D () C:\Windows\tiinst
2014-05-19 13:33 - 2014-02-01 18:00 - 00000000 ____D () C:\Program Files\IDT
2014-05-19 13:33 - 2014-02-01 17:56 - 00000000 ____D () C:\Program Files\WinRAR
2014-05-19 13:33 - 2014-02-01 17:49 - 00000000 ___RD () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 13:33 - 2014-02-01 17:49 - 00000000 ___RD () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\security
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-05-19 13:30 - 2014-02-01 17:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-19 13:30 - 2014-02-01 17:58 - 00000000 ____D () C:\Program Files (x86)\NEC Electronics
2014-05-19 13:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-05-19 13:24 - 2014-05-18 12:53 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DW WLAN
2014-05-19 13:24 - 2014-05-18 03:27 - 00000000 ____D () C:\Users\Andrea\Desktop\DriverView
2014-05-19 13:24 - 2014-05-17 22:24 - 00000000 ____D () C:\Program Files\7-Zip
2014-05-19 13:24 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2014-05-19 13:06 - 2014-02-15 10:02 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-05-19 12:35 - 2014-05-19 12:35 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Apple Computer
2014-05-19 12:35 - 2014-02-01 17:49 - 00000000 ____D () C:\Users\Andrea
2014-05-19 12:34 - 2014-02-06 20:53 - 00000000 ____D () C:\ProgramData\Apple
2014-05-18 21:17 - 2014-05-18 14:09 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Deployment
2014-05-18 19:38 - 2014-05-18 23:21 - 00000658 _____ () C:\Windows\TIPCI.log
2014-05-18 19:32 - 2014-05-18 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEC Electronics
2014-05-18 17:38 - 2014-05-18 17:38 - 00000000 ____D () C:\Intel
2014-05-18 14:09 - 2014-05-18 14:09 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Apps\2.0
2014-05-18 13:59 - 2014-05-18 12:53 - 00000000 ____D () C:\Program Files\Dell
2014-05-18 13:58 - 2014-05-18 13:58 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Dell
2014-05-18 13:58 - 2014-05-18 13:58 - 00000000 ____D () C:\ProgramData\Dell
2014-05-18 13:43 - 2014-05-18 13:43 - 00000000 ____D () C:\Users\Andrea 2\Documents\Bluetooth-Exchange-Ordner
2014-05-18 13:43 - 2014-05-18 13:43 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Broadcom
2014-05-18 13:40 - 2014-05-18 13:40 - 00000000 ____D () C:\Program Files\WIDCOMM
2014-05-18 13:38 - 2014-05-18 23:21 - 00009752 _____ () C:\Windows\DPINST.LOG
2014-05-18 12:55 - 2014-05-18 12:55 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-18 11:03 - 2014-05-18 11:03 - 00000000 ____D () C:\Users\Andrea 2\AppData\Roaming\ESET
2014-05-18 11:03 - 2014-05-18 11:03 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\ESET
2014-05-18 06:01 - 2014-05-18 06:01 - 00000000 __SHD () C:\Users\Andrea 2\AppData\Local\EmieUserList
2014-05-18 06:01 - 2014-05-18 06:01 - 00000000 __SHD () C:\Users\Andrea 2\AppData\Local\EmieSiteList
2014-05-18 05:58 - 2014-05-18 23:27 - 00328672 _____ () C:\Windows\Minidump\051814-16629-01.dmp
2014-05-18 05:58 - 2014-05-18 23:21 - 518897157 _____ () C:\Windows\MEMORY.DMP
2014-05-18 05:14 - 2014-05-18 05:12 - 00000000 ____D () C:\Dell
2014-05-17 21:53 - 2014-05-17 21:53 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-05-17 17:26 - 2014-05-18 23:27 - 00328672 _____ () C:\Windows\Minidump\051714-16052-01.dmp
2014-05-17 07:33 - 2014-05-17 07:29 - 00023735 _____ () C:\Users\Andrea\Desktop\Eset Scan 17-05-14.txt
2014-05-17 05:44 - 2014-05-17 05:44 - 00001191 _____ () C:\Users\Andrea\Desktop\Gmer.txt
2014-05-17 05:27 - 2014-05-17 05:26 - 00027345 _____ () C:\Users\Andrea\Desktop\FRSTold.txt
2014-05-17 05:27 - 2014-05-17 05:26 - 00026097 _____ () C:\Users\Andrea\Desktop\Additionold.txt
2014-05-17 05:21 - 2014-05-17 05:21 - 00000478 _____ () C:\Users\Andrea\Desktop\defogger_disable.log
2014-05-17 05:21 - 2014-05-17 05:21 - 00000000 _____ () C:\Users\Andrea 2\defogger_reenable
2014-05-17 04:38 - 2014-05-18 23:27 - 00328672 _____ () C:\Windows\Minidump\051714-24367-01.dmp
2014-05-17 04:20 - 2014-05-17 07:12 - 00050935 _____ () C:\Users\Andrea\Documents\ndl19844.dat
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\Program Files\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Local\ESET
2014-05-17 02:31 - 2014-05-18 23:21 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-05-17 02:09 - 2014-02-01 19:22 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-17 02:08 - 2014-05-18 23:29 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-16 22:06 - 2014-02-01 19:37 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-16 22:06 - 2014-02-01 19:37 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-16 22:06 - 2014-02-01 19:37 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-11 23:54 - 2014-05-18 23:31 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_wpdcomp_01_09_00.Wdf
2014-05-11 23:50 - 2014-05-18 23:27 - 00328672 _____ () C:\Windows\Minidump\051114-18361-01.dmp
2014-05-11 23:49 - 2014-02-01 19:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-10 22:25 - 2014-05-10 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 02:25 - 2014-05-10 02:24 - 00000000 ____D () C:\Users\Andrea\Desktop\Gruber
2014-04-30 19:22 - 2014-02-17 18:13 - 00000000 ____D () C:\Users\Andrea\Desktop\Musiik
2014-04-29 16:06 - 2014-05-18 23:27 - 00884960 _____ () C:\Windows\Minidump\042914-13868-01.dmp
2014-04-29 16:01 - 2014-05-06 01:59 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-06 01:59 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-06 01:59 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-06 01:59 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-20 21:19 - 2014-04-13 21:08 - 00000000 ____D () C:\Users\Andrea\Desktop\Neuer Ordner
2014-04-20 14:12 - 2014-04-20 14:12 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Adobe

Some content of TEMP:
====================
C:\Users\Andrea 2\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-20 04:12

==================== End Of Log ============================
--- --- ---

--- --- ---


bei dem letzten Post stimmt was nicht.
dieses "FRST Logfile" hab ich nicht geschrieben :confused:

cosinus 20.05.2014 22:24
Zitat:
bei dem letzten Post stimmt was nicht.
dieses "FRST Logfile" hab ich nicht geschrieben
Hab echt keinen Plan was du damit meinst :glaskugel:
Mach ein neues Log mit addtions.txt => Haken setzen bei addition.txt dann auf Scan klicken

http://saved.im/mtg0mjy4yjlu/2014-04...ryscantool.png

Fl!tsche 21.05.2014 21:40
Entschuldige das ich jetzt erst antworte!!!!

hier die neuen Logs von FRST


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014
Ran by Andrea 2 (administrator) on PRECISION_M6400 on 21-05-2014 22:17:24
Running from C:\Users\Andrea 2\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x540D1C111C75CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U5 BTHPORT; C:\Windows\System32\Drivers\BTHPORT.sys [552960 2013-10-09] (Microsoft Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 tifm21; C:\Windows\System32\drivers\tifm21.sys [319488 2009-06-19] (Texas Instruments)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-21 22:17 - 2014-05-21 22:17 - 00003984 _____ () C:\Users\Andrea 2\Desktop\FRST.txt
2014-05-21 22:14 - 2014-05-21 22:14 - 02067456 _____ (Farbar) C:\Users\Andrea 2\Desktop\FRST64.exe
2014-05-20 19:48 - 2014-05-20 19:48 - 00001989 _____ () C:\Users\Andrea\Desktop\nt.search-ms
2014-05-20 19:31 - 2014-05-20 19:31 - 00328672 _____ () C:\Windows\Minidump\052014-19968-01.dmp
2014-05-20 17:25 - 2014-05-20 17:26 - 00053330 _____ () C:\Users\Andrea\Desktop\FRST.txt
2014-05-20 17:20 - 2014-05-20 17:20 - 02067456 _____ (Farbar) C:\Users\Andrea\Desktop\FRST64.exe
2014-05-20 17:09 - 2014-05-20 17:09 - 00000628 _____ () C:\Users\Andrea 2\Desktop\JRT.txt
2014-05-20 17:03 - 2014-05-20 17:03 - 00000000 ____D () C:\Windows\ERUNT
2014-05-20 16:59 - 2014-05-20 16:59 - 01016261 _____ (Thisisu) C:\Users\Andrea\Desktop\JRT.exe
2014-05-20 16:20 - 2014-05-20 16:29 - 00000000 ____D () C:\AdwCleaner
2014-05-20 16:19 - 2014-05-20 16:19 - 01326389 _____ () C:\Users\Andrea\Desktop\adwcleaner_3.210.exe
2014-05-20 14:18 - 2014-05-20 14:18 - 00015040 _____ () C:\ComboFix.txt
2014-05-20 14:12 - 2014-05-20 14:18 - 00000000 ____D () C:\Qoobox
2014-05-20 14:12 - 2014-05-20 14:17 - 00000000 ____D () C:\Windows\erdnt
2014-05-20 14:12 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-20 14:12 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-20 14:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-20 14:12 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-20 13:51 - 2014-05-20 13:51 - 05200426 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2014-05-20 00:18 - 2014-05-20 00:18 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Apps\2.0
2014-05-19 18:10 - 2014-05-19 18:10 - 00001421 _____ () C:\Users\Andrea\Desktop\Internet Explorer.lnk
2014-05-19 17:33 - 2014-05-19 17:33 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Microsoft Help
2014-05-19 12:35 - 2014-05-19 12:35 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Apple Computer
2014-05-18 23:31 - 2014-05-21 21:47 - 00000442 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-05-18 23:31 - 2014-05-11 23:54 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_wpdcomp_01_09_00.Wdf
2014-05-18 23:31 - 2014-04-01 04:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ggsemc_01009.Wdf
2014-05-18 23:31 - 2014-04-01 04:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ggflt_01009.Wdf
2014-05-18 23:31 - 2014-04-01 04:00 - 00027760 _____ (Sony Ericsson Mobile Communications) C:\Windows\system32\Drivers\ggsemc.sys
2014-05-18 23:31 - 2014-04-01 04:00 - 00014448 _____ (Sony Ericsson Mobile Communications) C:\Windows\system32\Drivers\ggflt.sys
2014-05-18 23:31 - 2014-02-07 01:59 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2014-05-18 23:31 - 2014-02-06 21:26 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-05-18 23:31 - 2014-02-01 21:20 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_cvusbdrv_01005.Wdf
2014-05-18 23:31 - 2014-02-01 17:20 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WUDFUsbccidDriver_01_09_00.Wdf
2014-05-18 23:31 - 2014-02-01 17:19 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-05-18 23:31 - 2013-10-09 21:35 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2014-05-18 23:31 - 2013-10-09 21:34 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-05-18 23:31 - 2013-10-09 21:34 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-05-18 23:31 - 2013-10-09 20:41 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2014-05-18 23:31 - 2013-10-09 19:48 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BTHUSB.SYS
2014-05-18 23:31 - 2013-10-09 19:44 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2014-05-18 23:31 - 2013-10-09 19:44 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2014-05-18 23:31 - 2013-10-09 19:44 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2014-05-18 23:31 - 2013-10-09 19:44 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2014-05-18 23:31 - 2013-10-09 19:44 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00239320 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00239296 _____ (ESET) C:\Windows\system32\Drivers\edevmon.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00220232 _____ (ESET) C:\Windows\system32\Drivers\epfw.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00168256 _____ (ESET) C:\Windows\system32\Drivers\ehdrv.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00062136 _____ (ESET) C:\Windows\system32\Drivers\epfwwfp.sys
2014-05-18 23:31 - 2013-09-17 15:17 - 00044120 _____ (ESET) C:\Windows\system32\Drivers\EpfwLWF.sys
2014-05-18 23:31 - 2013-08-06 16:13 - 00023040 _____ (Apple Inc.) C:\Windows\system32\Drivers\netaapl64.sys
2014-05-18 23:31 - 2013-03-18 17:51 - 00054784 _____ (Apple, Inc.) C:\Windows\system32\Drivers\usbaapl64.sys
2014-05-18 23:31 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2014-05-18 23:31 - 2011-02-16 16:53 - 00014464 _____ (Western Digital Technologies) C:\Windows\system32\Drivers\wdcsam64.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00215936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00155008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpio.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00140672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msdsm.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00103808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sbp2port.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00078720 _____ (Hewlett-Packard Company) C:\Windows\system32\Drivers\HpSAMD.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00031104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msahci.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffp_sd.sys
2014-05-18 23:31 - 2010-11-21 05:23 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpipmi.sys
2014-05-18 23:31 - 2010-07-25 02:35 - 06858240 _____ (ATI Technologies Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2014-05-18 23:31 - 2010-07-25 00:55 - 00264192 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2014-05-18 23:31 - 2010-07-25 00:54 - 00053248 _____ (ATI Technologies Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2014-05-18 23:31 - 2010-07-22 04:19 - 00515584 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt64.sys
2014-05-18 23:31 - 2010-07-15 10:47 - 00116240 _____ (ATI Technologies, Inc.) C:\Windows\system32\Drivers\AtihdW76.sys
2014-05-18 23:31 - 2010-02-01 23:21 - 00047632 _____ (CACE Technologies, Inc.) C:\Windows\system32\Drivers\npf.sys
2014-05-18 23:31 - 2010-02-01 23:20 - 03058168 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\BCMWL664.SYS
2014-05-18 23:31 - 2010-02-01 23:20 - 00022520 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\bcm42rly.sys
2014-05-18 23:31 - 2009-11-03 18:40 - 00038440 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\cvusbdrv.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00491088 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\adp94xx.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00339536 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\adpahci.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00194128 _____ (AMD Technologies Inc.) C:\Windows\system32\Drivers\amdsbs.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00182864 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\adpu320.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00097856 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\arcsas.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00087632 _____ (Adaptec, Inc.) C:\Windows\system32\Drivers\arc.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00061008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00021584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\compbatt.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00017488 _____ (CMD Technology, Inc.) C:\Windows\system32\Drivers\cmdide.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00015440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdide.sys
2014-05-18 23:31 - 2009-07-14 03:52 - 00015440 _____ (Acer Laboratories Inc.) C:\Windows\system32\Drivers\aliide.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00284736 _____ (LSI Corporation, Inc.) C:\Windows\system32\Drivers\MegaSR.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00122960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
2014-05-18 23:31 - 2009-07-14 03:48 - 00115776 _____ (LSI Corporation) C:\Windows\system32\Drivers\lsi_scsi.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00114752 _____ (LSI Corporation) C:\Windows\system32\Drivers\lsi_fc.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00106560 _____ (LSI Corporation) C:\Windows\system32\Drivers\lsi_sas.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00065600 _____ (LSI Corporation) C:\Windows\system32\Drivers\lsi_sas2.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00051264 _____ (IBM Corporation) C:\Windows\system32\Drivers\nfrd960.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00044112 _____ (Intel Corp./ICP vortex GmbH) C:\Windows\system32\Drivers\iirsp.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00035392 _____ (LSI Corporation) C:\Windows\system32\Drivers\megasas.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00020544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
2014-05-18 23:31 - 2009-07-14 03:48 - 00016960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelide.sys
2014-05-18 23:31 - 2009-07-14 03:47 - 00530496 _____ (Emulex) C:\Windows\system32\Drivers\elxstor.sys
2014-05-18 23:31 - 2009-07-14 03:47 - 00065088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\GAGP30KX.SYS
2014-05-18 23:31 - 2009-07-14 03:47 - 00024144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crcdisk.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 01524816 _____ (QLogic Corporation) C:\Windows\system32\Drivers\ql2300.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00161872 _____ (VIA Technologies Inc.,Ltd) C:\Windows\system32\Drivers\vsmraid.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00128592 _____ (QLogic Corporation) C:\Windows\system32\Drivers\ql40xx.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00080464 _____ (Silicon Integrated Systems) C:\Windows\system32\Drivers\sisraid4.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00064592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
2014-05-18 23:31 - 2009-07-14 03:45 - 00064080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UAGP35.SYS
2014-05-18 23:31 - 2009-07-14 03:45 - 00043584 _____ (Silicon Integrated Systems Corp.) C:\Windows\system32\Drivers\sisraid2.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00024656 _____ (Promise Technology) C:\Windows\system32\Drivers\stexstor.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00021056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wd.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00017488 _____ (VIA Technologies, Inc.) C:\Windows\system32\Drivers\viaide.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00012496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
2014-05-18 23:31 - 2009-07-14 03:45 - 00012352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pciide.sys
2014-05-18 23:31 - 2009-07-14 03:19 - 00286720 _____ (Brother Industries Ltd.) C:\Windows\system32\Drivers\BrSerId.sys
2014-05-18 23:31 - 2009-07-14 02:38 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbprint.sys
2014-05-18 23:31 - 2009-07-14 02:17 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpbus.sys
2014-05-18 23:31 - 2009-07-14 02:07 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthpan.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rfcomm.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidbth.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00072832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ohci1394.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthmodem.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\1394bus.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidir.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\circlass.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthenum.sys
2014-05-18 23:31 - 2009-07-14 02:06 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\umpass.sys
2014-05-18 23:31 - 2009-07-14 02:02 - 00027776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wacompen.sys
2014-05-18 23:31 - 2009-07-14 02:02 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\MTConfig.sys
2014-05-18 23:31 - 2009-07-14 02:01 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sfloppy.sys
2014-05-18 23:31 - 2009-07-14 02:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffdisk.sys
2014-05-18 23:31 - 2009-07-14 02:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffp_mmc.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\parport.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00094208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\serial.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fdc.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\flpydisk.sys
2014-05-18 23:31 - 2009-07-14 02:00 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\serenum.sys
2014-05-18 23:31 - 2009-07-14 01:35 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\blbdrive.sys
2014-05-18 23:31 - 2009-07-14 01:31 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidbatt.sys
2014-05-18 23:31 - 2009-07-14 01:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\errdev.sys
2014-05-18 23:31 - 2009-07-14 01:19 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdk8.sys
2014-05-18 23:31 - 2009-07-14 01:19 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdppm.sys
2014-05-18 23:31 - 2009-07-14 01:19 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\processr.sys
2014-05-18 23:31 - 2009-07-01 12:46 - 00132648 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwavdt.sys
2014-05-18 23:31 - 2009-07-01 12:46 - 00098344 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwaudio.sys
2014-05-18 23:31 - 2009-07-01 12:46 - 00021160 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwrchid.sys
2014-05-18 23:31 - 2009-06-19 17:44 - 00319488 _____ (Texas Instruments) C:\Windows\system32\Drivers\tifm21.sys
2014-05-18 23:31 - 2009-06-10 23:00 - 00017463 _____ () C:\Windows\system32\Drivers\etc\services
2014-05-18 23:31 - 2009-06-10 23:00 - 00003683 _____ () C:\Windows\system32\Drivers\etc\lmhosts.sam
2014-05-18 23:31 - 2009-06-10 23:00 - 00001358 _____ () C:\Windows\system32\Drivers\etc\protocol
2014-05-18 23:31 - 2009-06-10 23:00 - 00000407 _____ () C:\Windows\system32\Drivers\etc\networks
2014-05-18 23:31 - 2009-06-10 22:41 - 00047104 _____ (Brother Industries Ltd.) C:\Windows\system32\Drivers\BrSerWdm.sys
2014-05-18 23:31 - 2009-06-10 22:41 - 00018432 _____ (Brother Industries, Ltd.) C:\Windows\system32\Drivers\BrFiltLo.sys
2014-05-18 23:31 - 2009-06-10 22:41 - 00014976 _____ (Brother Industries Ltd.) C:\Windows\system32\Drivers\BrUsbMdm.sys
2014-05-18 23:31 - 2009-06-10 22:41 - 00014720 _____ (Brother Industries Ltd.) C:\Windows\system32\Drivers\BrUsbSer.sys
2014-05-18 23:31 - 2009-06-10 22:41 - 00008704 _____ (Brother Industries, Ltd.) C:\Windows\system32\Drivers\BrFiltUp.sys
2014-05-18 23:31 - 2009-06-10 22:37 - 00023040 _____ (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) C:\Windows\system32\Drivers\secdrv.sys
2014-05-18 23:31 - 2009-06-10 22:34 - 03286016 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\evbda.sys
2014-05-18 23:31 - 2009-06-10 22:34 - 00468480 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\bxvbda.sys
2014-05-18 23:31 - 2009-06-10 22:34 - 00270848 _____ (Broadcom Corporation) C:\Windows\system32\Drivers\b57nd60a.sys
2014-05-18 23:31 - 2009-06-10 22:31 - 00031232 _____ (Hauppauge Computer Works, Inc.) C:\Windows\system32\Drivers\hcw85cir.sys
2014-05-18 23:31 - 2009-04-07 15:33 - 00035104 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwl2cap.sys
2014-05-18 23:31 - 2008-06-04 15:14 - 00032240 _____ (Dell Inc) C:\Windows\system32\Drivers\PBADRV.SYS
2014-05-18 23:30 - 2014-02-01 17:01 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
2014-05-18 23:30 - 2014-02-01 17:01 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
2014-05-18 23:30 - 2013-10-10 17:04 - 00134656 _____ (Legolash2o) C:\Windows\system32\WinToolkitRunOnce.exe
2014-05-18 23:30 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-05-18 23:30 - 2013-03-18 17:51 - 06112864 _____ (Apple, Inc.) C:\Windows\system32\usbaaplrc.dll
2014-05-18 23:30 - 2012-09-11 14:39 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\wdfcoinstaller01009.dll
2014-05-18 23:30 - 2010-11-21 05:58 - 00018432 _____ () C:\Windows\system32\umstartup.etl
2014-05-18 23:30 - 2010-11-21 05:40 - 00046080 _____ () C:\Windows\system32\umstartup000.etl
2014-05-18 23:30 - 2010-07-22 04:19 - 01952256 _____ (IDT, Inc.) C:\Windows\system32\stlang64.dll
2014-05-18 23:30 - 2010-07-22 04:19 - 00431616 _____ (IDT, Inc.) C:\Windows\system32\stcplx64.dll
2014-05-18 23:30 - 2010-07-22 04:19 - 00209920 _____ (IDT, Inc.) C:\Windows\system32\st646292.dll
2014-05-18 23:30 - 2010-02-01 23:21 - 03161088 _____ (Microsoft Corporation) C:\Windows\system32\vcredist_x64.exe
2014-05-18 23:30 - 2010-02-01 23:21 - 00073728 _____ (Broadcom Corporation) C:\Windows\system32\wltrynt.dll
2014-05-18 23:30 - 2010-02-01 23:21 - 00000457 _____ () C:\Windows\system32\vcredist_x64.bat
2014-05-18 23:30 - 2009-11-03 18:40 - 01919968 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01005.dll
2014-05-18 23:30 - 2009-07-14 03:45 - 00024144 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
2014-05-18 23:30 - 2009-06-10 22:31 - 00001988 _____ () C:\Windows\system32\ticrf.rat
2014-05-18 23:30 - 2008-01-17 19:25 - 02520064 _____ (UPEK, Inc.) C:\Windows\system32\tfmessbsp.dll
2014-05-18 23:29 - 2014-05-21 21:47 - 01527552 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-18 23:29 - 2014-05-21 21:47 - 00661436 _____ () C:\Windows\system32\perfh007.dat
2014-05-18 23:29 - 2014-05-21 21:47 - 00141416 _____ () C:\Windows\system32\perfc007.dat
2014-05-18 23:29 - 2014-05-20 13:43 - 00412616 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-18 23:29 - 2014-05-17 02:08 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-18 23:29 - 2014-03-31 09:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-05-18 23:29 - 2013-10-14 19:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2014-05-18 23:29 - 2013-09-11 20:39 - 00855664 _____ (Microsoft Corporation) C:\Windows\system32\msvcr110_clr0400.dll
2014-05-18 23:29 - 2013-09-11 20:39 - 00614000 _____ (Microsoft Corporation) C:\Windows\system32\msvcp110_clr0400.dll
2014-05-18 23:29 - 2013-09-11 20:39 - 00018000 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100_clr0400.dll
2014-05-18 23:29 - 2011-04-12 09:43 - 00295922 _____ () C:\Windows\system32\perfi007.dat
2014-05-18 23:29 - 2011-04-12 09:43 - 00038104 _____ () C:\Windows\system32\perfd007.dat
2014-05-18 23:29 - 2011-02-20 06:51 - 00608080 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll
2014-05-18 23:29 - 2011-02-19 08:52 - 00829264 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100.dll
2014-05-18 23:29 - 2010-11-21 05:28 - 00029815 _____ () C:\Windows\system32\InstallPackage_ETW.Log
2014-05-18 23:29 - 2010-11-21 05:26 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2014-05-18 23:29 - 2010-11-21 05:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\fsquirt.exe
2014-05-18 23:29 - 2010-11-21 04:52 - 00000050 _____ () C:\Windows\system32\Local_LLU.log
2014-05-18 23:29 - 2010-11-21 04:52 - 00000040 _____ () C:\Windows\system32\Network_LLU.log
2014-05-18 23:29 - 2010-11-21 04:52 - 00000015 _____ () C:\Windows\system32\LocalGroupAdminAdd.log
2014-05-18 23:29 - 2010-07-25 00:43 - 00055296 _____ (AMD) C:\Windows\system32\coinst.dll
2014-05-18 23:29 - 2010-07-22 04:19 - 11941376 _____ (IDT, Inc.) C:\Windows\system32\idtsg64.cpl
2014-05-18 23:29 - 2010-03-22 16:21 - 00283016 _____ () C:\Windows\system32\bipbsp.dll
2014-05-18 23:29 - 2010-03-22 16:16 - 00105864 _____ (Broadcom Corporation) C:\Windows\system32\lms.dll
2014-05-18 23:29 - 2010-03-22 16:15 - 00305544 _____ (Broadcom Corporation) C:\Windows\system32\bipdll.dll
2014-05-18 23:29 - 2010-03-22 16:15 - 00018320 _____ (Broadcom Corporation) C:\Windows\system32\CVUsrIfc.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 08075776 _____ (Dell Inc.) C:\Windows\system32\BCMWLCPL.CPL
2014-05-18 23:29 - 2010-02-01 23:20 - 04750848 _____ (Dell Inc.) C:\Windows\system32\bcmttls.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 01089024 _____ (Dell Inc.) C:\Windows\system32\BCMLogon.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 00095472 _____ (Broadcom Corporation) C:\Windows\system32\bcmwlcoi.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 00060928 _____ (Broadcom Corporation) C:\Windows\system32\bcmwlrmt.dll
2014-05-18 23:29 - 2010-02-01 23:20 - 00006656 _____ () C:\Windows\system32\bcmwlrc.dll
2014-05-18 23:29 - 2010-02-01 23:19 - 03891200 _____ (Broadcom Corporation) C:\Windows\system32\bcmihvsrv64.dll
2014-05-18 23:29 - 2010-02-01 23:19 - 03555840 _____ (Broadcom Corporation) C:\Windows\system32\bcmihvui64.dll
2014-05-18 23:29 - 2009-11-04 12:02 - 00440208 _____ () C:\Windows\system32\brcmbsp.dll
2014-05-18 23:29 - 2009-07-14 06:57 - 00001244 _____ () C:\Windows\system32\migwiz.lnk
2014-05-18 23:29 - 2009-07-14 03:40 - 00019456 _____ (Brother Industries Ltd.) C:\Windows\system32\brcoinst.dll
2014-05-18 23:29 - 2009-07-14 03:40 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\CIRCoInst.dll
2014-05-18 23:29 - 2009-06-10 22:53 - 00215943 _____ () C:\Windows\system32\dssec.dat
2014-05-18 23:29 - 2009-06-10 22:50 - 00000741 _____ () C:\Windows\system32\NOISE.DAT
2014-05-18 23:29 - 2009-06-10 22:47 - 11967524 _____ () C:\Windows\system32\korwbrkr.lex
2014-05-18 23:29 - 2009-06-10 22:47 - 00001696 _____ () C:\Windows\system32\NOISE.CHT
2014-05-18 23:29 - 2009-06-10 22:47 - 00001696 _____ () C:\Windows\system32\NOISE.CHS
2014-05-18 23:29 - 2009-06-10 22:47 - 00001486 _____ () C:\Windows\system32\noise.kor
2014-05-18 23:29 - 2009-06-10 22:47 - 00000697 _____ () C:\Windows\system32\NOISE.THA
2014-05-18 23:29 - 2009-06-10 22:31 - 00008798 _____ () C:\Windows\system32\icrav03.rat
2014-05-18 23:29 - 2008-12-09 19:46 - 00239104 _____ () C:\Windows\system32\bioapi_mds300.dll
2014-05-18 23:29 - 2008-12-09 19:46 - 00155136 _____ () C:\Windows\system32\bioapi100.dll
2014-05-18 23:29 - 2008-06-04 15:14 - 00081904 _____ () C:\Windows\system32\pbadrvdll.dll
2014-05-18 23:28 - 2014-05-21 21:50 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-18 23:28 - 2014-05-21 21:50 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-18 23:28 - 2013-09-11 20:39 - 00030312 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2014-05-18 23:28 - 2010-07-25 02:20 - 20017152 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll
2014-05-18 23:28 - 2010-07-25 01:32 - 00057816 _____ () C:\Windows\system32\atiapfxx.blb
2014-05-18 23:28 - 2010-07-25 01:31 - 00143360 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2014-05-18 23:28 - 2010-07-25 01:29 - 00458752 _____ (AMD) C:\Windows\system32\atieclxx.exe
2014-05-18 23:28 - 2010-07-25 01:29 - 00446464 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\ATIDEMGX.dll
2014-05-18 23:28 - 2010-07-25 01:28 - 00203264 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2014-05-18 23:28 - 2010-07-25 01:27 - 00421376 _____ (ATI Technologies, Inc.) C:\Windows\system32\atipdl64.dll
2014-05-18 23:28 - 2010-07-25 01:27 - 00120320 _____ (AMD) C:\Windows\system32\atitmm64.dll
2014-05-18 23:28 - 2010-07-25 01:27 - 00059392 _____ (ATI Technologies, Inc.) C:\Windows\system32\atiedu64.dll
2014-05-18 23:28 - 2010-07-25 01:27 - 00012288 _____ (AMD) C:\Windows\system32\atimuixx.dll
2014-05-18 23:28 - 2010-07-25 01:02 - 04930560 _____ (ATI Technologies Inc. ) C:\Windows\system32\atiumd64.dll
2014-05-18 23:28 - 2010-07-25 00:56 - 00336384 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2014-05-18 23:28 - 2010-07-25 00:55 - 00018432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll
2014-05-18 23:28 - 2010-07-25 00:55 - 00014848 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll
2014-05-18 23:28 - 2010-07-25 00:55 - 00012800 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2014-05-18 23:28 - 2010-07-25 00:54 - 00030208 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll
2014-05-18 23:28 - 2010-07-25 00:41 - 05265408 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll
2014-05-18 23:28 - 2010-07-25 00:41 - 00043008 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll
2014-05-18 23:28 - 2010-07-25 00:41 - 00039936 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll
2014-05-18 23:28 - 2010-07-25 00:15 - 02752512 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll
2014-05-18 23:28 - 2010-07-25 00:13 - 00534960 _____ () C:\Windows\system32\atiumd6a.cap
2014-05-18 23:28 - 2010-07-24 23:59 - 00054272 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll
2014-05-18 23:28 - 2010-07-24 23:59 - 00054272 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll
2014-05-18 23:28 - 2010-06-02 19:28 - 00002189 _____ () C:\Windows\system32\atipblag.dat
2014-05-18 23:28 - 2010-04-06 15:54 - 00203336 _____ () C:\Windows\system32\atiicdxx.dat
2014-05-18 23:28 - 2010-01-27 04:30 - 00162816 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAC64.dll
2014-05-18 23:28 - 2009-10-10 02:45 - 00442368 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTEC64.dll
2014-05-18 23:28 - 2009-05-11 19:35 - 00118784 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atibtmon.exe
2014-05-18 23:28 - 2009-03-03 03:58 - 00068608 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAR64.dll
2014-05-18 23:28 - 2009-02-18 15:55 - 00332288 _____ () C:\Windows\system32\ATIODE.exe
2014-05-18 23:28 - 2009-02-03 18:52 - 00051200 _____ () C:\Windows\system32\ATIODCLI.exe
2014-05-18 23:27 - 2014-05-19 21:40 - 00000000 ____D () C:\Windows\PCHEALTH
2014-05-18 23:27 - 2014-05-18 05:58 - 00328672 _____ () C:\Windows\Minidump\051814-16629-01.dmp
2014-05-18 23:27 - 2014-05-17 17:26 - 00328672 _____ () C:\Windows\Minidump\051714-16052-01.dmp
2014-05-18 23:27 - 2014-05-17 04:38 - 00328672 _____ () C:\Windows\Minidump\051714-24367-01.dmp
2014-05-18 23:27 - 2014-05-11 23:50 - 00328672 _____ () C:\Windows\Minidump\051114-18361-01.dmp
2014-05-18 23:27 - 2014-04-29 16:06 - 00884960 _____ () C:\Windows\Minidump\042914-13868-01.dmp
2014-05-18 23:27 - 2014-04-09 02:33 - 00328672 _____ () C:\Windows\Minidump\040914-14461-01.dmp
2014-05-18 23:27 - 2014-04-06 20:14 - 00328672 _____ () C:\Windows\Minidump\040614-14976-01.dmp
2014-05-18 23:27 - 2014-04-04 18:59 - 00328672 _____ () C:\Windows\Minidump\040414-15163-01.dmp
2014-05-18 23:27 - 2014-03-22 23:18 - 00374088 _____ () C:\Windows\Minidump\032214-16161-01.dmp
2014-05-18 23:27 - 2014-02-16 02:05 - 00328672 _____ () C:\Windows\Minidump\021614-14804-01.dmp
2014-05-18 23:27 - 2014-02-15 14:32 - 01702232 _____ () C:\Windows\Minidump\021514-21013-01.dmp
2014-05-18 23:27 - 2014-02-09 16:46 - 00328672 _____ () C:\Windows\Minidump\020914-17082-01.dmp
2014-05-18 23:27 - 2014-02-08 19:14 - 00328672 _____ () C:\Windows\Minidump\020814-14430-01.dmp
2014-05-18 23:21 - 2014-05-21 22:17 - 01206823 _____ () C:\Windows\WindowsUpdate.log
2014-05-18 23:21 - 2014-05-21 21:43 - 00021217 _____ () C:\Windows\setupact.log
2014-05-18 23:21 - 2014-05-20 19:30 - 677465861 _____ () C:\Windows\MEMORY.DMP
2014-05-18 23:21 - 2014-05-20 16:31 - 00034810 _____ () C:\Windows\PFRO.log
2014-05-18 23:21 - 2014-05-20 14:16 - 00000215 _____ () C:\Windows\system.ini
2014-05-18 23:21 - 2014-05-18 19:38 - 00000658 _____ () C:\Windows\TIPCI.log
2014-05-18 23:21 - 2014-05-18 13:38 - 00009752 _____ () C:\Windows\DPINST.LOG
2014-05-18 23:21 - 2014-05-17 02:31 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-05-18 23:21 - 2014-04-09 19:26 - 00000000 ___HT () C:\Windows\wusa.lock
2014-05-18 23:21 - 2014-02-14 21:32 - 00000478 _____ () C:\Windows\win.ini
2014-05-18 23:21 - 2014-02-02 20:43 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-18 23:21 - 2014-02-01 18:05 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-05-18 23:21 - 2010-07-19 05:55 - 00021591 _____ () C:\Windows\atiogl.xml
2014-05-18 23:21 - 2009-07-14 06:54 - 00000749 ___RH () C:\Windows\WindowsShell.Manifest
2014-05-18 23:21 - 2009-06-10 22:36 - 00001405 _____ () C:\Windows\msdfmap.ini
2014-05-18 23:21 - 2009-06-10 22:31 - 00048201 _____ () C:\Windows\Starter.xml
2014-05-18 23:21 - 2009-06-10 22:30 - 00048265 _____ () C:\Windows\HomePremium.xml
2014-05-18 23:12 - 2014-05-21 22:17 - 00000000 ____D () C:\FRST
2014-05-18 23:12 - 2014-05-19 21:16 - 00000000 ____D () C:\IDE
2014-05-18 19:32 - 2014-05-18 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEC Electronics
2014-05-18 17:38 - 2014-05-18 17:38 - 00000000 ____D () C:\Intel
2014-05-18 14:09 - 2014-05-18 21:17 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Deployment
2014-05-18 14:09 - 2014-05-18 14:09 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Apps\2.0
2014-05-18 13:58 - 2014-05-18 13:58 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Dell
2014-05-18 13:58 - 2014-05-18 13:58 - 00000000 ____D () C:\ProgramData\Dell
2014-05-18 13:43 - 2014-05-18 13:43 - 00000000 ____D () C:\Users\Andrea 2\Documents\Bluetooth-Exchange-Ordner
2014-05-18 13:43 - 2014-05-18 13:43 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Broadcom
2014-05-18 13:40 - 2014-05-18 13:40 - 00000000 ____D () C:\Program Files\WIDCOMM
2014-05-18 12:55 - 2014-05-18 12:55 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-18 12:53 - 2014-05-19 13:24 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DW WLAN
2014-05-18 12:53 - 2014-05-18 13:59 - 00000000 ____D () C:\Program Files\Dell
2014-05-18 11:03 - 2014-05-18 11:03 - 00000000 ____D () C:\Users\Andrea 2\AppData\Roaming\ESET
2014-05-18 11:03 - 2014-05-18 11:03 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\ESET
2014-05-18 06:01 - 2014-05-18 06:01 - 00000000 __SHD () C:\Users\Andrea 2\AppData\Local\EmieUserList
2014-05-18 06:01 - 2014-05-18 06:01 - 00000000 __SHD () C:\Users\Andrea 2\AppData\Local\EmieSiteList
2014-05-18 05:12 - 2014-05-18 05:14 - 00000000 ____D () C:\Dell
2014-05-18 03:27 - 2014-05-19 13:24 - 00000000 ____D () C:\Users\Andrea\Desktop\DriverView
2014-05-17 22:24 - 2014-05-19 13:24 - 00000000 ____D () C:\Program Files\7-Zip
2014-05-17 21:53 - 2014-05-17 21:53 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-05-17 07:29 - 2014-05-17 07:33 - 00023735 _____ () C:\Users\Andrea\Desktop\Eset Scan 17-05-14.txt
2014-05-17 07:12 - 2014-05-17 04:20 - 00050935 _____ () C:\Users\Andrea\Documents\ndl19844.dat
2014-05-17 05:44 - 2014-05-17 05:44 - 00001191 _____ () C:\Users\Andrea\Desktop\Gmer.txt
2014-05-17 05:26 - 2014-05-17 05:27 - 00027345 _____ () C:\Users\Andrea\Desktop\FRST (2).txt
2014-05-17 05:26 - 2014-05-17 05:27 - 00026097 _____ () C:\Users\Andrea\Desktop\Addition.txt
2014-05-17 05:21 - 2014-05-17 05:21 - 00000478 _____ () C:\Users\Andrea\Desktop\defogger_disable.log
2014-05-17 05:21 - 2014-05-17 05:21 - 00000000 _____ () C:\Users\Andrea 2\defogger_reenable
2014-05-17 03:36 - 2014-05-19 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\Program Files\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Local\ESET
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-10 22:25 - 2014-05-10 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 02:24 - 2014-05-10 02:25 - 00000000 ____D () C:\Users\Andrea\Desktop\Gruber
2014-05-07 01:28 - 2014-05-19 13:33 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 17:48 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 17:48 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 01:59 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 01:59 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 01:59 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 01:59 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

==================== One Month Modified Files and Folders =======

2014-05-21 22:17 - 2014-05-21 22:17 - 00003984 _____ () C:\Users\Andrea 2\Desktop\FRST.txt
2014-05-21 22:17 - 2014-05-18 23:21 - 01206823 _____ () C:\Windows\WindowsUpdate.log
2014-05-21 22:17 - 2014-05-18 23:12 - 00000000 ____D () C:\FRST
2014-05-21 22:14 - 2014-05-21 22:14 - 02067456 _____ (Farbar) C:\Users\Andrea 2\Desktop\FRST64.exe
2014-05-21 22:06 - 2014-02-01 19:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-21 21:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-21 21:50 - 2014-05-18 23:28 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-21 21:50 - 2014-05-18 23:28 - 00028320 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-21 21:47 - 2014-05-18 23:31 - 00000442 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-05-21 21:47 - 2014-05-18 23:29 - 01527552 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-21 21:47 - 2014-05-18 23:29 - 00661436 _____ () C:\Windows\system32\perfh007.dat
2014-05-21 21:47 - 2014-05-18 23:29 - 00141416 _____ () C:\Windows\system32\perfc007.dat
2014-05-21 21:43 - 2014-05-18 23:21 - 00021217 _____ () C:\Windows\setupact.log
2014-05-21 21:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-21 19:40 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-20 22:32 - 2014-02-06 20:54 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-05-20 22:13 - 2014-04-09 19:20 - 00106808 _____ () C:\Users\Andrea 2\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-20 19:48 - 2014-05-20 19:48 - 00001989 _____ () C:\Users\Andrea\Desktop\nt.search-ms
2014-05-20 19:31 - 2014-05-20 19:31 - 00328672 _____ () C:\Windows\Minidump\052014-19968-01.dmp
2014-05-20 19:31 - 2014-02-08 19:14 - 00000000 ____D () C:\Windows\Minidump
2014-05-20 19:30 - 2014-05-18 23:21 - 677465861 _____ () C:\Windows\MEMORY.DMP
2014-05-20 18:44 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-20 17:26 - 2014-05-20 17:25 - 00053330 _____ () C:\Users\Andrea\Desktop\FRST.txt
2014-05-20 17:20 - 2014-05-20 17:20 - 02067456 _____ (Farbar) C:\Users\Andrea\Desktop\FRST64.exe
2014-05-20 17:09 - 2014-05-20 17:09 - 00000628 _____ () C:\Users\Andrea 2\Desktop\JRT.txt
2014-05-20 17:03 - 2014-05-20 17:03 - 00000000 ____D () C:\Windows\ERUNT
2014-05-20 16:59 - 2014-05-20 16:59 - 01016261 _____ (Thisisu) C:\Users\Andrea\Desktop\JRT.exe
2014-05-20 16:31 - 2014-05-18 23:21 - 00034810 _____ () C:\Windows\PFRO.log
2014-05-20 16:29 - 2014-05-20 16:20 - 00000000 ____D () C:\AdwCleaner
2014-05-20 16:19 - 2014-05-20 16:19 - 01326389 _____ () C:\Users\Andrea\Desktop\adwcleaner_3.210.exe
2014-05-20 14:18 - 2014-05-20 14:18 - 00015040 _____ () C:\ComboFix.txt
2014-05-20 14:18 - 2014-05-20 14:12 - 00000000 ____D () C:\Qoobox
2014-05-20 14:17 - 2014-05-20 14:12 - 00000000 ____D () C:\Windows\erdnt
2014-05-20 14:16 - 2014-05-18 23:21 - 00000215 _____ () C:\Windows\system.ini
2014-05-20 14:07 - 2014-04-09 19:19 - 00000000 ____D () C:\Users\Andrea 2
2014-05-20 13:51 - 2014-05-20 13:51 - 05200426 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2014-05-20 13:43 - 2014-05-18 23:29 - 00412616 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-20 01:15 - 2014-02-01 18:05 - 00106808 _____ () C:\Users\Andrea\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-20 00:18 - 2014-05-20 00:18 - 00000000 ____D () C:\Users\Andrea\AppData\Local\Apps\2.0
2014-05-19 21:42 - 2011-04-12 09:54 - 00000000 ____D () C:\Windows\ShellNew
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\hr-HR
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\he-IL
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\et-EE
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\bg-BG
2014-05-19 21:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\ar-SA
2014-05-19 21:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help
2014-05-19 21:40 - 2014-05-18 23:27 - 00000000 ____D () C:\Windows\PCHEALTH
2014-05-19 21:16 - 2014-05-18 23:12 - 00000000 ____D () C:\IDE
2014-05-19 18:10 - 2014-05-19 18:10 - 00001421 _____ () C:\Users\Andrea\Desktop\Internet Explorer.lnk
2014-05-19 17:39 - 2014-02-01 19:13 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-19 17:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-05-19 17:33 - 2014-05-19 17:33 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Microsoft Help
2014-05-19 13:33 - 2014-05-07 01:28 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-19 13:33 - 2014-04-09 19:20 - 00000000 ___RD () C:\Users\Andrea 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 13:33 - 2014-04-09 19:20 - 00000000 ___RD () C:\Users\Andrea 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 13:33 - 2014-02-27 19:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-05-19 13:33 - 2014-02-27 19:36 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-05-19 13:33 - 2014-02-27 19:36 - 00000000 ____D () C:\Program Files\iTunes
2014-05-19 13:33 - 2014-02-27 19:36 - 00000000 ____D () C:\Program Files\iPod
2014-05-19 13:33 - 2014-02-27 19:36 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-05-19 13:33 - 2014-02-06 20:54 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-05-19 13:33 - 2014-02-06 20:54 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-05-19 13:33 - 2014-02-06 20:53 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-05-19 13:33 - 2014-02-06 20:53 - 00000000 ____D () C:\Program Files\Bonjour
2014-05-19 13:33 - 2014-02-06 20:53 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-05-19 13:33 - 2014-02-01 19:55 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-05-19 13:33 - 2014-02-01 19:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-05-19 13:33 - 2014-02-01 19:49 - 00000000 ____D () C:\Program Files (x86)\K-Lite Codec Pack
2014-05-19 13:33 - 2014-02-01 19:37 - 00000000 ____D () C:\Windows\system32\Macromed
2014-05-19 13:33 - 2014-02-01 18:01 - 00000000 ____D () C:\Windows\system32\SRSLabs
2014-05-19 13:33 - 2014-02-01 18:00 - 00000000 ____D () C:\Windows\tiinst
2014-05-19 13:33 - 2014-02-01 18:00 - 00000000 ____D () C:\Program Files\IDT
2014-05-19 13:33 - 2014-02-01 17:56 - 00000000 ____D () C:\Program Files\WinRAR
2014-05-19 13:33 - 2014-02-01 17:49 - 00000000 ___RD () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 13:33 - 2014-02-01 17:49 - 00000000 ___RD () C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\security
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\schemas
2014-05-19 13:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-05-19 13:30 - 2014-02-01 17:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-19 13:30 - 2014-02-01 17:58 - 00000000 ____D () C:\Program Files (x86)\NEC Electronics
2014-05-19 13:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-05-19 13:24 - 2014-05-18 12:53 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DW WLAN
2014-05-19 13:24 - 2014-05-18 03:27 - 00000000 ____D () C:\Users\Andrea\Desktop\DriverView
2014-05-19 13:24 - 2014-05-17 22:24 - 00000000 ____D () C:\Program Files\7-Zip
2014-05-19 13:24 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2014-05-19 12:35 - 2014-05-19 12:35 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\Apple Computer
2014-05-19 12:35 - 2014-02-01 17:49 - 00000000 ____D () C:\Users\Andrea
2014-05-19 12:34 - 2014-02-06 20:53 - 00000000 ____D () C:\ProgramData\Apple
2014-05-18 21:17 - 2014-05-18 14:09 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Deployment
2014-05-18 19:38 - 2014-05-18 23:21 - 00000658 _____ () C:\Windows\TIPCI.log
2014-05-18 19:32 - 2014-05-18 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEC Electronics
2014-05-18 17:38 - 2014-05-18 17:38 - 00000000 ____D () C:\Intel
2014-05-18 14:09 - 2014-05-18 14:09 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Apps\2.0
2014-05-18 13:59 - 2014-05-18 12:53 - 00000000 ____D () C:\Program Files\Dell
2014-05-18 13:58 - 2014-05-18 13:58 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Dell
2014-05-18 13:58 - 2014-05-18 13:58 - 00000000 ____D () C:\ProgramData\Dell
2014-05-18 13:43 - 2014-05-18 13:43 - 00000000 ____D () C:\Users\Andrea 2\Documents\Bluetooth-Exchange-Ordner
2014-05-18 13:43 - 2014-05-18 13:43 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\Broadcom
2014-05-18 13:40 - 2014-05-18 13:40 - 00000000 ____D () C:\Program Files\WIDCOMM
2014-05-18 13:38 - 2014-05-18 23:21 - 00009752 _____ () C:\Windows\DPINST.LOG
2014-05-18 12:55 - 2014-05-18 12:55 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-18 11:03 - 2014-05-18 11:03 - 00000000 ____D () C:\Users\Andrea 2\AppData\Roaming\ESET
2014-05-18 11:03 - 2014-05-18 11:03 - 00000000 ____D () C:\Users\Andrea 2\AppData\Local\ESET
2014-05-18 06:01 - 2014-05-18 06:01 - 00000000 __SHD () C:\Users\Andrea 2\AppData\Local\EmieUserList
2014-05-18 06:01 - 2014-05-18 06:01 - 00000000 __SHD () C:\Users\Andrea 2\AppData\Local\EmieSiteList
2014-05-18 05:58 - 2014-05-18 23:27 - 00328672 _____ () C:\Windows\Minidump\051814-16629-01.dmp
2014-05-18 05:14 - 2014-05-18 05:12 - 00000000 ____D () C:\Dell
2014-05-17 21:53 - 2014-05-17 21:53 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-05-17 17:26 - 2014-05-18 23:27 - 00328672 _____ () C:\Windows\Minidump\051714-16052-01.dmp
2014-05-17 07:33 - 2014-05-17 07:29 - 00023735 _____ () C:\Users\Andrea\Desktop\Eset Scan 17-05-14.txt
2014-05-17 05:44 - 2014-05-17 05:44 - 00001191 _____ () C:\Users\Andrea\Desktop\Gmer.txt
2014-05-17 05:27 - 2014-05-17 05:26 - 00027345 _____ () C:\Users\Andrea\Desktop\FRST (2).txt
2014-05-17 05:27 - 2014-05-17 05:26 - 00026097 _____ () C:\Users\Andrea\Desktop\Addition.txt
2014-05-17 05:21 - 2014-05-17 05:21 - 00000478 _____ () C:\Users\Andrea\Desktop\defogger_disable.log
2014-05-17 05:21 - 2014-05-17 05:21 - 00000000 _____ () C:\Users\Andrea 2\defogger_reenable
2014-05-17 04:38 - 2014-05-18 23:27 - 00328672 _____ () C:\Windows\Minidump\051714-24367-01.dmp
2014-05-17 04:20 - 2014-05-17 07:12 - 00050935 _____ () C:\Users\Andrea\Documents\ndl19844.dat
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\ProgramData\ESET
2014-05-17 03:36 - 2014-05-17 03:36 - 00000000 ____D () C:\Program Files\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Roaming\ESET
2014-05-17 03:27 - 2014-05-17 03:27 - 00000000 ____D () C:\Users\Andrea\AppData\Local\ESET
2014-05-17 02:31 - 2014-05-18 23:21 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-05-17 02:09 - 2014-02-01 19:22 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-17 02:08 - 2014-05-18 23:29 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-17 02:08 - 2014-05-17 02:08 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-16 22:06 - 2014-02-01 19:37 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-16 22:06 - 2014-02-01 19:37 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-16 22:06 - 2014-02-01 19:37 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-11 23:54 - 2014-05-18 23:31 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_wpdcomp_01_09_00.Wdf
2014-05-11 23:50 - 2014-05-18 23:27 - 00328672 _____ () C:\Windows\Minidump\051114-18361-01.dmp
2014-05-11 23:49 - 2014-02-01 19:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-10 22:25 - 2014-05-10 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-10 02:25 - 2014-05-10 02:24 - 00000000 ____D () C:\Users\Andrea\Desktop\Gruber
2014-04-30 19:22 - 2014-02-17 18:13 - 00000000 ____D () C:\Users\Andrea\Desktop\Musiik
2014-04-29 16:06 - 2014-05-18 23:27 - 00884960 _____ () C:\Windows\Minidump\042914-13868-01.dmp
2014-04-29 16:01 - 2014-05-06 01:59 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-06 01:59 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-06 01:59 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-06 01:59 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

Some content of TEMP:
====================
C:\Users\Andrea 2\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-20 04:12

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-05-2014
Ran by Andrea 2 at 2014-05-21 22:17:47
Running from C:\Users\Andrea 2\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Disabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{47938B5E-5D52-7A4B-2D5C-432B7B24AB2C}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
BioAPI Framework (Version: 1.0.1 - Dell Inc.) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0724.2243.38944 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0724.2243.38944 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0724.2243.38944 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0724.2243.38944 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help English (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help French (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help German (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0724.2242.38944 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0724.2243.38944 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0724.2243.38944 - ATI) Hidden
Dell ControlVault Host Components Installer 64Bit (Version: 1.7.459.360 - Broadcom Corporation) Hidden
Dell Security Device Driver Pack (HKLM-x32\...\{FF1DDCF4-3A28-4F7F-96D8-E3F4BD1C1702}) (Version: 1.4.056 - Dell Inc.)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6292.0 - IDT)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
K-Lite Codec Pack 10.2.0 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.2.0 - )
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.18.0 - NEC Electronics Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0 - NEC Electronics Corporation) Hidden
Nero 7.11.10.0 Lite (HKLM-x32\...\Nero7Lite_is1) (Version: 7.11.10.0 - Nero AG)
Texas Instruments PCIxx21/x515/xx12 drivers. (HKLM-x32\...\InstallShield_{B54B8CD3-E12B-4C29-AF5A-2101E2FF5F53}) (Version: 2.00.0005 - Texas Instruments Inc.)
TIPCI (x32 Version: 2.00.0005 - Texas Instruments Inc.) Hidden
UPEK TouchChip Fingerprint Reader (Version: 1.2.0 - Dell Inc.) Hidden
Windows-Treiberpaket - Dell Inc. PBADRV System  (09/11/2009 1.0.1.6) (HKLM\...\9512AA21B791B05A54E27065C45BBC417AB282DF) (Version: 09/11/2009 1.0.1.6 - Dell Inc.)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points  =========================

05-05-2014 16:32:44 Windows Update
05-05-2014 23:59:25 Windows Update
06-05-2014 23:28:36 Windows Update
10-05-2014 20:14:18 Windows Update
16-05-2014 19:28:01 Windows Update
17-05-2014 00:07:13 Windows Update
17-05-2014 00:32:57 Removed Bonjour
17-05-2014 00:33:24 Removed iTunes
17-05-2014 00:37:14 Removed Apple Application Support
17-05-2014 00:38:29 Removed Apple Mobile Device Support
17-05-2014 00:39:08 Removed Apple Software Update
17-05-2014 01:19:02 ESET Smart Security wurde installiert
17-05-2014 01:22:33 ESET Smart Security wurde installiert
17-05-2014 01:35:17 ESET Smart Security wurde installiert
17-05-2014 20:24:19 Installed 7-Zip 9.20 (x64 edition)
18-05-2014 03:15:14 Konfiguriert IDT Audio
18-05-2014 04:27:57 Windows Update
18-05-2014 06:21:38 Windows Update
18-05-2014 11:40:34 Installed Bluetooth Software
18-05-2014 11:46:13 Installed BtwMfcMM
18-05-2014 11:58:46 Installed Dell System Manager.
18-05-2014 13:44:34 Windows-Sicherung
18-05-2014 15:25:52 Installed Dell Latitude ON Configuration Utility Installer.
18-05-2014 17:27:46 Entfernt NEC Electronics USB 3.0 Host Controller Driver
18-05-2014 17:32:30 Installiert NEC Electronics USB 3.0 Host Controller Driver
18-05-2014 17:35:54 Entfernt TIPCI
18-05-2014 17:37:33 Installiert TIPCI
18-05-2014 19:19:17 Removed Dell Precision ON Configuration Utility.
18-05-2014 19:48:42 Windows-Sicherung
19-05-2014 15:32:31 Removed Microsoft Office Professional Plus 2010
19-05-2014 23:41:37 Windows Modules Installer
20-05-2014 11:53:59 Windows Update
20-05-2014 20:42:14 Removed Java 7 Update 51

==================== Hosts content: ==========================

2014-05-18 23:31 - 2013-01-03 11:25 - 00646495 ___RA C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 serial.alcohol-soft.com
127.0.0.1 www.alcohol-soft.com
127.0.0.1 serial.alcohol-soft.com
127.0.0.1 images.alcohol-soft.com
127.0.0.1 trial.alcohol-soft.com
127.0.0.1 forum.alcohol-soft.com
127.0.0.1 support.alcohol-soft.com
127.0.0.1 users.alcohol-soft.com
127.0.0.1 shop.alcohol-soft.com
127.0.0.1 vodka.alcohol-soft.com
127.0.0.1 *.alcohol-soft.com
127.0.0.1 *.alcohol-soft.*
127.0.0.1 iw2.slysoft.com
127.0.0.1 h3.slysoft.com
127.0.0.1 update.slysoft.com
127.0.0.1 slysoft.com
127.0.0.1 sb2slysoft.com
127.0.0.1 ns6.gandi.net
127.0.0.1 ev1slysoft.com
127.0.0.1 reverse.privatedns.com
127.0.0.1 update.slysoft.com
127.0.0.1 ev1slysoft.com
127.0.0.1 flashfxp.com
127.0.0.1 flashfxp.org
127.0.0.1 flashfxp.ws
127.0.0.1 www.flashfxp.com
127.0.0.1 www.flashfxp.org
127.0.0.1 www.flashfxp.ws
127.0.0.1 liveupdate.inicom.net/verify.php

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {62BA4D3D-253B-44BB-A506-B1463FC234C7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-16] (Adobe Systems Incorporated)
Task: {F8DC6DA2-523A-492D-B7A5-067558DF3F16} - \AutoKMS No Task File <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AESTFilters => 2
MSCONFIG\Services: AMD External Events Utility => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: Credential Vault Host Control Service => 2
MSCONFIG\Services: Credential Vault Host Storage => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: STacSV => 2
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: NUSB3MON => "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe

==================== Faulty Device Manager Devices =============

Name: Broadcom NetXtreme-Gigabit-Ethernet
Description: Broadcom NetXtreme-Gigabit-Ethernet
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Broadcom
Service: b57nd60a
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/21/2014 09:44:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2014 07:41:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2014 07:38:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2014 00:12:57 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/20/2014 10:51:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/20/2014 07:32:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/20/2014 05:14:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (05/21/2014 10:08:53 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 10:08:53 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 10:03:05 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 10:03:05 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 10:02:55 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 10:02:06 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 10:00:54 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 10:00:53 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 09:58:34 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (05/21/2014 09:43:27 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:


Microsoft Office Sessions:
=========================
Error: (05/21/2014 09:44:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2014 07:41:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2014 07:38:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/21/2014 00:12:57 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/20/2014 10:51:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/20/2014 07:32:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/20/2014 05:14:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 16308.19 MB
Available physical RAM: 14637.14 MB
Total Pagefile: 16306.37 MB
Available Pagefile: 14549.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:398.29 GB) NTFS
Drive z: (Volume) (Fixed) (Total:148.95 GB) (Free:132.3 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: 3017E1C1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 000C1EAF)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
ach ja, keine Ahnung ob des relevant für das Problem ist:
nach dem Post gestern mit der ersten FRST-Logfile ist der Laptop mit BSOD abgestürzt!

Dump-File wurde wohl erstellt. aber wo find ich die?

cosinus 21.05.2014 22:24
Okay, dann bitte Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Fl!tsche 22.05.2014 15:03
hier die beiden Logs von Malwarebytes und Eset

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 22.05.2014
Suchlauf-Zeit: 14:47:18
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.05.22.06
Rootkit Datenbank: v2014.05.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Andrea 2

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 295994
Verstrichene Zeit: 5 Min, 31 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 7
PUP.Optional.HDvidCodec.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HDvid-Codec V9.0, In Quarantäne, [313d1440e09b0d29154264386b976d93],
PUP.Optional.1ClickDownload.A, HKU\S-1-5-21-903756670-1242167296-504001174-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\1ClickDownload, In Quarantäne, [f27c8dc7ea910234bbb9ba00669d18e8],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-903756670-1242167296-504001174-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, In Quarantäne, [9cd2d183cdae2b0b17827e4fd92a25db],
PUP.Optional.HDvidCodec.A, HKU\S-1-5-21-903756670-1242167296-504001174-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HDvid-Codec V9.0, In Quarantäne, [640a88cc215acb6b82d58319d13137c9],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-903756670-1242167296-504001174-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\3874, In Quarantäne, [7bf3c292126948eef787385ef70bc13f],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-903756670-1242167296-504001174-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\installdaddy, In Quarantäne, [73fbd97b25563afc80868e2c7d8629d7],
PUP.Optional.HDvidCodec.A, HKU\S-1-5-21-903756670-1242167296-504001174-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HDvid-Codec V9.0, In Quarantäne, [f47ab99b9ddec274084fafedf70b867a],

Registrierungswerte: 2
PUP.Optional.Iminent.A, HKU\S-1-5-21-903756670-1242167296-504001174-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}, In Quarantäne, [94da6ee69dde60d62a6009584bb730d0],
PUP.Optional.Iminent.A, HKU\S-1-5-21-903756670-1242167296-504001174-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{84FF7BD6-B47F-46F8-9130-01B2696B36CB}, In Quarantäne, [94da6ee69dde60d62a6009584bb730d0],

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 1
PUP.Optional.CrossRider.A, C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\dcw0gby5.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.crossrider.bic", "144eb36a8266a17e9c3ad57d04c13637");), Ersetzt,[640a65ef1962bf7776e2562a9c68649c]

Physische Sektoren: 0
(No malicious items detected)


(end)
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=974050a1d7cb27408b0709535fe4f40f
# engine=18366
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-22 01:47:39
# local_time=2014-05-22 03:47:39 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5892 16777213 88 94 267273 10164477 0 0
# scanned=149728
# found=0
# cleaned=0
# scan_time=2145

cosinus 22.05.2014 15:08
Nur Reste.

TFC - Temp File Cleaner

Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
  • Öffne die TFC.exe.
    Vista und Win 7 User mit Rechtsklick "als Administrator starten".
  • Schließe alle anderen Programme.
  • Drücke auf den Button Start.
  • Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.




Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Fl!tsche 23.05.2014 13:25
danke danke danke ... hat wunderbar gefunzt. :applaus:

scheint wirklich wieder sauber zu sein. Nochmal dickes :dankeschoen: an dich!

deine Tipps werd ich mir auf jeden Fall zu Herzen nehmen!!! und auch sonst werd ich mich mehr mit der Materie auseinander setzen - von nüscht kommt nüscht! :)

Sonst läuft der Laptop auch wieder schneller und ruhiger. Bluescreen kam auch keiner mehr. Und Virenfunde sind auch nicht mehr zu vermelden.

Probleme gibts so auch keine, im Moment - hoffe das ich den Status beibehalten kann. Fragen hätt ich noch etliche. da werd ich hier im Forum schauen obs antworten gibt und wenn nicht dann kann ich hier ja auch nachfragen.

gibts sonst noch was was ich bezüglich der Scanner etc. wissen muss - wegen Deinstallation oder so?

auf jeden Fall nochmal Danke!!!

cosinus 23.05.2014 13:40
Dann wären wir durch! :daumenhoc


Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. Es empfiehlt sich Malwarebytes Anti-Malware zu behalten und damit wöchentlich nach Malware zu scannen.

Helfen kann dir dabei delfix:


Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.






Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Fl!tsche 23.05.2014 14:22
SUPER! :Boogie:

werd mich gleich um die Sachen kümmern und nochmal vielen vielen Dank!!!

ihr habt auf jeden Fall nen neuen Fan und Supporter


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:08 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55